How To Implement Operational Resilience

To guarantee the general operations of companies against cyber threats, it is essential to activate operational resilience, acquiring tools to act before, during, and after an attack. To counter the increase in cyberattacks and their business consequences, many organizations are adapting their disaster recovery procedures with measures to respond to these types of incidents.

However, these procedures have remained almost unchanged for years, proving inadequate against today’s threats. The key finding is that, at an enterprise level, disaster recovery is only one aspect of a more extensive scope: operational resilience. 

What Is Meant By Operational Resilience?

Operational resilience is a comprehensive concept that ranges from governance to active risk management through business continuity plans and the management of risks deriving from cyber attacks, data protection, and third-party suppliers. On the other hand, disaster recovery is a very specific action and refers to a limited period of time.

In other words, disaster recovery plans are mostly about the recovery itself. While operational resilience implies a broader perspective, covering the entire ecosystem and every possible measure to ensure business continuity during attacks or other types of adverse events.  

Strengthen The Weak Links In The Chain

Operational resilience has a scope that requires the participation of all departments and members of an organization. It cannot be the exclusive prerogative of a team, but must involve everyone, from management to the board of directors, up to the staff. Whoever has management roles must know what the risks are and how much the company is exposed or able to bear them. 

For this, functions and procurement agreements must be set up with third-party suppliers. Resilience needs to revolve around day-to-day workflows, and if more than one vendor is necessary to manage risk, then you need to diversify providers. In today’s landscape, we are all targeted: companies, suppliers, partners and providers. If a threat were to compromise or bring down a vendor’s systems, companies that depend on them could also experience problems .

Focus Resilience On Operations

The US Department of Transportation has proposed a $1 million fine against Colonial Pipeline for ” control room management errors ” during the 2021 cyber attack that caused the gas supply disruption on the east coast of the United States. The fine is in addition to the revenue losses from the attack itself. 

According to the US government, the company did not act from an operational resiliency perspective : instead of planning how to handle and limit the scope of an incident, it simply shut down process control networks as soon as the malware went into action.  

Companies administering national infrastructure or critical supply chains should think more about business continuity management and controls to mitigate risk. Everything must start from the awareness of the risk profile and the planning of adequate measures to manage it.

Why It’s Essential To Bring IT Closer To OT For Operational Resiliency

One of the main causes of conflict in the industrial sector – and the reason why operational resilience initiatives fail – is due to the lack of interaction between information (IT) and operational technologies (OT).  The respective departments need a clearer understanding of each other’s challenges and workflows. This situation must change, starting with the adoption of a new perspective. 

Part of the problem is that cyber threats are seen as something unto themselves. They are a risk to the security team or IT department and so others can wash their hands of it.

However, this myth must be debunked. Only with the proper understanding of the flows of the various corporate teams and with a shared assumption of risks can adequate resilience measures be implemented.

Active Directory With A View To Operational Resilience

Active Directory and Azure AD in hybrid identity environments play a central role in building operational resilience. Even though there is now a tool to manage priorities between departments, we often need to remember how important Active Directory is. Nothing can be done without Active Directory, it is the heart of business activities, therefore it should not be considered as a separate program, but must be integrated into the operational resilience strategy.  

An Active Role In Operational Resilience

Calamity recuperation plans zeroed in on catastrophic events should be fitter to address the present dangers to functional versatility. Since the personality framework is significant to business coherence and is the essential objective of digital assailants, it is fundamental to safeguard it. To keep functional flexibility from being compromised, associations should put the safeguard of the personality framework first. 

ALSO READ: What About Operational Technology (OT) Resilience?