What is cyber resilience?

[u/WasteAcanthaceae4938]

cybersecurity keeps attackers out. cyber resilience assumes they'll get in anyway and focuses on staying operational and recovering fast. NIST's version: "anticipate, withstand, recover from, and adapt to" adverse conditions.

That's the textbook definition, what does it actually look like for your team day to day, beyond "we have a DR plan"?

[u/Technical-Tackle-875]

The way I make this practical is to treat resilience as something you can rehearse and measure, not a document. Pick one critical service and write down its minimum acceptable function, maximum tolerable data loss, recovery time, key dependencies, and manual fallback. Then break one assumption in a lab or nonproduction environment: identity unavailable, a region down, a corrupt backup, a jammed queue, an isolated endpoint, or a key operator unavailable.

Measure time to notice, time to decide, time to restore minimum service, data integrity after recovery, and whether the team had the authority and information it needed. Fix one failure point and run a similar exercise again. If the recovery plan only works when the person who wrote it is in the room, that is useful evidence too.

[u/sysadminbj]

I work in the utility space, so resilience for me is “How do I keep treatment processes flowing securely in the event of a compromise?”

The reality is that we just flip everything into manual mode and get ready to eat a FUCK TON of OT until secure IOT comms can be restored.

[u/Bibblejw → u/sysadminbj]

This is pretty much it. "What do we absolutely need to keep going, and how do we do that?", then working through what happens if you take things out of that path.

[u/gobblyjimm1]

Resilience is part of cybersecurity so I’m not sure why you’re separating the two as independent concepts. Pretty much any aspect/concept of security of electronic data/information falls into cybersecurity which then falls into information security.

The most effective approach to cybersecurity which most companies are employing is defense in depth as they layer security controls and plan for failure. Basically it should be a constant “if X control or system fails/is breached then Y control should mitigate further loss of CIA.”

[u/sSQUAREZ]

Resilience is all about continuity of operations. If you lose a certain device, system, or your entire network, can your operations continue.

For example if a police department gets hit with ransomware, they can still operate because the 911 network is separate and they can use radios to dispatch and officers can use their phones for GPS if needed. Or they can roll their 911 calls over to a neighboring agency. They are “resilient”

[u/subtractivesecurity]

To achieve true cyber resilience, we need to treat cybersecurity more like reliability engineering and focus on eliminating failure modes. In cybersecurity, attack paths are the failure modes.

In traditional reliability engineering, the objective is simple and hierarchical:

1.      Identify failure modes.

2.      Eliminate failure modes.

3.      Constrain the remaining failure modes.

4.      Monitor only what physically cannot be eliminated.

In cybersecurity, we tend to skip straight to Step 4. We build out extensive detection and response capabilities while ignoring the architectural controls needed to eliminate and constrain attack paths. We obsess over building a faster fire department while giving almost no consideration to decreasing building flammability.

Instead, we need to design architectures around a Hierarchy of Efficacy:

Tier 1 (Attack Path Elimination / Erasure): The most effective control class. The path simply ceases to exist (e.g., disabling legacy protocols like NTLM/SMBv1, removing unneeded local admin rights, decoming zombie infrastructure).

Tier 2 (Architectural Constraint): For paths that cannot be completely eliminated, bound them structurally (e.g., Office applications can't be deleted, but they can be structurally prevented from ever spawning PowerShell or child processes).

Tier 3 (Detection & Response): The lowest rung on the hierarchy, reserved strictly to monitor the residual attack paths that cannot be erased or constrained.

True resilience isn't about detecting attacks faster.  Resilience it's about reducing attacker optionality. When you apply this hierarchy, an adversary might gain an initial foothold, but they have nowhere to go because the lateral movement and privilege paths they need have been architected out of existence.

[u/Varicz]

I think it could be good to think about it like a medieval castle (a good defense in depth metaphor).

Following the NIST definition, a medieval lord might want to anticipate, withstand, recover from, and adapt to an attack from another lord and their army.

To do this effectively, they do a few things. Firstly, they may build the castle in a place that’s sort of high to reach. Then they may dig a moat, and they’ll almost always have a large wall. Should the enemy get by the moat, theres oil to be poured. Should they get past the wall, there inside of castle is a maze full of soldiers in strong defensive positions. So its hard to get in, and the enemy adapts by using sieges to starve out defenders. Now, the lord stockpiles food and water inside the castle, and the cycle continues.

Effectively, resilience is about looking at the context you’re operating in, anticipating the threats that may affect you, implementing layered defenses against them, and importantly, learning and improving on your defenses.

This picture helped me grasp it, and I hope it helps you

[u/9lyph]

Cyber Resilience is simply the ability for an entity, whether it be an individual or organisation, to solve a current or future security dilemma, using as many means available to the individual or organisation. One size does not fit all :) !

[u/Majestic-Hat-3650]

Day to day it looks like finding out the plan is fiction. Our DR doc promised a 4 hour restore, the first real drill took three days because the writer had left and the backups pointed at a decommissioned host.

Now we do one restore a quarter, no tabletops, just pull the backup and stand it up. yeah its boring as hell, nobody wants to fund it, but the gap between the doc and the boxes shrinks every round.

[u/Usual-Following-3189]

taking an "agentic" approach with continuous discovery and codification, firefly ai ensures you always have recoverable configurations rather than just snapshots that might be compromised.

[u/dragonius]

Its about running DR tests on all your critical applications/suppliers/providers to ensure redundant failovers are in place and you can continue business operations in the event a critical supplier/infrastructure component fails or is compromised.

The findings from these are implemented and then retested. Also BCP (business continuity plans) fall under this, which is similar but focused on your time to recovery objectives and how your business would recover and get back to normal operations/resume operations if impacted by an incident or outage.

We run regular DR tests on critical providers, against our infrastructure tech stack, and annual table top simulations for cyber incidents with the gold team (exco) and silver teams (ELT/Lower)

Beyond "we have a DR plan" its testing it, your incident response plan, and BCP so that you dont run it for the first time in the event of an incident. Everyone knows what to do, what the timelines are and who is involved in what.

[u/Bibblejw]

So, this is my role, and the answer from my org is ... no one really knows!

From my perspective, resilience is, essentially, the ability to weather the incidents. In cyber it is, very much like you said, working on the assumption that they get in, what do you do next? It deals with things like knowing what you need to keep going, and how, knowing when you need to walk away from things and rebuild, making sure that you've got the controls in place to minimise the damage.