Company Services Clients Careers Blog CONTACT US Home / Cybersecurity / Cyber Resiliency: Preparing for and Mitigating the Inevitable CYBERSECURITY Cyber Resiliency: Preparing for and Mitigating the Inevitable May 16, 2021 While risk management has been in use within information security doctrine for decades, cyber resiliency is a new paradigm has begun to gain ground. It is no longer enough to solely focus on securing networks, as even the most robust controls may be circumvented by sophisticated adversaries. Organizations must now consider the inevitability that their organization’s cyber resources may be compromised. Cyber resiliency bridges the gaps between cybersecurity, mission assurance, and mission continuity. It assumes that at some point, your organization’s cyber resources will be compromised and provides a framework for mitigating damage, recovering, and adapting to threats. In this article, we will cover: What is Cyber Resiliency? Objectives of Cyber Resiliency Zero Trust Architecture Active Cyber Defense Conditional Access and Privilege Restriction Segmentation Recovering and Adapting How TestPros Can Help What is Cyber Resiliency? The National Institute of Standards and Technology (NIST), Special Publication (SP) 800-160 Volume 2: Developing Cyber Resilient Systems: A Systems Engineering Approach, defines cyber resiliency as, “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that include cyber resources.” These goals of cyber resiliency can be defined as: Anticipate - Maintain a state of informed preparedness for adversity Withstand - Continue essential mission or business functions despite adversity Recover - Restore mission or business functions during and after adversity Adapt - Modify mission or business functions and/or supporting capabilities to predicted changes in the technical, operational, or threat environments In other words, cyber resilience requires organizations to do more than just secure their systems. Cyber resilience requires an understanding of the threats within the context of your organization, your assets, the criticality of your assets, the adversaries, and other factors. Objectives of Cyber Resiliency To become more capable of withstanding adversities, organizations must assume compromise is already taking place or will take place in the future, continuously pursuing the cyber resiliency objectives of: Prevent or Avoid - Preclude the successful execution of an attack or the realization of adverse conditions Prepare - Maintain a set of realistic courses of action that address predicted or anticipated adversity Continue - Maximize the duration and viability of essential mission or business functions during adversity Constrain - Limit damage from adversity Reconstitute - Restore as much mission or business functionality as possible after adversity Understand - Maintain useful representations of mission and business dependencies and the status of resources with respect to possible adversity Transform - Modify mission or business functions and supporting processes to handle adversity and address environmental changes more effectively Re-Architect - Modify architectures to handle adversity and address environmental changes more effectively Why? Because today, more than ever, it is important for organizations to be able to continuously deliver the intended outcome, despite adverse cyber events. To accomplish this and build more resilient systems reliant upon cyber resources, organizations must now consider: What are the threats that could impact your organization’s ability to effectively carry out its mission? How do you stop that event from taking place? If you cannot stop it, how do you mitigate the impact? If damage is done, how do you recover from it? What does this all look like in practice? Zero Trust Architecture One approach that has gained significant traction as of late is the building (or rebuilding) of systems to be Zero Trust. According to NIST SP 800-207 Zero Trust Architecture, “Zero trust is a cybersecurity paradigm focused on resource protection and the premise that trust is never granted implicitly but must be continually evaluated. Zero trust architecture is an end-to-end approach to enterprise resource and data security that encompasses identity (person and nonperson entities), credentials, access management, operations, endpoints, hosting environments, and the interconnecting infrastructure.” Zero trust is interesting because it assumes that the network has already been compromised and that to mitigate further damage, threats must be contained. However, it is important to understand that Zero Trust is not a defined standard or specification. It is a set of design principles and security model that has a specific objective/purpose and primarily entails robust monitoring and granular risk-based access controls. In the case of authentication: is the user requesting a given resource who they say they are? In the case of authorization, is the request valid and does the requestor have sufficient privileges? If those two questions cannot be answered affirmatively, then the user and/or request should not be trusted. Active Cyber Defense Another trend in cyber resiliency is a concept referred to “Active Cyber Defense” (ACD). According to the National Security Agency’s (NSA) Information Assurance Directorate (IAD), ACD is defined as, “a component of the U.S. Government’s overall approach to defensive cyber operations. ACD elements complement preventative and regenerative cyber-defense efforts by synchronizing the real-time detection, analysis, and mitigation of threats to critical networks and systems.” ACD is primarily focused on the detection of potentially