Operational Resilience: More Than Disaster Recovery 

To contend with the explosion of cybercrime and its impact on business operations, many organisations are updating their disaster recovery plans to include cyber incident response. Many of the processes and guidelines in traditional disaster recovery plans have changed little in years, sometimes even in over a decade - making them ill-suited to address cyber disasters.

More important, at a business level, disaster recovery is just one aspect of a larger discipline: operational resilience.   
 
There is a need for organisations to view disaster recovery in the context of the overall viability of the business - including cyberattack prevention, detection, and response.  
 
Disaster recovery is fairly narrow in its definition and typically viewed in a small timeframe. Operational resilience is much broader, including aspects like the sort of governance you’ve put in place; how you manage operational risk management; your business continuity plans; and cyber, information, and third-party supplier risk management. 
 
In other words, disaster recovery plans are chiefly concerned with recovery. Operational resilience looks at the bigger picture: your entire ecosystem and what can be done to keep your business operational during disruptive events.   

 Mending A Broken Chain   

The broader focus of operational resilience requires organisation-wide participation. You cannot simply leave it to a single department or team. Instead, everyone needs to be involved, from executives and the board of directors to individual employees in multiple departments.   
 
In today’s climate, it’s not just your own organisation that’s under threat. Your suppliers, partners, and vendors are targets, too. If a major supplier is compromised or taken down, your business might go down with them.  
 
Leadership needs to understand risk and to know the risk tolerance and risk appetite of the company. That even includes things such as procurement functions and agreements with third-party suppliers. Resilience must be built into everything down to every-day workflows, and if a single supplier is insufficient to manage risk, then diversity of supply is a must. 
 
There are many cases where a cyber event at a supplier rendered multiple organisations unable to fulfil their business outcomes. For instance, consider a retail organisation that is using a logistics provider to get products to their stores and that logistics provider experiences disruption caused by a cyber incident, which lead to stockouts in the retail organisations’ stores. Avoiding such scenarios requires a broader perspective. In the context of operational resilience, every risk management scenario and process must consider the supply chain.  

Putting The “operation” In Operational Resilience   

The U.S. Department of Transportation proposed a $1 million fine against Colonial Pipeline for “control room management failures” in the 2021 cyberattack that disrupted gas delivery in the Eastern U.S., adding to the company’s revenue losses from the attack itself. The government’s take is that the company ignored operational resilience: Instead of planning how to manage and limit the scope of an incident, the organisation simply shut down its process control networks the instant malware hit its systems.   
 
Sadly, this is a scenario that’s not unique; many organisations don’t fully understand the impact of operational technology in a cyber incident.   
 
Ideally, organisations managing national infrastructure or critical supply would think much more about business continuity management and mitigating controls. Such thinking starts with knowing their risk profile and planning appropriately to manage it. Organisations must also test what they can do in terms of shutting down their networks, ensuring they have the capability to sever the connection between information technology and operational technology, so malware doesn’t bring everything to a grinding halt. 
 
Bridging The Gap Between IT And OT   

The technology running systems such as pipelines and refineries is distinctly different from that found in a typical office environment. Different network protocols, a different approach to the security stack, and a greater concern for critical safety issues exist. One of the biggest sources of friction for industrial businesses—and the reason operational resilience efforts so often fail - involves a disconnect between information technology (IT) and operational technology (OT).   
 
Neither department fully understands the other’s workflows and challenges. This disconnect needs to change. And that begins with a change in perception.  
 
Part of the issue is that cyber is still seen as special. The discussion always seems to conclude with the assumption that the security team or IT department is managing a particular risk, so no one else needs to worry about it. There is a need to demystify cybersecurity. It’s only with the proper business understanding and risk ownership that you can put proper resilience mechanisms in place.  
 
What worked well at BP was bringing engineering into cyber and cyber into engineering, giving each team expertise and perspective that it previously lacked. 
 
The truth is that different teams have different priorities. The engineering team might be aware of the importance of cybersecurity but needs to prioritise procedural elements and safety-critical matters. By encouraging interdepartmental collaboration, businesses can determine how to facilitate the rollout of controls and strategies across each environment.   
 
