Focusing on the Recovery Aspects of Cyber Resilience

Abstract

Advances in technology and emerging cyber security tactics, techniques, and procedures (TTPs) are pillars for the ‘social good’ on the one hand. On the other hand, they have advanced the landscape for adversarial purposes, e.g., the increasing number of cyber incidents and data breaches. This realisation that cyber incidents cannot be completely avoidable has made cyber resilience an extremely important preposition of any comprehensive and reliable cyber security strategy. Despite the importance, very little contributions exist on cyber recovery1 – a core aspect of the cyber resilience, and cyber security standard. In this paper, we develop and present a comprehensive cyber recovery operational framework. An adaptive, robust framework that can be used as it is, or adapted by an organisation to create its own cyber recovery manual or operative. Each aspects of the framework are discussed thoroughly. Further, we show how a cutdown version of the framework is implemented, mindful that not all organisations are of the same size.1 Cyber recovery is used interchangeably with recovery, and in this paper the mean one and the same thing