Cyber Resilience

Resilience starts from the assumption that some attacks will get through. It joins prevention with the ability to detect quickly, limit the damage, carry on at a reduced level and restore from clean backups. Practical measures include network segmentation, immutable backups, tested recovery procedures, alternative systems for critical services, clear decision rights and rehearsed communications. It is measured by outcomes, for example how long a critical service can be down (its impact tolerance) and how long recovery actually takes. Cyber resilience is closely tied to operational resilience, with the difference that the cause of disruption is a malicious act. Regulators, including financial supervisors, now ask firms to show it through scenario testing and not only through control lists, and rules such as DORA require testing of ICT resilience. Boards use the recovery-time results to decide where extra spending on backups or standby systems would shorten an outage.

A bank sets a limit that its payment service may be down for no longer than four hours. A simulated attack encrypts the primary data centre. The test shows that restoring from backups takes nine hours because the recovery order was never practised. The bank adds a standby environment and reruns the exercise until the four-hour limit is met.