Cyber-Resilience, the major challenge of the 21st century

Our world is experiencing a major industrial revolution and is irremediably moving to the digital world. The latter will bring with it deep changes to our socio-economic, political and cultural ecosystems. It will revolutionise our daily lives and the very functioning of businesses. For instance, autonomous cars will be connected objects constantly exchanging data with their ecosystem. The health world will be similarly changed through robotization and diagnostics using AI. Algorithms will be ubiquitous in decision-making processes, including in the political and judicial worlds. Although this first side of the coin shows that the lives of citizens and businesses will be improved with the emergence of major new opportunities, there is of course the other side of the coin. All of this will generate risks related to the protection, availability, confidentiality, and integrity of data.

2017 and 2018 were key years in terms of security breaches: massive DDOS attacks, ransomware epidemics, and more. On the topic of availability, for instance, British Airways had to cancel over a hundred flights because of the unavailability of the Data Centre managing their data. Data confidentiality was strongly violated, as billions of personal accounts were hacked. 1.2 billion personal and biometric records in India’s largest governmental database were unlawfully made accessible for the price of 500 rupees (€7). 340 million personal records held by the marketing firm Equifax were accessed to. The Cambridge Analytica scandal had a major impact on Facebook. On the topic of integrity, data was massively manipulated, fake news were created, cyber-attacks were conducted against the French and American elections, and more.

Risk is a certainty in cyberspace. Every citizen, business and State will experience breaches. It is necessary to take upstream measures in order to enable the business to recover in as quickly as possible, and in some cases even survive. A paradigm shift is required in order to meet the increasing number and complexity of threats. The traditional approach to Cyber-Security is outdated. This new complexity requires a comprehensive, systemic, pro-active and integrated approach: Cyber-Resilience. In cyberspace, risks are naturally managed, by design, on a “business as usual” basis, to fight changing threats, much in the same way as the immune system protects the human body.

In the physical world, Man is able to recognise threats and protect himself against them. His immune system and defensive reflexes are effective. However, he is as yet unable to naturally recognise the basic threats present in cyberspace. Basic digital hygiene is often neglected. Cyber-Resilience is a culture and form of organisation aimed at preparing, identifying, protecting, detecting, analysing, and responding to incidents and threats. In the event of an impact, it aims at recovering and restoring business in order to ensure the continuity. Being cyber-resilient entails having a cyber-immunity mechanism that identifies threats and makes it possible to deal with them. It learns from the changing environment and improves constantly itself.

Cyber-Resilience is a cycle of continuous improvement: continuous risk analysis, identification of unacceptable risks, strategy and governance, identification of vulnerabilities, action plans. Entrusting the management of IT operations to a Cyber-Resilience expert enables the latter to identify threats on a daily basis through a CERT (Computer Emergency Response Team). He will continuously protect the data and systems through a SOC (Security Operations Centre). His IT operations teams will continuously apply corrective measures, much like the immune system does for the human body. In the event of an attack, it is necessary to analyse, prioritise, respond and remedy to incidents. Forensics analyses, crisis management, communication, and restoring normal operations round off the Cyber-Resilience cycle.

Navigating the digital ocean requires planning. Being cyber-resilient means having the agility and security to meet challenges, withstand the storms of cyberspace and get home safely.