Cyber-Resilience: Seven Steps for Institutional Survival. Issue 2 (1st February 2017)

• Record Type: Journal Article
• Authors: Conklin, William Arthur; Shoemaker, Dan
• Is Part Of: EDPACS. Volume 55:Issue 2(2017)
• Page Start: 14
• Page End: 22
• Publication Date: 2017-02-01
• Subjects: Electronic data processing -- Auditing -- Periodicals; Computers -- Access control -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.8
• DOI: 10.1080/07366981.2017.1289026
• Languages: English
• ISSNs: 0736-6981

Abstract

Abstract: No enterprise will ever be 100% secure. There are just too many threats. This article presents seven practical steps to achieving cyber-resilience. Cyber resilience is not a traditional defensive stance. It requires a change in the way organizations approach security of its information and communication technology (ICT) asset base. Cyber resilience is integrated into the "bones" of the organization and requires the organization to develop a well-defined, explicit architecture of controls to ensure cyber resiliency. The controls assure provable protection of critical ICT assets and their various interdependencies from every form of electronic, human and physical threat; inside and outside the enterprise's eco-system. Cyber-resilient architectures make attacks less likely to succeed, minimize the consequences when they do, increase the work-factor cost and uncertainty for the adversary, and possibly act as a deterrent against future attacks. Cyber resilience is enforced as an organizational condition rather than a deployed set of explicit countermeasures. This goal requires that a robust set of concrete controls are embedded in the enterprise architecture. Effective implementation of a cyber-resilient enterprise architecture requires strategic vision. It also requires day-to-day engagement across the enterprise to ensure that the controls that enable cyber resilience are effective.