# Resilience in the Context of Cyber Security: A Review of the Fundamental Concepts and Relevance
## 5 Challenges and Future Directions  
Cyber resilience has been the subject of numerous studies over time, but various aspects related to this subject still pose challenges and require more in-depth research. The following are issues related to the study of resilience from the point of view of some researchers. The digital transformation, driven by the COVID-19 pandemic, has opened up space for cybercriminals to exploit vulnerabilities [4], while the assessment of cyber resilience has not advanced and is still in its infancy, requiring studies to develop robust and systematic assessment methods, traditionally anchored in two types of approaches: metrics-based and model-based [68]. Developing resilience requires a transition from conventional security measures to evolutionary and predictive approaches. While the conventional approach is based on static security measures, an evolutionary approach makes it possible to constantly improve cyber resilience based on adaptive defense tactics, allowing organizations, based on the history of previous incidents, to better understand their risks and evolve in the prevention of cyber-attacks. The predictive approach, on the other hand, will allow an organization to use data and analysis to predict potential threats, allowing the organization to adapt to new scenarios and provide more effective responses [13]. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Stage** & **Scenario** & **Explanation** \\ \hline \multirow{2}{*}{Planning–Preparation} & \multirow{2}{*}{Before the crisis} & \multicolumn{2}{c}{It includes the structuring and implementation of cyber security management processes to establish resilience capabilities in the operation of IT services.} \\ \hline \multirow{2}{*}{Monitoring–Detection} & \multirow{4}{*}{} & It aims to provide automated tools capable of monitoring the availability and capacity of IT services, as well as identifying anomalies in operations and alerting the responsible parties. \\ \cline{3-3}  & & This refers to the ability of established security systems to deal with a large volume of adverse events without impacting IT operations. \\ \hline \multirow{2}{*}{Response–Adaptation} & \multirow{2}{*}{During the crisis} & It relates to the ability of systems to contain malicious events and reconfigure themselves in such a way as to preserve resources for maintaining IT operations at satisfactory levels. \\ \hline \multirow{2}{*}{Recovery–Reconstruction} & \multirow{2}{*}{} & It implements measures to restore or rebuild the affected IT services to satisfactory operating levels whenever there is a degradation or even an interruption of these services. \\ \hline \multirow{2}{*}{Learning–Optimization} & \multirow{2}{*}{After the crisis} & It refers to the use of knowledge generated by previous cyber incidents to promote improvements in processes, staff training and the configuration of security solutions, improving the capacity of the whole cyber security system to deal with adverse situations. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Defining the stages of cyber resilience. Adversarial training has proven to be an effective defense approach in training deep learning models to increase adversary robustness and can thus be improved and used to deal with attacks in general [69]. This is because, unlike conventional models, an additional step is added to the training of the model, where in addition to clean data, contradictory data is also used, increasing the robustness of the model against adversarial attacks [70; 71]. Thus, the concept of adversarial training can also be used in cyber defense systems, increasing the resilience of these defense systems in the Monitoring-Detection, Resistance-Absorption, Response-Adaptation phases and especially in the Learning-Optimization phase. However, learning algorithms for cyber-attacks based on adversarial training still need to be explored [72].