Cyber resilience: The key to protecting your entire organization

1. New forms of attack like trojan cryptocurrency degrade computer performance and resources by inserting secret malware for mining cryptocurrencies like Bitcoin.
2. An old form of attack, inbound phishing emails, increased by 250 percent in 2018. As phishing security becomes more sophisticated, so too are the attacks. Today’s phishing campaigns utilize a varied infrastructure and multiple attack points to get past stronger defenses.
3. Attacks are also focusing on different parts of an organization, specifically software supply chains. 2018’s Dofoil targeted a peer-to-peer application within supply chain software and installed coin-mining malware.

 

While most organizations understand the threat, they also need to focus on solutions that create a secure data environment which is resilient and able to defend itself against increasingly sophisticated cyberattacks.

Increasing an organization’s resilience

To help increase stability and lessen the impact to their citizens, an increasing number of government entities have drafted regulations requiring the largest organizations to achieve a true state of operational resilience.

While it will always be necessary to be fully compliant with regulations like GDPR, SOX, HIPAA, MAS, regional banking regulators, and any others that might be relevant to the specific industry, it simply isn’t sufficient for a mature cyber program to use this compliance as the only standard.

Organizations must build a program that incorporates defense in depth and implements fundamental security controls like MFA, encryption, network segmentation, patching, and isolation and reduction of exceptions. We also must consider how operations will continue after a catastrophic cyberattack and build systems that can both withstand attack and be instantaneously resilient even during such an attack.

Extending operational resiliency to cover cybersecurity program should not mean applying different principles to attacks, outages, and third-party failures than one would to physical attacks and natural hazards. In all cases, the emphasis is on having plans in place to deliver essential services whatever the cause of the disruption.

The winning combination: Defense in depth and sophistication of response

 

The ability to do something as simple as restoring from recent backups will be tested in every ransomware attack, and many organizations will fail this test—not because they are not backing up their systems, but because they haven’t tested the quality of their backup procedures or practiced for a cyber event.

While the majority of firms have a disaster recovery plan on paper, nearly a quarter never test that and only 42 percent of global executives are confident their organization could recover from a major cyber event without it affecting their business.

Cybersecurity often focuses on defending against specific threats and vulnerabilities to mitigate cyber risk, but cyber resilience requires a more strategic and holistic view of what could go wrong and how an organization will address it as whole. We must continue to be vigilant and thorough in both security posture, which must be based on “defense in depth,” and in sophistication of response. The cyber events organizations face are real threats, and preparing for them must be treated like any other form of continuity and disaster recovery.