Don’t be the easy target: building a more cyber-resilient organisation

As part of Cyber Security Awareness Month, organisations are being encouraged to think about how they can make life harder for attackers. While much of the conversation focuses on preventing cyber incidents, resilience is just as important. Good cyber security reduces the likelihood of an incident occurring, but good cyber resilience determines how effectively an organisation continues operating when one does occur.

Whether an organisation can contain disruption, continue its most important work, and recover safely is just as important as whether the incident could have been prevented.

Security culture creates resilience

People are an organisation’s strongest asset for cyber resilience. Everyday decisions made across the business can create barriers that prevent attackers from gaining a stronger foothold inside the organisation. A strong security culture gives people clear ways to question unusual requests, verify important decisions and report mistakes quickly without fear of blame.

More importantly, it creates a working environment in which people recognise their role in protecting the organisation. They know when to pause, when to verify, and when to raise concerns – and that culture of early reporting and shared responsibility creates friction for attackers. This gives the organisation more opportunities to respond before an issue develops into a larger incident.

Avoid single points of success

Building a resilient organisation means looking beyond traditional single points of failure. Most organisations understand the risks of relying on a single server, supplier or network connection whose loss could disrupt operations.

But, they should also look for single points of success: the single account, person, platform, or process on which successful response and recovery depend. These could include an identity provider, administrator, supplier, communication platform or backup system. If one of these becomes unavailable or compromised, it can create valuable leverage for an attacker and significantly slow containment and recovery efforts.

The challenge becomes even greater during a prolonged incident. Effective response often requires staff handovers, sustained decision-making and the ability to operate under pressure for an extended period. Where recovery depends on a single person or system, resilience quickly becomes difficult to maintain.

Business continuity cannot sit solely with IT

Identifying critical dependencies is only part of the picture. Organisations must also understand how they would continue operating if important systems, people or processes became unavailable.

Business continuity is often viewed as an IT responsibility, but the reality is much broader. Every department should understand the fallback arrangements available when normal systems or processes fail. Organisations need to identify their critical resources, understand the order in which services should be restored and establish contingency options such as manual workarounds where appropriate.

Plans and playbooks are important, but so is ensuring that people are familiar with them and confident in using them when normal operations are disrupted. Plans and playbooks are important, but so is ensuring that people are familiar with them and confident in using them when normal operations are disrupted. A plan that exists only on paper is unlikely to provide much value during a real incident.

Test the plan, not just the document

This is where testing becomes critical. Most organisations have some form of incident response or business continuity plan, but far fewer have tested whether those plans will work under realistic conditions.

Tabletop exercises and other forms of testing help identify weaknesses before they emerge during a live incident. The objective is not simply to confirm that a document exists, but to challenge the assumptions behind it. Can key decisions still be made if critical systems are unavailable? Do teams know their responsibilities? Are communication channels and escalation paths realistic?

The answers are often more valuable than the plan itself.

Backups do not guarantee recovery

Recovery planning is another area where assumptions can create risk. Backups are essential, but they do not guarantee recovery simply by existing.

Many attackers now target backup infrastructure specifically to increase pressure on victims and make payment appear to be the fastest route back to operation. The NCSC advises that backup solutions should be capable of isolation, use appropriately separated administrative credentials, resist destructive actions and support restoration from an earlier version if later copies have been corrupted or created during the compromise window.

For that reason, organisations should regularly test whether critical systems, identities, data and business processes can be restored in a controlled and prioritised manner. Without a proven route back to operation, an organisation may find its available options become far more limited during a crisis.

Resilient processes help prevent fraud

While ransomware and major outages often dominate conversations about cyber resilience, the same principles apply to everyday business processes.

A resilient organisation assumes that a communication channel, user account or individual could be compromised and designs processes accordingly. This helps prevent a single compromise from escalating into a larger incident.

Take mandate fraud as an example. An attacker may compromise or impersonate a supplier and request that future payments be redirected to a different bank account. If the organisation relies solely on email to request, approve and confirm that change, compromising one channel may be enough to defeat the process.

A more resilient approach assumes that an apparently legitimate message may not be trustworthy. Generating alerts when supplier bank details change and independently verifying those changes through a trusted alternative communication channel can significantly reduce the risk of fraud succeeding.

Security and resilience both matter

The strongest organisations invest in both security and resilience. They make compromise more difficult, but they do not assume every attack will be prevented. Instead, they focus on understanding their critical services, reducing dependency risks, testing their response capabilities and ensuring they can recover safely when disruption occurs.

Cyber resilience is ultimately about ensuring that an incident does not become a business crisis. Organisations that prepare for disruption before it happens are far better placed to continue operating when it does.

To strengthen your organisation’s cyber resilience:

• Build a strong security culture
• Identify and reduce single points of failure and single points of success
• Do not rest business continuity plans and processes on IT recovery and response
• Test your plans and processes and the assumptions behind them
• Have strong and well-tested backup solutions
• Consider the resilience of everyday business processes as well as technical systems

​