Sebbene le organizzazioni possano indicare come prioritarie specifiche misure di sicurezza informatica, ciò che conta davvero è il loro comportamento. Questa è stata una delle principali conclusioni emerse dal nostro primoCyber Recovery Rapporto di preparazione”, realizzato in collaborazione con GigaOm attraverso un sondaggio condotto su 1.000 responsabili IT e della sicurezza a livello globale.
When analyzing the most resilient organizations, we found that they employed many measures, but five practices rose to the top when determining their true readiness. We call these practices maturity markers (see 5 Markers of Cyber Recovery Readiness, below).
Organizations demonstrating four or five markers are considered cyber mature. These companies report experiencing fewer breaches and recovering faster when they do get breached.
Tuttavia, dalla nostra indagine è emerso che solo il 4% delle organizzazioni ha implementato tutti e cinque gli indicatori e solo il 13% ne applica almeno quattro. Alla base della curva di maturità, il 14% non ha implementato alcun indicatore chiave.
While fewer than half of all organizations feel confident in their recovery plans, more than half of cyber mature organizations (54%) feel substantially more confident in their ability to recover critical systems and data following a major incident.
5 indicatori della Readiness per la Recovery informatica
An organization’s level of cyber maturity can be measured by the presence of five markers. The most mature, cyber-ready organizations demonstrate four or five of these:
- Security tools to enable early warning about risk, including insider risk.
Early warning security tools are technologies and systems designed to detect potential cyber threats before they can cause significant harm. These tools aim to identify risks at the earliest possible stage, allowing organizations to respond proactively rather than reactively. Examples include Intrusion Detection Systems, Deception Technology, Intrusion Prevention Systems, Security Information and Event Management, User and Entity Behavior Analytics, and Endpoint Detection and Response.
- A known-clean dark site or secondary system in place.
Maintaining an isolated, pre-configured or dynamic isolated recovery environment (for example, a cleanroom) that remains unaffected by cyber incidents at the primary site. This secondary site can be quickly activated for business continuity and data integrity in the event of a cyber attack or major failure. It enhances cyber resiliency by providing a secure failover option, minimizing downtime and complexities of failover.
- An isolated environment to store an immutable copy of the data.
Involves maintaining a separate, air gapped (that is, immutable and indelible) copy of data secured behind a third party’s infrastructure. The data remains unchanged and protected from cyber threats, including ransomware and malicious insider actions. It enhances data integrity and availability, providing a reliable recovery option in case of data corruption or loss.
- Defined runbooks, roles, and processes for incident response.
A crucial capability for cyber resilience for a structured and efficient response to cyber incidents. Tested runbooks provide step-by-step instructions for handling various types of incidents, reducing confusion and response time. Clearly defined roles and processes ensure that every team member knows their responsibilities, promoting coordinated efforts. This preparedness speeds up recovery and helps maintain operational continuity during and after cyber events.
- Specific measures to show cyber recovery readiness and risk.
Metrics and tests that demonstrate an organization’s ability to recover from cyber incidents and assess associated risks. These measures, such as regular recovery drills and risk assessments, provide insight into the effectiveness of recovery plans and identify potential vulnerabilities. They are important for cyber resiliency in particular, as well as preparedness, validation of recovery strategies, and to highlight areas for improvement.
Scarica ilRapportocompleto per scoprire come la tua organizzazione possa prepararsi al meglio in caso di violazione dei dati.
