Must-Read for CISOs | Cyber Resilience is a Corporate Imperative

Faced with increasingly rampant ransomware attacks and a complex, volatile threat landscape, enterprises must treat cybersecurity resilience as a core business strategy. This requires more than just complying with laws and regulations; it demands a comprehensive consideration of all aspects of the business, from operational continuity to software supply chain security.

▌The Grim Cybersecurity Landscape and Cybersecurity Resilience Levels

In May 2021, Colonial Pipeline was hit by the DarkSide hacker group. CEO Joseph Blount made the decision to pay a US$4.4 million ransom, although this decision was highly controversial. The attack compromised critical US infrastructure, drawing daily attention from the US President. Blount described the decision to pay the ransom as one of the most challenging of his career.

"We were in a very dangerous situation and had to make difficult choices that no company wants to face," Blount said before the US Senate Committee on Homeland Security and Governmental Affairs.

With ransomware payments hitting a record US$1.1 billion in 2023, these frequent attacks are forcing business leaders to face difficult choices more and more often. More and more CSOs and CEOs are realizing that the question is not if they will be attacked, but when.

According to a report published by ISTARI and the University of Oxford, the CEO of a US$4 billion European company stated, "The biggest change is that I now completely accept the fact that an attack will happen. Organizations that accept this possibility have a fundamentally different coping strategy compared to those that think they can resist it."

Too often, enterprises view resilience as a regulatory mandate, failing to provide everything needed to truly recover after an attack. Mehran Farimani, CEO of RapidFort, pointed out that the ability to withstand and recover from cybersecurity incidents requires a shift in mindset, not just meeting compliance requirements.

Achieving true cybersecurity resilience requires a comprehensive approach, including robust backup and recovery systems.

"You might have backed up all your critical software and data, but can you recover quickly after an adverse event? Or will it take two weeks? Do you always ensure that all these systems are checked?" Farimani asked his CSO.

A report on resilience released by Barracuda this April showed that when asked to rate their confidence in handling cyber risks on a scale of 1 to 10, most IT security leaders were not optimistic. Financial services institutions seemed the most prepared, with 55% believing their security posture is highly effective. In contrast, only 32% of companies in industrial and manufacturing sectors expressed optimism, and in retail, the figure was 39%. Overall, smaller companies showed less confidence in dealing with cyber threats.

With rising geopolitical instability, AI, and wealth inequality, CISOs must not only further strengthen their organizations' cybersecurity defences but also help them prepare for the worst-case scenario to ensure they can recover quickly when a cybersecurity incident occurs.

▌Cybersecurity Resilience Has Become a Crucial Business Strategy Element

The concept of cybersecurity resilience has evolved into a critical element of today's overall business strategy. Kory Daniels, CISO at Trustwave, told his CSO: "Boards of directors have started asking the question: is it important to appoint a formal Chief Resilience Officer?"

Given recent high-profile cyberattacks, such as the one experienced by Colonial Pipeline, the availability component of the traditional CIA (Confidentiality, Integrity, and Availability) triad has received increasing emphasis. This is because disruptions not only affect operational continuity but also damage customer trust and overall market perception of the company.

Daniels noted that taking a "holistic approach" to cybersecurity resilience is crucial, requiring consideration of all aspects of the business and all teams, from employees and partners to the board. Often, organizations possess more capabilities internally than they realize, but these resources may be scattered across different departments, and the various groups responsible for building cybersecurity resilience may lack a comprehensive view of existing resources.

Daniels said: "Network and security operations departments possess rich intelligence resources that other departments can benefit from."

Many companies are integrating cybersecurity resilience into their enterprise risk management processes, taking proactive measures to identify vulnerabilities, assess risks, and implement appropriate controls.

Angela Zhao, an analyst at Gartner, stated that these proactive measures include regular validations such as risk assessments and penetration testing, as well as continuous monitoring to detect and respond to threats in real time.

These proactive measures often extend beyond the organization's immediate perimeter to include vendors and partners. Cameron Dicker, Global Business Resilience Lead at FS-ISAC, said: "Companies should conduct a deep analysis of their service providers and software supply chain, identify where security risks lie, and develop corresponding incident response plans."

