Cyber Resilience in a Time of Crisis

By Sandra Jamshidi

Cyber Resilience

Readiness and preparedness are actions you take. Resilience is a quality you possess. It is fostered from the top by leadership that emphasizes a framework of coaching and team development. It is sharpened through drills, tabletops, and exercises; reported as readiness and preparedness measures; and designed around planning and anticipating the unexpected. Most importantly, resilience is honed through a culture appreciative of mental toughness, agility, and adaptability.

What Resilience Means in Cybersecurity

• iThe measurement and reporting of unit-level readiness has rich traditions in military procedure and accountability. But with the exploding use of “resilience” and “resiliency” in the cybersecurity parlance, newer ideas are being explored, such as, “Can cyber resilience be measured?” Or, “Since it’s not a matter of ‘if’, but ‘when’ we are attacked, we need to be resilient enough to fight through it“.

  Currently, we are seeing three key cybersecurity resilience factors playing out through the COVID-19 crisis that would translate well to any crisis situation:

  • Widespread sharing of best practices
  • Confidence built on a clear presence of the fundamentals
  • Leadership clearing the way for timeliness and action-oriented agilty

When the Rate of Acceleration Accelerates

The rate of change in IT has been accelerating steadily since IT was created, but in a time of crisis even that rate of acceleration accelerates. At worst, we see counter-productive, knee-jerk reactions. At best, we are presented with remarkable growth opportunities. But both timeliness and agility are needed to successfully realize positive outcomes.

During the COVID-19 crisis, office personnel have moved to teleworking. Industrial processes have changed to meet alternate supply chain demands. Network infrastructure is being loaded and used in different ways. Cybersecurity officials are faced with the need to quickly adapt testing and approval processes to implement appropriate access controls, connection approvals, and permissions maintaining a healthy use of least-privilege policies. Where short-term solutions, such as a telephone call, may have been acceptable for a fully-functioning team working on existing projects, longer-term requirements emerge when it is time to build new teams and take on new projects. That simple phone call becomes insufficient for building new relationships, bridging teams, and creating trust. The need to “shift to more robust solutions” requires new agile approval processes to quickly test, configure, and implement necessary security controls.

Share Your Best Practices

During a crisis, there’s a greater need for learning from others and widely sharing best practices within the cybersecurity community. We have seen a wealth of free training, webinars, advertising to highlight shared content-focused media, and expanded access in free- and basic-service plans quickly emerge when COVID-19 crisis sent us into our homes to implement social distancing. This sharing of information is intended to accelerate solutions to issues exacerbated by the pandemic.

Be Brilliant at the Basics

Whether it’s “Fundamentals of Seamanship” or “Nuclear Weapons Checklists”, in a time of crisis people naturally turn to the fundamentals. Confidence and comfort come from knowing the fundamentals are fully mastered.

In our sphere, cyber hygiene is a basic “fundamental”. Amidst accelerating change, with new demands, now is the time to stand by the effective security controls we trust. By leaning on the basics, a calm to the chaos can be achieved through the assurances that come from knowing the fundamentals are fully mastered.

 Finally, Communicate Relentlessly

Leadership during a crisis can generate enthusiasm for doing new things, foster heightened teamwork through brainstorming, or demonstrate appreciation for the team’s contributions.  But throughout, the most important thing to remember is to “communicate relentlessly.”

The human brain is a sense-making machine and, in the absence of reliable information from trusted sources, will make up its own sense of things. With system operators driven by the need to be productive, cybersecurity questions must be asked and answered – particularly when addressing the need to quickly adapt procedures based on best practices. Leadership communications are invaluable anytime, but essential during times of crisis.

For more discussion on how government can improve its cybersecurity resilience, watch Sandra Jamshidi’s interview on Cybersecurity TV.

About the author: Ms. Sandra Jamshidi is a retired US Navy, Information Professional Officer. A graduate of the US Naval Academy and Naval Postgraduate School, as a Captain she led the Defense Information Assurance Program on the DoD Office of the Secretary of Defense Staff; was the Chief Information Officer for Naval Forces Europe/Africa and SIXTH Fleet; and served on the Staff of the Deputy Chief of Naval Operations for Information Warfare in the Pentagon. She has been consulting in IT/Cybersecurity since 2018.