Cyber resilience is key to cybersecurity

February 2018 Cyber Security, Security Services & Risk Management

The current focus on ransomware is in itself dangerous, argues Jeremy Capell, executive: cyber resilience, Internet Solutions and ContinuitySA, because it deflects attention away from building an holistic response that includes recovery as well as prevention.

Jeremy Capell.
Jeremy Capell.

“The threat landscape is constantly mutating, and cybercriminals have enormous resources behind them. While security measures to prevent a breach remain important, organisations must devote even more resources to developing the ability to respond to, and recover from, an attack,” he says. “This cyber resilience is critical because chances are that an attack will succeed – how quickly the business can get back up and running will determine its sustainability.”

Capell says that cyber resilience means that cybersecurity can no longer be seen purely as an IT issue, but must be integrated into the broader business continuity and business resilience plan.

“Ultimately, the CEO and board are responsible for the organisation’s ability to continue trading after a disaster, so building a business that is resilient in the face of disaster is very much something they should be driving,” he argues.

When it comes to building cyber resilience, says Tim Quintal, senior product manager: cyber resilience, Internet Solutions, the Cybersecurity Framework developed by the National Institute of Standards and Technology (NIST) offers a great blueprint. The NIST framework comprises five pillars:

• Identify. Manage and govern cybersecurity risk.

• Protect. Traditional firewalls must be supplemented with next generation security technologies such as intrusion prevention systems. E-mails are a key vulnerability, so anti-virus technology must be complemented by user education – the same goes for web security. It is also vital to protect end-point devices which can introduce malware onto networks via, for example, an infected USB. Proper patch management processes are also critical; WannaCry gained access via a vulnerability for which Microsoft had provided a patch several months earlier, so the damage caused was largely preventable.

• Detect. One technique is to deploy ­honeypots, or create clear vulnerabilities, to entice hackers into a quarantine area where they can be studied. Many attacks are undetected for extended periods so this area has a crucial role to play. For example, ransomware is increasingly activated only after an extended period of time, meaning that backups themselves are infected, thus hamstringing response and recovery.

• Respond. Because of cybercrime’s resources and the constant development of new technologies, the likelihood of a breach is real. The organisation must have a plan to respond to a breach, which would include crisis communications with stakeholders. A key element of any response would include proper disaster recovery and backups – the latter must be regularly tested. Response should also include feeding lessons learned into the cyber-resilience plan.

• Recover. Once the immediate response is under way, the organisation must have a strategy and capability for returning to normal operations.

Looking into the future, Capell warns that the constant advance in hacking techniques will accelerate. A growing threat is the emergence of the Internet of Things, which will see millions of scada and PLM devices connected.

“This ‘operational technology’ is typically designed by engineers using old DOS-based software and is intrinsically insecure – a myriad of back doors into corporate networks,” he concludes. “Those that build resilience into their organisations will be those that continue to prosper as technology’s march continues.”

For more information contact ContinuitySA, +27 (0)11 554 8050, cindy.bodenstein@continuitysa.co.za, www.continuitysa.co.za


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

30 years of business continuity
May 2019, ContinuitySA, Technews Publishing , Editor's Choice, Security Services & Risk Management
ContinuitySA is celebrating its 30th anniversary this year and Hi-Tech Security Solutions spoke to CEO Michael Davies about the changes he has seen in the business continuity and disaster recovery markets.

Read more...
The enemy within – insider ­security threats
May 2019, Wolfpack Information Risk , Editor's Choice, Cyber Security, Financial (Industry)
Insider threats in today’s financial world are insidious and destructive and your defence against insiders should start long before the person assumes his/her position.

Read more...
The benefits of background screening
May 2019, iFacts, Managed Integrity Evaluation , Editor's Choice, Security Services & Risk Management
Companies need to be more vigilant about the people they employ by making sure comprehensive background screening checks are conducted.

Read more...
Simplifying fire detection system installations
May 2019, Elvey Security Technologies , Editor's Choice, Fire & Safety, Security Services & Risk Management
A fire detection system needs to be selected with extreme care, as is selecting an installer that not only understands the various technologies employed in fire detection, but that also has the necessary accreditations and certifications.

Read more...
Security workforce management platform
May 2019, Secutel Technologies , CCTV, Surveillance & Remote Monitoring, Integrated Solutions, Security Services & Risk Management
Secutel Technologies says the South African market is excited about body-cam technology and clearly sees the potential benefits.

Read more...
Solar energy storage systems
May 2019, Specialised Battery Systems , Products, Security Services & Risk Management
Specialised Battery Systems has a range of Energy Storage Systems (ESS) available, both standard and custom designed to suit customer requirements.

Read more...
LoJax: Be very careful
May 2019 , Cyber Security
Even replacing drives won’t kill this malware, which is still active more than nine months after researchers from Arbor Networks detailed it.

Read more...
Assessing impacts: The meteors of security and AI
May 2019 , Cyber Security
As security threats evolve and artificial intelligence pervades, what impact are they set to have on business over the next year?

Read more...
Visibility is key, and lacking
May 2019 , Editor's Choice, Cyber Security
Cybercriminals are most likely to be caught on servers and networks, but detecting their time and point of entry remains a mystery.

Read more...
The benefits of machine learning and UEBA
May 2019 , Cyber Security
Combining accurate and essential user behavioural data with machine learning allows you to more accurately monitor your users on an endpoint-by-endpoint basis.

Read more...