# Resilience in the Cyberworld: Definitions, Features and Models
## 5 Discussion  
In this discussion we present our idea of extending the concept of key actions to IT systems and critical infrastructure systems. In contrast to the models using four or five key actions as described in the literature (see Figures 2 and 4), we propose the use of the following five key actions and/or attributes: anticipation, error analysis, new (learned) methods of /for resilience, robustness and resistance, recovery and adaptation. It is noticeable that our model includes a combination of key actions and attributes. The reason for this is that methods of reliability, availability, security and so on (key action: resistance) must be permanently active from our point of view. In addition, we consider a continuous \"resilience monitoring\", where in the literature this is discrete, i.e., assessments are made at specific points in time. The process of increasing resilience can be interpreted as the capacity for evolution. The system \"learns\" how to better deal with a disturbance that has already occurred at least once. This process is called evolvability. The term \"evolvability\" originally comes from evolutionary biology and describes the ability of a living organism to bring about a change in its characteristics (attributes) by changing its genes with the aim of improving its (survival) abilities. Two approaches are therefore important for evolvability, which build on each other:  
1. Modification of genes
2. Changes in attributes resulting from 1. The relation between genes and attributes can be transferred to a resilient system as follows: genes contain, among other things, the basic information for the evolution of the attributes of a living organism. The key actions represent the \"genes\" of resilience and the resilience itself has a multitude of attributes (reliability, safety, integrity, etc.). By modifying or improving the key actions (according to Figure 2) the properties of a resilient system can be improved. The model of the four key actions from [6] is very well-suited for the purpose described in [6]. As shown in Figure 4, [PERSON] extends [PERSON]'s model of key actions [6] to include the ability to detect a threat. From our point of view, however, the sole detection of a threat is not sufficient. For the IT area, we believe that modifications of the model are necessary. First, another essential key action must be added: **error analysis**. Error analysis includes  
Figure 4: Cyber-resilience lifecycle [8]. both the detection and the understanding of the detected error. The reason for this is that the system must \"understand\" what the error is in order to react optimally or at least appropriately within the scope of its possibilities. Furthermore, from our point of view, the key action resistance must be considered differently for a (distributed) IT system. An IT system must be able to continuously resist current and future disturbances. A disturbance does not necessarily have to be an event that immediately has negative consequences for the system. A disturbance can also be an attack with the aim of stealing information (e.g., private keys). Such actions, often carried out as side channel attacks [48; 49] do not cause any direct, immediately visible damage. However, if the extraction of the private key is successful, the system is considered broken from a security perspective and can no longer be described as resilient. This eliminates the key action resistance from the cycle. In our model, resistance is divided into permanent and newly learned methods of resistance. This key action is continuously active, whereby \"newly learned\" methods of resistance are added to the permanent methods of resistance after the disturbance has been eliminated. Figure 5 shows our model of the key actions [45]. The components of our model are described below. Please keep in mind that an IT system is under constant change, i.e., its state concerning the key actions is also constantly changing. The boundaries between the key actions are not strict. There is hardly a rapid transition between the states.