Proactively defending against cyberattacks and incidents within your organization is the main goal of any good cybersecurity strategy. But what happens WHEN, not IF, your company experiences a cyber incident? In a recent annual survey, 82% of organizations reported at least one successful phishing attack in 2021. This was a 46% increase in email-based attacks over the previous year, with no signs of slowing down.
It is not enough to focus efforts on cyber protection. Proper attention must also be given to business recovery and continuation in the event of a cyber incident. The National Institute of Standards and Technology (NIST) defines a cyber-resilient organization as one that has done as much as possible to anticipate and withstand a cyberattack and... has planned as much as possible to quickly recover, adapt, and resume operations that depend on cyber resources following a cyber incident.
It is important to note that cyber resilience goes beyond recovery after an event. A cyber resilient strategy also includes the ability to limit the effects of a security incident while consistently delivering services, despite any failures resulting from an attack. This continuous service delivery involves restoring existing service methods, as well as the ability to continuously modify service methods to adapt to evolving cyber risks.
The question is, how can your business become cyber-resilient? At the core of an effective cybersecurity strategy, you must have well-developed security policies and plans. These plans will outline how your company protects itself and the technology assets maintained. Here are the basic components to get you started down the path to proactively position your company to be cyber resilient.
Approach & Measure Cyber Risk
Risks are constantly evolving, so a key element of cyber resilience is to have a clear understanding of risk and what is an acceptable level within your organization. Measuring risk should be a recurring exercise, so you can focus resources on the cyber risks with the greatest potential impact as threats evolve and change. What was a major cyber risk last year may now be mitigated, and a new attack surface has developed
Manage & Mitigate Cyber Risk
Once cyber risks have been identified and evaluated, it is necessary to implement tactics and best practices to reduce the likelihood and limit the effects of an attack. By expanding the focus beyond simply preventing criminal network entry, you begin to address cyber resilience strategies that focus on limiting the effects of a cyberattack and the ability to recover with limited damages.
“What is risk? Risk is uncertainty about the outcome. The less data you have, the more uncertainty you have about the outcome.”
– David Friedberg
Challenge Business Continuity Plans Annually
One of the most important documents your organization can create is a Business Continuity Plan (BCP). This plan comprehensively reviews how your organization can preserve business continuity when responding to cyber incidents that cause business disruption of critical operational processes, applications, and IT infrastructure.
With persistent and increasingly sophisticated cyberthreats, the complexity of securing hybrid workforces, poor cybersecurity habits, and the ongoing threat of cyber warfare, BCPs need to be reviewed and challenged annually. Conduct this exercise in a safe environment and capture any opportunities for improvement.
Test Backup & Recovery Plans
It's not enough to have a data backup solution in place and check a box. You must have an ongoing strategy that evaluates your data and applications for appropriate levels of protection based on predetermined recovery time and recovery point objectives (RTO & RPO), and replication alternatives. Because data loss can happen at any time, even without a cyber incident, the RTO and RPO both need to be carefully considered and tested as both have financial implications. With proper planning, a data recovery effort can be taken from days down to hours, directly impacting the data resilience of your company.
Create a Culture of Security
A cyber-resilient organization is dependent upon the company leadership's priority and attitude toward cyber risk. Business leaders will influence the culture of security, which is built on policies and procedures that are enforced throughout the company. Some of the usual policies related to cybersecurity include the following:
- INFORMATION SECURITY POLICY: Define the standards and processes your company uses to secure your network and data.
- TECHNOLOGY ACCEPTABLE USE AGREEMENT: Articulate acceptable employee uses of your company's technology, in addition to the consequences of misuse.
- BUSINESS CONTINUITY PLAN: Demonstrate to your clients, shareholders, and partners that your business is prepared for the worst.
- SECURITY AWARENESS TRAINING: Formal and ongoing security training for employees that reinforces proper end-user behavior through simulated phishing attacks.
It is wise to understand that no organization can be 100% protected from a cyberattack. Our current threat landscape makes it rational to assume a disruption will eventually occur. With this thinking in mind, ensure preparations are in place to respond and recover from a cyber incident with as minimal impact on operations, the financial bottom line, and your organization's reputation.
Being prepared and building cyber-resilience means knowing where your risks lie. If you are questioning your own organization's cyber resilience, consider engaging in a cybersecurity risk assessment. This evaluation will uncover and address hidden cybersecurity risks within your organization.
For more information on improving your organization's cyber resiliency, connect with us at info@systemsengineering.com or call 888.624.6737. Clients, please get in touch with your Systems Engineering Account Manager.
