How to Improve Your Organization’s Cyber Resiliency

Pandemic-era ransomware attacks have highlighted the need for robust cybersecurity safeguards. Now, leading organizations are taking it a step further, embracing a cyber resilience paradigm designed to make incident response agile while ensuring sustainable business operations, regardless of event or impact.

Cyber ​​resilience, as defined by the Ponemon Institute, is a company’s ability to sustain its core business in the face of cyberattacks. NIST defines cyber resilience as “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are activated by cyber resources.”

The practice brings together formerly separate disciplines of information security, business continuity and disaster response (BC/DR) employed to achieve common goals. Although traditional cybersecurity practices were designed to keep cybercriminals out and BC/DR focused on recoverability, cyberresilience aligns the strategies, tactics, and planning of these traditionally siled disciplines. The goal: a more holistic approach than it is possible to address everyone individually.

At the same time, improving cyber resilience is challenging organizations to think differently about their approach to cyber security. Instead of focusing solely on protection, organizations need to anticipate cyber events will happen. Adopting practices and frameworks designed to maintain IT capabilities and system-wide business operations is critical.

“The traditional approach to cybersecurity was to have a good lock on the front door and locks on all windows, with the idea that if my security controls were strong enough, they would keep hackers out,” says Simon Leech, associate director at HPE . Global Competence Center for Security. Pandemic-era changes, including the shift to remote working and accelerated cloud adoption, coupled with new and evolving threat vectors mean traditional approaches are no longer sufficient.

“Cyberresilience is being able to anticipate an unforeseen event, withstand that event, recover, and adapt to what we’ve learned,” says Leech. “What really focuses us on cyber resilience is protecting critical services so we can address business risks as effectively as possible. The point is that there are regular test exercises that ensure that the data backup is also useful in an emergency.”

A cyber resilience roadmap

With a risk-based approach to cyber resilience, organizations are developing practices and designing security to be business conscious. The first step is to conduct a holistic risk assessment across the entire IT estate to understand where risks exist and to identify and prioritize the most critical systems based on business intelligence. “The only way to be 100% secure is to give business users confidence that they can safely conduct their business and allow them to take risks, but in a safe way,” explains Leech.

Another requirement is the adoption of a cybersecurity architecture that embraces modern constructs such as zero trust and incorporates agile concepts such as continuous improvement. It is also necessary to formulate and implement proven incident response plans that detail the roles and responsibilities of all stakeholders so that they are adequately prepared to respond to a cyber incident.

Leech outlines several other recommended actions:

• Be an affiliate of the company. IT needs to fully understand business needs and collaborate with key business stakeholders, rather than serve primarily as a cybersecurity enforcer. “Enable the company to take risks; don’t stop them from being efficient,” he advises.
• Remember that preparation is everything. Cyber ​​resilience teams must evaluate existing architecture documentation and assess the environment, either by scanning the environment for vulnerabilities, conducting penetration testing, or conducting tabletop exercises. This verifies that the systems have the appropriate level of protection to remain operational in the event of a cyber incident. As part of this exercise, organizations must create appropriate response plans and enforce the necessary best practices to bring business back online.
• Underpin a data protection strategy. Different applications have different recovery time objective (RTO) and recovery point objective (RPO) requirements, both of which impact backup and cyber resilience strategies. “It’s not a one-size-fits-all approach,” says Leech. “Organizations can not only think about backups, but [also about] how to relax. It’s about making sure you have the right strategy for the right application.”

The HPE GreenLake Advantage

The HPE GreenLake edge-to-cloud platform is designed with zero trust principles and scalable security as the cornerstone of its architecture. The platform leverages common security building blocks, from silicon to cloud, to continuously protect infrastructure, workloads, and data while adapting to increasingly sophisticated threats.

HPE GreenLake for Data Protection offers a range of services that reduce cybersecurity risks in distributed multicloud environments, prevent ransomware attacks, ensure recovery from disruptions, and protect virtual machine (VM) data and workloads in on-premises and hybrid cloud environments. As part of the HPE GreenLake for Data Protection portfolio, HPE provides access to next-generation as-a-service data protection cloud services, including a disaster recovery service powered by Zerto and HPE Backup and Recovery Service. This offering enables customers to easily manage hybrid cloud backups from a SaaS console while providing policy-based orchestration and automation capabilities.

To help organizations transition from traditional cybersecurity to more robust and holistic cyberresilience practices, HPE’s cybersecurity advisory team offers a variety of consulting and professional services. This includes access to workshops, roadmaps, and architectural consulting services, all focused on fostering organizational resilience and delivering Zero Trust security practices.

HPE GreenLake for Data Protection also helps in the cyber resilience journey as it eliminates upfront costs and over-provisioning risks. “Because you’re paying to use it, HPE GreenLake for Data Protection will scale with the business and you don’t have to worry [about whether] They have enough backup capacity to handle an application that’s growing at a rate that wasn’t predicted,” says Leech.

For further information, click here.