In a world, where we have seen a pandemic and a war in the last two years, understanding the concept of VUCA has never been more important. VUCA is an acronym for Volatile, Uncertain, Complex and Ambiguous. Volatile refers to the speed of change in an industry, market or the world in general. Uncertainty stands for the inability to predict the market conditions. Truly uncertain environments are those that do not allow any prediction. Complexity refers to several mutually exclusive, or inclusive factors that need to be taken into consideration in a given market. Finally, ambiguity refers to a lack of clarity about how to interpret something.

Our world is changing drastically, from Syria wall, Pandemic, to Afghanistan Humanitarian Crisis to now Russia-Ukraine war. Enterprise security teams across the globe have issued warnings about potential cyberattacks being unleashed. If enterprises want to function in such an unstable world, then they need to build resiliency and strengthen up their cyber defense mechanism.

Amidst such news constantly disrupting our world, enterprises can take the following steps to ensure cyber resilience:

· Revisit your business continuity plan – Since IT problems have the potential to quickly become business problems, businesses need to revisit their continuity plans. They need to carefully examine the existing solutions and introduce new policies exclusively for instances of cyber-attacks. It must include detailed pointers on – if a cyber-attack hits a company, what kind of remedial actions would be taken. While these actions are being taken, can the organization sustain their operations without having access to their systems? Is there a way to ensure functioning of daily operations when a company’s servers and systems are being hacked? Enterprises need to get realistic about current market condition and plan their continuity plans accordingly.

· Closely examine risk assessment and mitigation – A resilient cybersecurity posture requires optimization of the cyber defense measures. To achieve this, enterprises need clear visibility into their security architecture. They should simulate attacks to measure the effectiveness of their solutions and preparedness of their teams. By testing continually, internal security teams can gauge their readiness and make consistent improvements wherever needed. Further, risk assessment metrics offer clarity about solutions’ effectiveness. A detailed report at the end of each exercise provides the security teams and management with insights on their threat landscape, preparedness, effectiveness of mitigating measures, and additionally comparison with other players in the market.

· Actively engage with vendors and partners – Enterprises need to be clear on the definition of ‘security’. An isolated approach to security will not yield the desired results as it is a shared responsibility between internal security teams and vendor partners. Whether it is about ensuring robust cloud security or network security or the security of applications and underlying databases, organizations and vendor partners must work together to design a detailed strategy on threat detection and risk mitigation.

· Inculcate a security-first mindset in employees – As per many industry reports, insider threats have been the biggest cause of cyber-attacks. These threats could be deliberate or based on pure carelessness. Hence, it is imperative for enterprises to take insider threats into consideration while forming their security architecture. Majority of times, these threats occur due to negligence of employees, therefore it is a must to educate employees on cybersecurity best practices. Employees need to know the importance of logging into a corporate network through a secure connection, protecting their personal and professional devices by using unique passwords with the additional security layer of two-factor authentication.

· Implement cyber insurance policy – Realistically, no matter how many defenses an organization puts up, there’s still a chance of falling prey to threat actors. Hence, it is always advisable to get an adequate cyber insurance policy that should cover the damages arising out of cyber-attacks. However, before opting for any such policy, an organization must assess and quantify as many risks as possible to ensure best coverage and protection.

In conclusion, ensuring effective cyber defense is a long process that requires sustained strategic investments. The key to operating effectively in a VUCA environment is to cultivate resilience by building a flexible, agile and proactive cybersecurity approach and practices.

Neelesh Kripalani – Chief Technology Officer, Clover Infotech