Deploying a Cyber-Resilient Framework to Reduce Risk and Enable Digital Transformation

Cybersecurity is one of the most important issues of our time. Cybercrime damages are expected rise to more than $10 trillion by 2025. As noted by Cybersecurity Ventures, this could represent the greatest transfer of economic wealth in history, with profits greater than the global trade of all major illegal drugs combined.

What are some of the key steps organizations can take to focus on cyber-resiliency? From the perspective of the overall business, three are foundational to a successful cyber-resiliency strategy:

1. Align security strategy with business priorities. This includes doing regular cybersecurity vulnerability assessments; focusing on risk tolerance and risk management; using proven security models such as the National Institute of Standards and Technology’s Cybersecurity Framework (NIST CSF); and adopting a zero trust culture and architecture for cybersecurity.
2. Build a security-first culture. This includes prioritization, training and education—which is especially important with more people working from home in response to COVID-19. It also means embedding security and SecDevOps into your products and services, particularly for all of your business transformation initiatives.
3. Understand your attack surface and fix vulnerabilities. The potential attack surface has changed and grown dramatically during the past two years, with no end in sight. That has been fueled by, among other things, the shift to remote work, the exponential growth of cloud and the rise of Internet of Things devices. Examine your vulnerability assessments in this new light and take the necessary remediations to fix gaps. Make sure your technology investments and frameworks take into account the changing security landscape. 

Developing a Cyber-Resilient Framework
In support of the steps outlined above, it is critical to implement a modern cyber-resilient security framework and invest in solutions with partners that can help you reduce risk and adapt as the threat environment continues to evolve.

A successful approach should be built on a holistic cyber-resilient framework that adheres to the five critical functions as defined by the NIST CSF, which are:

1. Identify—including physical and software assets; the business environment; cybersecurity assets and asset vulnerabilities; and risk management and supply chain risk management strategy.
2. Protect—including implementing identity management and access control; conducting awareness training; establishing data security protection consistent with the organization’s risk strategy; implementing protection processes and procedures; protecting resources through maintenance; and managing technology to ensure the security and resilience of systems and assets.
3. Detect—including ensuring that anomalies and events are detected and their potential impact is understood; implementing continuous monitoring capabilities; and maintaining detection processes to provide awareness of anomalous events.
4. Respond—including ensuring response planning processes are executed during and after an incident; managing communications; conducting analysis, including forensics, and determining the impact of incidents; mitigating activities; and incorporating lessons learned to implement improvements.
5. Recover—including developing recovery planning processes and procedures to restore systems and assets; implementing improvements; and coordinating internal and external communications during and after recovery from a cybersecurity incident. 

Maximizing Protection, Minimizing Risk
To deliver the benefits of this holistic framework, you should focus on deploying the key elements of a modern security approach to maximize protection and minimize risk. These are:

• A zero trust architecture, starting in the supply chain, embedded at the silicon and firmware levels and in the operating systems, platforms and applications, and then building out from data center to cloud to edge to endpoints.
• A platform that supports and empowers SecDevOps and security engineers, enabling the organization to incorporate security at every stage of a product’s development, deployment and lifecycle.
• A cyber-resilient platform that incorporates threat intelligence and automation to discover and mitigate attacks before they can inflict damage.
• An as-a-service delivery model to increase speed, agility and scalability from the edge to the cloud.
• A partner that can deliver the technology as well as the ongoing service and expertise to help the organization assess risk, create a risk profile, plug up existing gaps, build a cyber-resilient framework, and discover and react to new vulnerabilities as the landscape shifts.

Taking the Next Step
Every organization must do its part to maximize protection and minimize risk. If your customers and employees don’t have trust in their interactions with your organization, it will impact your brand and limit the success and potential of your most important digital business initiatives. 

To learn more about how your organization can deploy and maximize a holistic cyber-resilient framework, including a zero trust architecture, threat intelligence, as-a-service delivery and more, please contact HPE at www.hpe.com/security.