▌Software Supply Chain: A Critical Part of Cybersecurity Resilience

Trustwave's Daniels pointed out that software supply chain analysis remains a weak link in cybersecurity resilience. He believes organizations should conduct thorough penetration testing and risk assessments on their supply chains, enforce vendor cybersecurity requirements, and develop contingency plans to mitigate the impact of supply chain disruptions on operations.

When selecting potential vendors, especially those that will connect to the company's private network, security leaders must ensure that contracts or Master Service Agreements (MSAs) contain clear provisions for overall resilience, including both cybersecurity and business resilience.

Bobby Williams, Business Continuity Team Lead at GuidePoint Security, pointed out: "Vendors should be held accountable in contracts for defined business continuity, disaster recovery, and information security plans. There should be a clear testing procedure in the contract to demonstrate the vendor's resilience, and the test results should be available for the company to review."

If the vendor provides software services or applications, the contract should specify clear Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). Williams said: "Vendors should be able to demonstrate RTO and RPO through required testing, and the contract should clearly define how the customer's data is backed up and provide a data retention plan." He also added that data mirroring should not be accepted as an alternative to backing up customer data.

▌Artificial Intelligence Confounders Cybersecurity Resilience

The rise of generative AI as a hacker tool has further complicated organizational resilience strategies. This is because generative AI enables even low-skilled individuals to execute sophisticated cyberattacks. This could increase the frequency and severity of attacks, forcing enterprises to elevate their response capabilities.

However, from a defensive standpoint, generative AI tools are not as effective yet. Organizations mainly use them as auxiliary tools. AI has proven effective in areas such as threat detection and analysis, anomaly detection, behavioral monitoring, and automated response systems. AI can also be used for risk management and code review.

Valerie Abend, Global Strategy Lead at Accenture Security, pointed out: "AI algorithms can rapidly analyze massive amounts of data, identify patterns, and detect potential threats or vulnerabilities that might be overlooked by human operators."

Furthermore, AI offers benefits in establishing and maintaining cybersecurity resilience plans. Tamara Nolan, Cyber and Operational Resilience Lead at MorganFranklin Consulting, said: "From developing customized AI security policies to deploying advanced AI technologies and providing ongoing operational support, an organization's solutions should ensure reliability, transparency, and compliance throughout the AI journey."

However, currently, the role of AI in cybersecurity remains auxiliary rather than a replacement for human oversight. Anastasiia Voitova, Security Engineering Lead at Cossack Labs, said: "While AI can assist in certain instrumental aspects, at its current stage of development, its contribution to risk management remains limited. It is a tool for security professionals to use, rather than a direct replacement for security professionals."

Farimani of RapidFort agreed with this view, adding that AI tools can indeed help develop and communicate resilience plans, but are far from reliable enough to run automatically, and it is difficult to trust them to automatically protect systems.

As AI tools improve their capabilities in detecting and responding to threats in real time, the role of AI in cybersecurity resilience is likely to expand in the coming years. In addition, AI could be used to enhance user authentication and access control mechanisms, and improve the overall resilience of critical infrastructure systems.

▌The Global Regulatory Environment Will Drive a Major Shift in Cybersecurity Resilience Posture

The evolving global regulatory landscape makes it difficult for security leaders to fully keep pace with all the regulations they must comply with. However, adhering to these legal requirements helps mitigate risks and maintain an organization's reputation. Trevin Edgeworth, Red Team Practice Director at Bishop Fox, said: "Regulations can indeed help organizations increase focus on enterprise risk management efforts and help improve accountability for their resilience strategies."

The Digital Operational Resilience Act (DORA) and rules issued by the US Securities and Exchange Commission (SEC) are changing how global companies view cyber resilience. Set to take effect on 17 January 2025, DORA aims to strengthen the security of financial entities such as banks, insurance companies, and investment firms. Non-EU financial entities and ICT service providers offering critical technical services to EU financial institutions must also comply with DORA.

Nolan of MorganFranklin told CSOs: "Given this new regulation and widespread concern over continuous cyberattacks, consulting firms are spending less time on all-hazard resilience planning and more time on IT resilience, with a particular focus on the connection between business processes and supporting applications and infrastructure." She advises companies not to settle for a tick-box approach to satisfy regulations like DORA, but to strive to cover all aspects of resilience because "regulations assume that foundational operational resilience elements have already been established before attempting to meet DORA requirements."