It’s ultimately all about context; what is the business trying to achieve, and what outcomes is it trying to fulfil? How does it support those outcomes? What technology does it use? What matters to it in terms of confidentiality, integrity, and availability?  

The Role Of Active Directory In Building Operational Resilience    

Active Directory (and Azure AD, in hybrid identity environments) has a central place in the quest for operational resilience.   
 
The single most important application across dimensions is Active Directory. Without it, you cannot fulfil any of your business outcomes. Active Directory is at the very core of your ability to operate and deliver business outcomes, and it needs to be part of your operational resilience strategy instead of being treated as an island.  

Take An Active Role In Operational Resilience   

Disaster recovery plans that focus on natural disasters are insufficient for dealing with modern threats to operational resilience. Because the organisation’s identity system is critical to keeping operations running - and is the prime target for cyberattacks - protecting it is paramount.

By prioritising the resilience of the identity system, organisations can address one of the most serious threats to operational resilience

Sean Deuby is Director of Services and Simon Hodgkinson is former Chief Information Security Officer at BP and Strategic Advisor for Semperis 

You Might Also Read: 

Securing Hybrid Identity:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

 

 

« UK Cyber Week - London - 4 and 5 April 2023
Security Is Key To Remaining Innovative Amid Recession »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Applause

Applause

Applause provides real-world software testing for functionality, usability, accessibility, load, localization and security.

SecureKey Technologies

SecureKey Technologies

SecureKey is a leading identity and authentication provider that simplifies consumer access to online services and applications.

Waratek

Waratek

Waratek is a pioneer in the next generation of application security solutions known as Runtime Application Self-Protection or RASP.

LinOTP

LinOTP

LinOTP is an enterprise level, innovative, flexible and versatile OTP-platform for strong authentication.

XM Cyber

XM Cyber

XM Cyber is a leading hybrid cloud security company that’s changing the way innovative organizations approach cyber risk.

ICT Reverse

ICT Reverse

ICT Reverse is one of the UK’s leading, fully accredited providers of ICT asset disposal and secure data erasure.

aDolus Technology

aDolus Technology

aDolus delivers a robust solution for safeguarding against counterfeit or malicious software and firmware in mission-critical systems.

Document Security Systems (DSS)

Document Security Systems (DSS)

DSS anti-counterfeit, authentication, and brand protection solutions are deployed to prevent attacks which threaten products, digital presence, financial instruments, and identification.

SOC Experts

SOC Experts

SOC Experts is a pioneer (we started SOC training well before people realized how big the domain was going to be) and the only institution to provide end-to-end training on Security Operations Centers

Rostelecom

Rostelecom

Rostelecom is Russia’s largest integrated provider of digital services and solutions, covering all market segments including consumer, governmental and private organizations.

Alcon Maddox

Alcon Maddox

Alcon Maddox is a niche recruitment and executive search firm specialised in sourcing exceptional Cyber Security sales and commercial leadership talent. Serving clients across the Middle East & Europe

MAXXeGUARD Data Safety

MAXXeGUARD Data Safety

MAXXeGUARD: The High Security Shredder. MAXXeGUARD easily destroys hard disks up to the highest security levels as well as other digital data carriers like SSD’s, LTO’s, USB’s, CD’s etc.

Probity

Probity

Probity Inc. is a certified software development and systems engineering company, providing support to federal government and national defense related clients.

Tsaaro Academy

Tsaaro Academy

Tsaaro Academy is a unique privacy certification training platform and here you earn a privacy certification CEH, CISM and DPO from India’s No.1 Privacy training platform.

ASRC Federal

ASRC Federal

ASRC Federal’s mission is to help federal civilian, intelligence and defense agencies achieve successful outcomes and elevate their mission performance.

Tenchi Security

Tenchi Security

Tenchi Security are specialized in Third-Party Cyber Risk Management (TPCRM) and aim to reduce information asymmetry when it comes to third and Nth-Party security and compliance risk management.