MIT Sloan panelists urge cyber resilience focus

Cyber Darwinism

Cybersecurity executives underscored the importance of cyber resilience.

"For me, it's Darwinian," said Esmond Kane, chief information security officer at Steward Health Care, a healthcare system based in Dallas that operates 39 hospitals. Kane, who participated in a cyber resilience panel at the MIT Sloan event, cited ransomware as a particularly dangerous threat to enterprises.

Esmond Kane

"If you don't take the proactive measures, you're going to learn the hard way that ransomware isn't an IT problem -- it's a business problem," he said.

Preparing for trouble is paramount. Businesses should build a plan for sustaining operations amid a cyber attack, although the act of planning may prove more useful than the plan itself. 

"What we found, very quickly, was that the core concept around resilience is in preparing," Kane said. "Now unfortunately, when you do prepare, you will find that no plan survives first contact."

The COVID-19 outbreak, the mass adoption of cloud technologies and the follow-on pandemic of cyber attacks put many plans to the test. Steward Health Care's planning exercise, however, created an "organic understanding" of who to talk to as a facilitator or coordinator amid an attack and established lines of communications to be used when needed, he noted.

For me, it's Darwinian.

Planning fosters resilience, which, in turn, helps an enterprise stand out from competitors.

"Our ability to adapt to control and manage change associated with that massive change in risk profile was a competitive advantage," Kane said.

Fred Cohn

Schneider Electric, a French multi-national that makes industrial automation and control systems, manages three aspects of cyber resilience: its internal security posture, the security of the products it sells and customers' secure deployment of those products, said Fred Cohn, director of cybersecurity and digital risk leader for the digital offer practice at Schneider Electric.

Cohn said customers have become more sophisticated over the years. They are not only inquiring about product security, but about how Schneider Electric protects its own enterprise, he said.

"The two of those [questions] are intertwined now as part of the answer," Cohn noted.

The other part of the answer involves how customers use the company's products. Schneider Electric aims to ensure that clients properly install its offerings, he said.

"Resilience, for us, is really looking at both sides," Cohn said. "It's critical for us that we make sure that we help them, we guide them, cajole them, to try to make sure that they take care of themselves as much as we take care of our own house."

Rolling with the punches

David Masson

MIT and industry executives define resilience as series of events from preparation to recovery. What resilience isn't, however, is throwing in the towel, according to David Masson, director of enterprise security at Darktrace, a cybersecurity AI company headquartered in Cambridge, United Kingdom. He said shutting down an organization to stop an attack sends the wrong signal.

"To me, building cyber resilience … is about taking the punch when you get attacked and rolling with it," Masson said. "You keep going while you're under attack, and you keep moving, and that will reassure people. That will give you an advantage, particularly in the supply chain."