Accelerating Cyber Resilience Through Automation
Key Points
- Cyber resiliency means an organization can quickly and effectively recover from cyber attacks, reducing the current average recovery time of 23 days.
- Prolonged recovery increases the amount of compromised data—potentially petabytes—making the restoration process more complex and costly.
- Achieving faster recovery relies on five key steps: strong foundational security (SIEM/SOAR), rapid detection of anomalies, swift recovery actions, maintaining immutable data snapshots, and extensive automation.
- Automation ties the process together, enabling coordinated detection, response, and restoration to minimize downtime and keep both IT staff and CISOs from facing lengthy, painful recovery timelines.
Sections
- Cyber Resiliency: Reducing Recovery Time - The speaker defines cyber resiliency, highlights the current 23‑day average recovery period for attacks, and stresses the need to shorten downtime to protect massive data workloads.
- Immutable Snapshots and Automated Recovery - The speaker explains that using immutable snapshots together with automation enables organizations to quickly revert to a known‑good state after a cyber‑attack, reducing human error and recovery time, thereby enhancing cyber resilience.
Full Transcript
# Accelerating Cyber Resilience Through Automation **Source:** [https://www.youtube.com/watch?v=S9c7oy-QXHI](https://www.youtube.com/watch?v=S9c7oy-QXHI) **Duration:** 00:03:55 ## Summary - Cyber resiliency means an organization can quickly and effectively recover from cyber attacks, reducing the current average recovery time of 23 days. - Prolonged recovery increases the amount of compromised data—potentially petabytes—making the restoration process more complex and costly. - Achieving faster recovery relies on five key steps: strong foundational security (SIEM/SOAR), rapid detection of anomalies, swift recovery actions, maintaining immutable data snapshots, and extensive automation. - Automation ties the process together, enabling coordinated detection, response, and restoration to minimize downtime and keep both IT staff and CISOs from facing lengthy, painful recovery timelines. ## Sections - [00:00:00](https://www.youtube.com/watch?v=S9c7oy-QXHI&t=0s) **Cyber Resiliency: Reducing Recovery Time** - The speaker defines cyber resiliency, highlights the current 23‑day average recovery period for attacks, and stresses the need to shorten downtime to protect massive data workloads. - [00:03:05](https://www.youtube.com/watch?v=S9c7oy-QXHI&t=185s) **Immutable Snapshots and Automated Recovery** - The speaker explains that using immutable snapshots together with automation enables organizations to quickly revert to a known‑good state after a cyber‑attack, reducing human error and recovery time, thereby enhancing cyber resilience. ## Full Transcript
What is cyber resiliency?
Well, to put it simply, it's the ability for an organization
to quickly and effectively recover from a cyber attack.
Now, these attacks affect small businesses all the way up to enterprise.
And with the increase in complexity and frequency of these attacks,
It's more important now than ever for anyone involved in an organization's data
to understand what it means to be truly cyber resilient.
So what does it take to be cyber resilient?
Well, let's talk about time first.
Now, if we take this timeline,
and this represents the days it takes to recover from a cyber attack.
The average right now is 23.
Now, this is a nightmare scenario for the CISO all the way down to the I.T. admin.
Any CISO does not want to explain why
they're still 23 days in and they haven't recovered yet,
and the IT admin is having to do this recovery that whole time.
And to further illustrate why it's important
to recover more quickly than this, we can add the data, Y-axis, to this.
Now, if this is your data,
every day that passes by,
we have more and more of our workload being affected.
Now we're talking about petabytes at this point.
And this just further illustrates what a headache this can be,
which it also makes it evident what we want to do,
which is we want to reduce this time to recover
closer to this side of the timeline.
Now, what this does with the workload amount
is it makes a much nicer slice of pie to recover from.
Now this makes the IT admin happy, and this makes the CISO happy
because they don't have to explain why it's taken 23 days.
Maybe it's done in a shift now.
So what is involved in achieving this result?
Well, there's five steps.
The first one is your foundational security.
Now this is your SIEM and your SOAR.
These are the folks that are keeping most of the bad guys out of the castle.
Now, I say most because it's not going to catch everyone.
And it truly is not a matter of if, but when someone gets through.
So what do you need to do then?
Well, we need to figure out something is going on, right?
So detecting is the next part.
And it's not enough to just detect an anomaly.
We have to do this quickly,
because nothing can kick off in this process
until we know something's going on.
Now, the next step once we've detected, is to recover.
And this similarly has to be done quickly
because we can detect quickly and not recover quickly.
And we're still back at the 23 mark.
But if we can detect quickly and recover quickly,
we're much closer to bringing our recovery time
closer to our ideal goal.
Now, what are we recovering?
Well, we need to have a copy of our data
that hasn't been encrypted and held for ransom.
So we need to have an immutable snapshot available to us,
that we can recover from.
And what an immutable snapshot allows us to do
is it allows us to go back in time basically
to before the attack
to a known good copy of our data that we can then recover from.
And the last step that is the glue for all of this
is automation.
When we automate this process, we eliminate human error
and also speed up every step in the process
so that we're dragging this workload
and time to recover all the way back down to here.
So when we understand what we need to focus on
and also the steps that it takes to truly recover from a cyber attack,
we're that much closer as an organization to being cyber resilient.