To Improve Cyber Resilience, Measure It

Abstract

We are not very good at measuring -rigorously and quantitatively -the cyber security of systems. Our ability to measure cyber resilience is even worse. And without measuring cyber resilience, we can neither improve it nor trust its efficacy.Even the meaning of the term cyber resilience is often misunderstood. Cyber resilience refers to the ability of systems to resist and recover from, or adapt to, a cyber compromise (DoD, 2014). A few attempts to measure cyber resilience have focused on the ability of systems to resist well-defined and predictable threats, that is, avoid compromise, which is part of the traditional risk assessment and management process (Linkov and Trump, 2019). What is measured in this case is the probability of the failure of system components in response to different threat scenarios with the goal of hardening the system so the compromise does not happen. This is not exactly resilience. The key notion of cyber resilience is acceptance of cyber compromise as a likely event, and the system suffering as a result; the focus is on the system's ability to recover and adapt, and not just resist. Cyber resilience characterizes what happens after an adverse event, and requires preparedness for both known and unknown threats (Kott and Linkov 2019).

Cyber resilience during the COVID‐19 pandemic crisis: A case study

“…Furthermore, we agree with Kott and Linkov (2021) that more scholarly effort should be devoted to resilience measurement. For instance, based on their definition of resilience ("cyber resilience refers to the system's ability to recover or regenerate its performance after cyber-attacks produces a degradation of its performance", Linkov & Kott, 2019:5), cyber resilience can only be measured in case of an attack that significantly impacted the organizational performance.…”

“…There are different viewpoints that can be used to study resilience (e.g., Hynes, Trump, Love, Kirman, et al, 2020;Groenendaal & Helsloot, 2020;Kott & Linkov, 2021).…”

“…Second, a major advantage of Hollnagel's approach is that it provides a lens through which resilient performance can be observed and assessed. It should be noted here that researchers have only recently begun to investigate how resilience can be quantitatively measured (e.g., Kott & Linkov, 2021) and therefore we rely on qualitative approaches to measure cyber resilience. The third reason is that we discovered that elements of Hollnagel's approach are being used in practice.…”

The COVID‐19 scamdemic: A survey of phishing attacks and their countermeasures during COVID‐19

“…In addition to the previous ‘horizontal’ works that provided general recommendations, some scholars also carried out ‘vertical’ analyses by focussing on specific issues and relevant case‐studies. As a notable example of this kind, [ 103 ] investigated the task of measuring cyber‐resilience, a preliminary – yet mandatory – step towards the development of better countermeasures to cyber‐attacks. The paper highlighted common misunderstandings in the definition and notion of cyber‐resilience, which impair our capacity to measure it.…”

Digitalization Capabilities for Sustainable Cyber Resilience: A Conceptual Framework

“…According to [24], measuring cyber resilience is in its infancy. Decisions on converting knowledge and intuition regarding the recovery and adaptation of cyber systems in response to threats into management decisions and policy will rely on a growing volume of increasingly diverse measurements.…”