From Cyber security to Cyber Resilience: A Paradigm Shift toward Organization-Wide Adaptive Defense

Organizations are increasingly facing increasingly advanced cyber threats for which traditional security frameworks are struggling to cope. The typical cybersecurity framework that thousands of organizations have adhered to, which is centric to technical controls and departmental silos, is ultimately inadequate for maintaining business operations during and after cyber incidents. Cyber resilience, as a newly evolving, potentially revolutionary model extends beyond the protective framework to encompass anticipating (the dynamic threat landscape), enduring capabilities (to build organizational strength and capacity to withstand events), recovery (iterative remediation and drawdown timelines), and evolving capabilities (to adapt to and change as result of exposures, incidents and/or events). This framework represents the cybersecurity threat as part of a broader perspective on business resilience, requiring transformation at the organization level and culture rather than narrowly focused technical fixes. Shifting the focus from reactive protection to proactive resilience necessitates a cross-functional approach that focuses as much on the technical stack as it does the organizational environment by breaking through barriers of security teams and operations, functions that are historically siloed. Cybersecurity prioritizes attack prevention through narrowly defined procedures and protective technologies, while cyber resilience needs to prioritize maintaining minimum* business functions in the event of potential adversity. Framework has four pillars - anticipate, withstand, recover, and evolve that describe all-encompassing guidance of organizational requirements of organizational capacity and sustainable defense. The implementation of cyber resilience will necessitate organizational culture change away from the responsibility of security being a technical accountability, and ultimately transforming security to organizational accountability. The transitional shift is an elegant evolution as a methodology to build adaptive capacity and eliminate risk tolerance rather than a model of mitigating risk exposure. This places a condition on which organizations need to operate to flourish in the quasi-daily presence of cyber threats while fulfilling operational efficacy and business continuity globally.