Understanding Minimum Viability
In considering how to improve their cyber resilience, agency leadership should conduct careful business continuity and disaster recovery planning that identifies and prioritizes key processes that must be maintained for the agency’s continuing operation. The result of this assessment is the minimum viable organization, a concept that describes how long the agency can operate without specific processes and identifies options that may be available to fulfill these needs.
Agencies looking to understand their minimum viability should start with the mission. The size and mission of agencies can vary significantly, and their approaches to cyber resilience will reflect that.
Some systems are very different, such as weapons systems in the military that are not used by other agencies, but other essential systems such as payroll are present across the government. Agencies that have achieved a high level of cyber resilience will be able to bring these systems back online quickly and trust their data.
Agencies must focus their investments in cyber resilience on the steps that enable them to maintain minimum viability. Getting these critical functions back on track is essential to enabling rapid recovery from a cybersecurity incident.
3 Ways That Zero Trust Supports Cyber Resilience
The progress that agencies make toward zero trust also improves their cyber resilience. Zero trust supports resilience in three important ways:
- Limiting the blast radius: Zero trust makes it more difficult for an attacker to gain a foothold in an agency’s IT environment. When an attack succeeds, zero trust limits the damage the cyberattacker can do before the attack is discovered, which helps speed recovery.
- Promoting visibility: Zero trust requires agencies to have mature capabilities for identity and access management by using tools such as multifactor authentication. This improves the visibility that IT teams have into the environment, making clear who is accessing specific data and systems. These visibility improvements help IT teams to detect issues earlier, diagnose problems more quickly and provide a clearer picture of how to solve them.
- Improving trust: During a cybersecurity incident, agencies lose trust in the integrity of their data and systems, and getting that trust back is necessary for a full recovery. Zero trust enables IT professionals to take a granular approach to trust so that they can quickly confirm which parts of the environment are still trustworthy.
Zero trust and cyber resilience have become important priorities for agencies. IT leaders should consider the relationship of these concepts to optimize the impact of their investments in both.