Companies operating in the US market also need to be vigilant and ensure compliance with evolving regulations. In July 2023, the Securities and Exchange Commission (SEC) introduced new reporting requirements requiring public companies to disclose material cybersecurity incidents and provide annual disclosures on their cybersecurity risk management, strategy, and governance. To meet these requirements, most public companies have taken proactive measures to ensure they have systems in place to assess and respond to incidents.

In many cases, however, these processes are established outside of the operational resilience framework, and as a result, they are not integrated with the company's crisis management plans. Nolan advises organizations to actively engage with legal and regulatory frameworks and integrate them into their cybersecurity resilience strategies. This approach can help minimize penalties and strengthen their overall cybersecurity resilience posture.

Gartner believes that regulations issued by DORA and the SEC often have a global impact. She said: "Regulatory changes in one jurisdiction often have cross-border implications, as multinationals operating globally need to comply with multiple regulatory frameworks. This leads to a need for organizations to harmonize their cybersecurity resilience strategies across different markets, ensuring consistent security practices and compliance with various regulations."

Regulations have also played a key role in raising awareness of the importance of cybersecurity resilience. Abend of Accenture Security stated that they encourage companies to assess their own security posture, as well as board oversight and governance.

"We are seeing growing awareness of these risks among CEOs, executives, and boards, driven not just by regulatory mandates but by genuine business concerns."

But while regulation helps, merely complying with regulations does not necessarily translate to adequate resilience.

Edgeworth of Bishop Fox said organizations can "fall into a false sense of security, believing that their strong level of compliance equates to a strong security posture."

▌The Importance of People and Awareness

Although many organizations invest in cybersecurity resilience technology solutions, they often overlook the importance of having the right people and fostering a culture of security awareness among them.

Shaha from CyberMaxx said: "The ability to quickly find cybersecurity talent at the right price is creating vulnerabilities in the industry."

Consequently, security leaders must develop robust, diverse sourcing strategies to ensure they meet evolving talent demands.

In addition, Trustwave's Daniels said they should also invest in security training programs that need to go beyond basic awareness of phishing emails and password security. He added that training should "include a deeper understanding of cyber threats, the importance of data protection, and everyone's role in maintaining cybersecurity resilience."

Drills and crisis simulations are highly effective ways to do this. Williams of GuidePoint said: "Companies should ensure their drills use a variety of scenarios to guarantee that response plans can handle a wide range of unexpected events." "If the planning process ensures sufficient relevance and continuous updates, these black swan events will be kept under control."

Such drills should be conducted regularly and should be of a certain level of difficulty. "Only by conducting challenging drills that push the limits of teams, tactics, and procedures can organizations know where their capability boundaries lie and where improvements are needed," said Dicker of FS-ISAC.

"An incident should never be the first test of a response plan."

▌SecuXing Provides a Comprehensive Solution for Cybersecurity Resilience

SecuXing believes that continuous validation and optimization throughout the entire lifecycle of digital transformation are key to enterprise success. SecuXing focuses on providing "continuous validation" services for enterprises in their digital transformation, ensuring that businesses' operations, information security, and customer experience remain stable and optimized in a rapidly changing digital world.

The SecuXing Business Observability Platform starts from a business perspective to build a comprehensive, real-time business monitoring and analysis solution for enterprises. Utilizing powerful intelligent data collection and analysis tools, it allows enterprises to clearly observe every detail in their business processes. The platform collects all relevant data on performance metrics, user behavior, and security incidents in real time, translating it into valuable business insights to help enterprises promptly detect and resolve problems, predict future trends, and make wiser decisions.

The SecuXing Security Metrics Validation Platform is dedicated to using first-hand victim threat intelligence to validate and empower organizations' existing security defense systems, achieving effective cybersecurity deployment. Taking an attacker's perspective, the platform targets the enterprise's security defense system by automatically executing real APT attack scenarios. It analyzes all relevant logs—such as alerts, audits, and operations—generated during simulations of attack techniques across the complete kill chain. This helps discover security defense blind spots, accurately locate weaknesses in security equipment, processes, and personnel, and provides actionable mitigation, remediation, or patching recommendations based on actual data.

Through innovative technologies and solutions, SecuXing provides security safeguards for business continuity and stability, helping enterprises maintain a high level of cybersecurity resilience and achieve continuous and stable business growth.