malicious behavior on systems and the activities that take place in response to those detected behaviors, and encompasses the integration, synchronization, automated sense, sense-making, decision-making, and acting capabilities of an organization. Characteristics of a comprehensive ACD solution may include: automated decision-making that enables the detection and mitigation of cyber-relevant speed; scalable enough to operate on any sized enterprise network; and works in an integrated manner with other network defense capabilities. Conditional Access and Privilege Restriction Some of the more compelling and readily implementable solutions entail placing greater limitations on privileged users and the functions they can execute. Conditional access, or restricting privileges based on certain conditions (e.g., location, IP address, time of day, etc.), which helps to prevent malicious use of compromised login credentials. If a threat actor can log-in to an account, but cannot actually execute administrative functions – what use are the credentials? Another compelling approach is Just-in-time (JIT) privileges. With JIT, privileged users are granted only the privileges necessary to execute a function and their request and actions are logged/audited. In addition, permissions granted with JIT are typically time-based, so that the privileges expire either after the function has been performed or a set period of time has passed. Segmentation Segmentation – or micro-segmentation – refers to the logical (mostly) and physical separation of network component and is a concept or component of Zero Trust Architecture. Within cyber resiliency specifically, segmentation of critical assets is of primary importance and can be achieved via some of the following means: Access control lists (ACLs) VLANs Internal Firewalls PEPs However, even with segmentation, active cyber defense measures, limitations on privileged users and execution of privileged functions, and use of a zero-trust architecture, bad things may still occur. In that event, does your organization have a plan for and means to recover? Is there an institutionalized process and practice in place to mitigate the root causes that led to the event? Recovering and Adapting Even with the most robust security controls and organizational practices, sometimes, cyber resources will be negatively impacted by any number of threats. When that happens, it is important for organizations to have a plan and mechanisms in place to make recovery and business continuity possible. In addition, lessons can always be learned when a compromise takes place. Organizations should conduct root cause analysis after an incident. What caused the issue to take place? Were there vulnerabilities taken advantage of (technical or otherwise)? How does the organization prevent the same incident from taking place in the future? Depending on the cause of the incident, redefinition may be required as well (e.g., changes to system requirements, design, etc.). How TestPros Can Help No organization looks forward to their cyber resources being compromised, or the threat of such. However, TestPros is here to help your organization through the process of building more resilient systems. We can help your organization with: Defining system requirements and identifying critical assets Conducting a risk assessment to better understand the threat environment, as it relates to your organization and its systems Develop a plan to build, re-build, or modify a cyber resilient system Identify cyber incidents taking place and/or analyze incidents that already took place Assist your organization with recovering from a cyber incident Understanding causes of compromise and how best to mitigate future incidents If your organization needs assistance with becoming more resilient cyber resources, please contact us today! Ready to Take the Next Step? Our team is happy to answer your questions and help make your next project successful. Contact us today and we will be in touch as soon as possible. Contact Us! Additional resources you may be interested in CYBERSECURITY Vulnerability in the Age of Remote Work With COVID-19 continuing to run its course across the United States, it is likely that remote work is here to… Lucas Dell'Anno August 11, 2021 ACCESSIBILITY Accessibility in GitHub with Git Flavored Markdown Millions of people use GitHub daily for a variety of reasons. Some are users seeking to download software. Some are… Tom Busillo July 27, 2021 ACCESSIBILITY VPAT – Voluntary Product Accessibility Template In the world of accessibility, there are many mechanisms used to demonstrate whether a an organization's Information and Communication Technologies… Tom Busillo May 27, 2021 0 Rating Subscribe Connect with Login {} [+] 0 COMMENTS We are here to assist you Have a project you need some assistance with? Our team is happy to answer your questions and help make your next project successful. Fill out the form and we will be in touch as soon as possible. You can also check us out on social media in the meantime! Contact Us First name Last name Company name Email address Phone number Reason for Inquiry Accessibility Services Cybersecurity Services Managed IT Services IV&V Services Testing Automation / QA Services Teaming Other Message Send Subscribe to our Newsletter Subscribe COMPANY About Us Our Team Frequently Asked Questions Contract Vehicles Press Releases Contact Us SERVICES Accessibility Cybersecurity Independent Verification and Validation Automation Managed IT Services OTHER Blog Resources Accessibility Policy Privacy Statement Careers Employee Portal Sitemap 703-787-7600 info@testpros.com 46090 Lake Center Plaza #306 Sterling, VA 20165