Cyber resilience

For other uses, see Resilience (disambiguation).

Cyber resilience refers to an entity's ability to continuously deliver the intended outcome, despite cyber attacks.^[1] Resilience to cyber attacks is essential to IT systems, critical infrastructure, business processes, organizations, societies, and nation-states. A related term is cyberworthiness,^[2] which is an assessment of the resilience of a system from cyber attacks. It can be applied to a range of software and hardware elements (such as standalone software, code deployed on an internet site, the browser itself, military mission systems, commercial equipment, or IoT devices).

Adverse cyber events are those that negatively impact the availability, integrity, or confidentiality of networked IT systems and associated information and services.^[3] These events may be intentional (e.g. cyber attack) or unintentional (e.g. failed software update) and caused by humans, nature, or a combination thereof.

The objective of cyber resilience is to maintain the entity's ability to deliver the intended outcome continuously at all times.^[4] This means doing so even when regular delivery mechanisms have failed, such as during a crisis or after a security breach. The concept also includes the ability to restore or recover regular delivery mechanisms after such events, as well as the ability to continuously change or modify these delivery mechanisms, if needed in the face of new risks. Backups and disaster recovery operations are part of the process of restoring delivery mechanisms.

Frameworks

Resilience, as defined by Presidential Policy Directive PPD-21, is the ability to prepare for and adapt to changing conditions and withstand and recover rapidly from disruptions.^[5]

The National Institute of Standards and Technology's Special Publication 800-160 Volume 2 Rev. 1^[6] offers a framework for engineering secure and reliable systems—treating adverse cyber events as both resiliency and security issues. In particular 800-160 identifies fourteen techniques that can be used to improve resiliency:

Cyber Resiliency Techniques^[7]

Technique	Purpose
Adaptive Response	Optimize the ability to respond in a timely and appropriate manner.
Analytic Monitoring	Monitor and detect adverse actions and conditions in a timely and actionable manner.
Coordinated Protection	Implement a defense-in-depth strategy, so that adversaries have to overcome multiple obstacles.
Deception	Mislead, confuse, hide critical assets from, or expose covertly tainted assets to, the adversary.
Diversity	Use heterogeneity to minimize common mode failures, particularly attacks exploiting common vulnerabilities.
Dynamic Positioning	Increase the ability to rapidly recover from a non-adversarial incident (e.g., acts of nature) by distributing and diversifying the network distribution.
Dynamic Representation	Keep representation of the network current. Enhance understanding of dependencies among cyber and non-cyber resources. Reveal patterns or trends in adversary behavior.
Non-Persistence	Generate and retain resources as needed or for a limited time. Reduce exposure to corruption, modification, or compromise.
Privilege Restriction	Restrict privileges based on attributes of users and system elements as well as on environmental factors.
Realignment	Minimize the connections between mission-critical and noncritical services, thus reducing the likelihood that a failure of noncritical services will impact mission-critical services.
Redundancy	Provide multiple protected instances of critical resources.
Segmentation	Define and separate system elements based on criticality and trustworthiness.
Substantiated Integrity	Ascertain whether critical system elements have been corrupted.
Unpredictability	Make changes randomly and unexpectedly. Increase an adversary's uncertainty regarding the system protections which they may encounter, thus making it more difficult for them to ascertain the appropriate course of action.

See also

• Critical infrastructure protection
• Decentralization
• Internet censorship
• Peer-to-peer
• Proactive cyber defense
• Resilience (organizational)
• Operational Collaboration
• Airworthiness
• Crashworthiness
• Roadworthiness
• Railworthiness
• Seaworthiness
• Spaceworthiness