Safeguarding your digital operations with the three Rs: resilience, response and recovery

This is the first in a series of five articles on the importance of building and maintaining digital systems resilient to, and able to detect and respond to, operational threats (both accidental and malicious), and that are quick to recover and resume normal operations after an adverse event.

 

A growing reliance on digital

 

Today, digital commercial interactions are getting more resilient than ever. From financial services to travel and transportation sectors, digital transformation has revolutionised both consumer and business behaviour. For example, how many times have you used e-commerce in the past month – and how many times have you used cash? When was the last time you wrote or received a paper cheque? Or went to a medical centre and watched someone take paper notes?

 

Operational continuity is critical

 

Resilient e-commerce systems are great for consumers, of course. But they’re also great for businesses too. Great for everyone, in fact. But our heavy reliance on them comes with a risk. Consider the impact to the providers of these services if their systems were inoperable – and by extension, potentially the entire financial ecosystems they form a part of.

 

We have seen the damaging impact on supply chains from unavailable systems due to ransomware. And we have seen the impact on consumers through accidental IT failures at financial institutions. Businesses and economies have become almost completely reliant on the availability of computer systems and data access to do business – and that means that when they go down and need to be fixed, the costs and impacts on those businesses can be astronomical.

 

Cyber-threats to digital systems have grown. Whether they are accidental, natural, or one of an increasing number of intentional malicious threats designed to steal data, destroy operations, or hold systems hostage for monetary gain, the threat of cybergeddon for any given business is very real.

 

By extension, the operational continuity of digital systems is also critical to national economies.  Because of this, regulators issue new rules for operational resilience on an ongoing basis, focusing on the resilience, response and recovery capabilities of critical digital systems. Examples of these include the recently issued EU Digital Operational Resilience Act (DORA) and the UK’s FCA Operational Resilience Instrument 2021.

 

Resilience, response, and recovery

 

Organisations need to be able to keep their digital systems running to both their own standards and those of national economies – and this is where the “three Rs” come into play. These organisations must focus on:

 

Resilience – the ability to resist the loss of service in the face of threats, minimize the impact to users and quickly restore normal operations.

Response – the ability to detect events and respond with the appropriate actions and decisions to prevent and/or mitigate the impact and rapidly restore normal operations.

Recovery – the ability to quickly act to restore normal operations with acceptable but minimum impact to users.

 

The next three articles will go on to cover how preparation, protection, and practice actions, or the “three Ps”, apply to creating resilience, response, and recovery capabilities. These articles also describe related Kyndryl Security and Resiliency capabilities.

 

Preparation – the activities relating to incorporating capabilities that provide the necessary resilience, response, and recovery into the design and operation of digital systems.

Protection – the appropriate protective features needed to detect and prevent intrusions, which are built into the operational environment at development.

Practice – the methods employed to build and develop systems with the appropriate operational resilience characteristics, including the regular rehearsal of the response and recovery procedures.

 

The final article will integrate these topics with a discussion of the management and governance aspects of developing and maintaining operational resilience.

 

---

 

Bob Pitcole - Executive Consultant, Kyndryl Security & Resiliency Servces