So, is there a difference?

Yes, an important difference. Cyber security focuses on preventing, detecting and responding to attacks on an organisation’s network. And there are numerous methods deployed as part of an organisation’s cyber security such as firewalls, antivirus software, maybe encrypting sensitive data, which all then contribute towards a strong cyber security position, which we hope will keep the criminals at bay.

But cyber resilience is more than just setting up these technical measures, being resilient is ensuring that your organisation can withstand and recover from a cyber incident. This means not just relying on preventative barriers, but putting in place policies, processes, and raising awareness among employees of the potential methods of attack. A focus on cyber resilience means minimising the impact of a cyber-attacks, ensuring that systems can recover quickly and continue operating effectively, ensuring you are limiting the impact on your business continuity.

Both cyber security and cyber resilience are important to your organisation, but put simply, while cyber security focuses on preventing breaches, cyber resilience recognises that despite investing in security, breaches can still occur. For this reason, it’s important to combine your approach so you protect yourself from an attack, but where a breach does occur, you are in a position to quickly recover and minimise the impact of that attack.

Cyber security and cyber resilience are crucial elements for creating a strong cyber security strategy. If we use a castle as an analogy, think of cyber security as being the walls, castles often have multiple ringed walls, with a centralised strong area known as a keep. This defence in depth is a concept recommended within cyber security.

Cyber resilience would then equate to the ability of that castle to withstand attacks and rebuild a breached wall if needed. So this, in our analogy, would be the occupants of the castle, whether as an archer, knight, or being responsible for wall maintenance. And there is no doubt that the better trained they are in those roles, the more resilient the castle would be to an attack – which is a transferable concept to businesses and organisations in the modern world.

The National Cyber Security Centre is the leading authority on cyber security in the UK, and it advises taking a comprehensive approach which incorporates both cyber security and cyber resilience. It recommends assessing the risks to your organisation’s information and systems with the same vigour you would for legal, regulatory, financial or operational ones. This needs your business to create a risk management regime across your organisation, with support from your management board and senior managers.

The 10 Steps to Cyber Security is a great starting point, and recommends measures such as producing user security policies covering acceptable and secure use of your systems; staff training to maintain an awareness of cyber risks; establishing an incident response and disaster recovery capability and testing your incident management plans.

By recognising the distinctions between cyber security and cyber resilience you can implement a comprehensive strategy that integrates both, making you better positioned to protect yourself against cyber-attacks and minimising their potential impact.

Police CyberAlarm provides the essential cyber security your business needs so that your cyber resilience is as strong as it can be in keeping cyber threats out. By installing Police CyberAlarm, which is a free tool, you’ll receive reports on the attacks your organisation is facing from the internet, providing valuable information and intelligence so that you can learn how to defend it from them. It also supports the police in understanding trends and patterns of criminal activity.

Find out more about how Police CyberAlarm works on our website: www.cyberalarm.police.uk/police-cyber-alarm/how-it-works/