The Craft of Cyber-Resilience: Lessons from the Trenches
Channel: FIRST
Date: 2021-02-12

The growing sophistication, frequency and severity of cyberattacks targeting financial sector institutions (but also many other sectors) highlight their inevitability and the impossibility of completely protecting the integrity of critical computer systems. In this context, cyber-resilience offers an attractive complementary alternative to the existing cybersecurity paradigm. Cyber-resilience is defined here as the capacity to withstand, recover from and adapt to the external shocks caused by cyber risks. Resilience has a long and rich history in a number of scientific disciplines, including in engineering and disaster management. There is a growing number of reports from vendors and consulting firms claiming to reveal what makes organizations cyber-resilient. The scientific literature, standard-setting bodies and regulators are also paying closer attention to the concept of cyber-resilience and embedding it in their frameworks. But most of this work remains theoretical and there is very limited empirical research on how organizations that experience high rates of cyberattacks (such as financial institutions) develop their cyber-resilience. This presentation will outline the results of a two-year research project that sought to understand how cyber-resilience is understood and practiced by cybersecurity experts in the financial sector.
--
Dr Benoît Dupont is a Professor of Criminology at the Université de Montréal and the Scientific Director of the Smart Cybersecurity Network (SERENE-RISC), which he founded in 2014. He also holds the Canada Research Chair in Cybersecurity, as well as the Research Chair in the Prevention of Cybercrime, both at the Université de Montréal. He sits as an observer representing the research community on the Board of Directors of the Canadian Cyber Threat Exchange (CCTX). His main research interests include the co-evolution of crime and technology, the social organization of malicious hackers, the governance of cybersecurity (and in particular public-private partnerships that achieve the common good), and the use of AI by law enforcement agencies.