Organisations continuously face numerous cyber threats in today’s digital landscape and while many prioritise cybersecurity to safeguard digital assets, their strategies for cyber resilience often become neglected.
By Graham Brown, country manager at Commvault SA/SADC
Yet, understanding the distinction between the two and how they complement each other as integrated components is key to developing a comprehensive and robust cyber risk management strategy. It is important to understand that while cyber resilience and cybersecurity are to a degree related, they are also distinct concepts.
Cybersecurity relates to the operational side of an IT environment and focuses on protecting systems, networks and data from unauthorised access and unauthorised use. It also emphasises the prevention and detection of cyber threats to minimise the risk of cyberattacks or breaches before they occur.
Cyber resilience, on the other hand, speaks to the ability of an organisation to withstand or respond to a cyberattack or breach and is therefore focused on the preparation, the response and the subsequent learnings from a cyber incident.
Cyber resilience builds on cybersecurity by ensuring an organisation can continue delivering outcomes despite adverse cyber events. It involves preparation, response, recovery and adaptation to maintain continuity and quickly recover from incidents.
Critical component
A critical component of cyber resilience is the Survival Time Objective (STO), which is the maximum amount of time in which an organisation must detect, respond to and recover from a cyberattack.
There are three basic metrics against which an STO is measured – the time it takes to identify and detect an attack, the time it takes to respond to the incident and the time it takes to recover to a functional state so that the business can continue operating.
So, while cybersecurity aims to prevent cyberattacks and safeguard sensitive information through prevention, detection and response measures, cyber resilience goes beyond this to ensure organisational continuity and swift recovery from cyber incidents.
Cyber resilience must be developed around an organisation’s incident response plans and must incorporate disaster recovery strategies, smart backup or data protection strategies and rigorous testing.
So, while cybersecurity looks after the perimeter, cyber resilience goes far beyond that and plugs in all the bigger parts on top of cyber security to foster a culture of resilience and continuous improvement. Ultimately, cyber resilience is an organic living, breathing component of an organisation that changes and evolves in response to the dynamic cyber threat landscape.
However, by working together, cybersecurity and cyber resilience can significantly enhance an organisation’s overall cyber risk management strategy. By working together, cybersecurity and cyber resilience can help an organisation to better understand the risks and loopholes that bad actors are likely to exploit.
This should inform the organisation’s decisions in terms of which mitigation strategies and tools to use in the early stages of an attack cycle.
View of the environment
Furthermore, by leveraging cybersecurity and cyber resilience, companies can successfully implement detection technology and anomalous detection platforms that provide a real-time view of the IT environment.
Finally, ensuring organisational continuity is about recovering the data, irrespective of where it lives (on-premises, in the cloud or between clouds).
Thus, to develop a comprehensive risk management strategy, organisations should integrate both cybersecurity and cyber resilience into their plans. In this way, it becomes easier for organisations to understand the threat actors, the threat surface and what deception technologies and decoys they should be implementing to create a robust strategy. This can ensure swift recovery and minimal impact in the event of a cyberattack.
Organisations that want to do this successfully should balance their investment between cybersecurity and cyber resilience, in other words, between prevention and response. At the same time, it is also about prioritising risk assessments and vulnerability management, as well as developing a culture of resilience and continuous improvement.
Together, cybersecurity and cyber resilience create a robust strategy for managing cyber risks and organisations should view both as integrated components of their overall risk management strategy. By investing in both, they can protect digital assets and ensure swift recovery in the face of cyber threats.