Using vulnerability to build cyber resilience

Too often, organisations in the digital ecosystems we depend on don’t trust each other enough. The problem is caused by institutions that don’t like to lose, people who are afraid of being judged, weak confidence, and a lack of cyber resilience.

The Global Cybersecurity Outlook 2022 report, which was made by the World Economic Forum and Accenture, found that:

• Only 19% of cyber leaders are sure that their organisation can handle cyber attacks.

• 58 % of those who answered think that their partners and suppliers are less resilient than their own business.

• 88 % of respondents are worried about the ability of Small and Medium-Sized Enterprises (SMEs) in their ecosystem to deal with cyber threats.

This doesn’t have to happen. If organisations can get over these self-limiting stereotypes, each will benefit from the knowledge and skills of its partners. Doing so is necessary to stop the chain reactions that happen when fragile ecosystems that are connected to each other break down, as many recent events have shown.

For organisations to get past this long-lasting lack of trust, they must take advantage of a different kind of critical vulnerability than what cyber professionals are used to, which is the organization’s ability to be seen for what it is. They must be willing to be open about weaknesses in their cyber resilience posture within their organisation and ecosystem. They should tell people what to expect from their exposure and give clear information about how disruptions affect the whole system. They should be honest about how they’ve dealt with disruptive events and share what they’ve learned.

When security prevention measures fail, cyber resilience takes over. In the digital economy, market leaders are those who can deal with cyber disruptions. When a weak spot is turned into a strong point, an organisation will have the confidence to take healthy risks.

It’s not easy to turn institutional weakness into organisational strength. The Cyber Resilience Index Framework, which was just released by the World Economic Forum and was made in collaboration with Accenture, shows the six ways to build a resilient culture:

Assess and rank cyber risk on a regular basis

Set up and keep up with basic security measures

Governance for cyber resilience should be part of business strategy

Encourage system resilience and collaboration across the whole ecosystem

Ensure design supports cyber resilience

Cultivate a culture of resilience

Creating a culture of cyber-resilience and encouraging systemic resilience and collaboration are two principles that have been undervalued for a long time. Both of these principles give organisations a place to start when they want to move from being vulnerable to being cyber-resilient. Here’s how the rules are put into action:

Develop a cyber-resilient culture

Employees are given the tools they need to learn and practise cyber-resilient behaviours. The following rules come from this principle:

Earn trust through accountability and openness. Management shares the cyber resilience strategy, practises, operations, successes, and failures on a regular, clear, and open basis. This builds and keeps knowledge, trust, openness, and a sense of ownership over the success of the organisation.

Cyber-resilient leadership that is aware: Leadership has the knowledge and power to manage the organization’s cyber resilience based on best practises, and they are incentivized to improve their knowledge as the environment changes.

Culture is shaped by leadership: Leadership sets the tone and puts in place the organisational mechanisms that create a culture of capability and accountability for cyber resilience at every level of the organisation.

Champion the behaviour of employees: Employees know what the goals for cyber resilience are, feel responsible for the organization’s cyber resilience, and have the freedom to act in ways that are cyber resilient without fear of being punished.

Provide ongoing training. Employees are taught cyber resilience concepts and best practises, as well as how important cyber resilience is and what role it plays in their daily tasks. They keep practising what they have learned, which changes as the cyber resilience landscape does. Also, they get immediate feedback on what they do.

Encourage system resilience and collaboration across the whole ecosystem

The organisation knows how different parts of its ecosystem depend on each other, works with other organisations, and does what it needs to do to keep the whole ecosystem strong. The following rules come from this principle:

Trust is built through knowledge, accountability, and openness. The organisation is open with its ecosystem partners about its practises, operations, successes, and failures, and it shares best practises to make the group stronger.

Cooperation across the whole ecosystem. Management builds a culture of working together and sets goals for sharing knowledge and information. In the same way, it finds, understands, and reduces cyber risks in the ecosystem. The group also works closely with its peers in the industry and with policymakers.

Cyber resilience capabilities for the whole ecosystem. Together with other members of the ecosystem, the organisation is always working to improve its collective cyber-resilience. This is done to share knowledge, raise awareness, and improve the overall standards of practise. This makes it possible for all parts of the ecosystem to work together better and strikes a good balance between innovation, preparedness, protection, response, and recovery.

These principles and practises help organisations and ecosystems get the kind of cyber vulnerability they need. It’s not just about making an ecosystem that can do more. It’s about the chance to get a competitive edge that will last. Organizations that quickly adopt cyber resilience through confident vulnerability become leaders in their industry and set the standard for their ecosystem.

ISO 31000:2018 stresses that risk is the “effect of uncertainty on objectives” and that, contrary to what most people think, this effect can be both good and bad. During the Fourth Industrial Revolution, systemic interdependence makes cyber risk both more expensive and more valuable. On both sides, resilient organisational behaviour has a bigger impact on the future than the sum of its parts. The organisations that will lead us into the digital future are those that are both vulnerable enough to admit they can’t do it alone and smart enough to know that it’s better for businesses not to even try.