Resilience is the ability to prepare for, adapt to, withstand and rapidly recover from disruptions caused by changing conditions.
Shields Ready complements CISA’s successful “Shields Up” campaign, which encourages critical infrastructure stakeholders to take specific, time-sensitive actions that reduce risk in response to specific threat intelligence during cyberattacks, physical security threats, or natural disasters in response to specific threat intelligence.
Shields Ready focuses more broadly and strategically on how to prepare critical infrastructure for a potential disruption and how to build more resilience into systems, facilities and processes by taking action before a crisis or incident even occurs.
The program aligns with and complements FEMA’s Ready campaign.
“In the constantly evolving threat environment that our nation faces today, our Department must remain ready and agile to prepare for and respond to threats against critical infrastructure,” said Secretary of Homeland Security Alejandro N. Mayorkas. “The Shields Ready campaign, spearheaded by CISA and supported by FEMA, will ensure our nation’s critical infrastructure is better equipped and more resilient against all threats and hazards, ranging from cyberattacks to natural disasters.”
“Our nation’s critical infrastructure entities — from schools to hospitals to water facilities — must have the tools and resources to respond to and recover from disruption,” said CISA Director Jen Easterly. “By taking steps today to prepare for incidents, critical infrastructure, communities and individuals can be better prepared to recover from the impact of the threats of tomorrow and into the future.”
This focused approach highlights how critical infrastructure entities and other organizations can resolve to be resilient by integrating certain practices that will make themselves secure, resilient, able to bounce back quickly and build back stronger from an incident.
To that end, entities should:
Know your infrastructure and dependencies. Organizations should identify their most critical systems and assets for their operations and understand their potential dependencies on other infrastructure systems.
Assess your risks. Consider the full range of threats and hazards that could disrupt your organization’s infrastructure operations and evaluate specific vulnerabilities and consequences the threats and hazards could pose.
Make actionable plans. Organizations should develop a strategic risk management plan to reduce the risks and vulnerabilities identified as well as actionable incident response and recovery plans to help withstand disruptions and rapidly restore operations within minimal downtime.
Measure progress to continuously improve. Exercise incident response and recovery plans under realistic conditions and periodically evaluate and update strategic plans.
“In the context of the U.S. government launching a new campaign to encourage critical national infrastructure (CNI) operators to enhance their cyber-resilience, one of the four key messages stands out as a considerable challenge: Conduct comprehensive risk assessments,” said Stephen Gates, principal security subject matter expert at Horizon3.ai. “This is more difficult than most people believe when organizations solely rely on humans to perform risk assessments. In fact, there are simply not enough qualified and certified risk assessment professionals available today.
“Therefore, a paradigm shift in the mindset of CNI operators needs to happen. This shift includes augmenting their human-based risk assessments (often in the form of periodic penetration tests and regular scheduled vulnerability scans) with autonomous systems designed to discover where CNI operators are truly at risk. These systems operate autonomously, peruse network environments on their own, discover truly exploitable vulnerabilities, safely exploit what they discover, provide proof of compromise, and deliver expert guidance on how to remediate these risks – preemptively.”
“Improving processes and hardening systems is critical for any CNI organization but must be paired with the right solutions for resiliency in the face of continual onslaughts of threats and attacks; that’s why it makes complete sense to pair the Shields Up initiative with Shields Ready,” said Dave Ratner, chief executive at HYAS. “Only through a complete security-in-layers approach will critical infrastructure really be properly prepared for and resilient against cyber intrusions.”