The last stop on our organizational resilience journey touches one of the issues organizations have the least control over: geopolitical and socio-economic trends and threats.

However, they can be some of the most impactful on your organization. Today, the ubiquitous use of interconnected information systems to carry commerce exists on a scale that never did before.

Previously, only certain industries, like the financial sector, had the absolute need and requirement to rely on interconnected information systems to carry out automated transactions and processes. Nowadays, organizations could come to a screeching halt if their staff does not have a stable internet connection to work from home.

Times have indeed changed.

Inheriting Global Risks

We have not only inherited the benefits of an information system-based economy, but also its vulnerabilities. These added pressures and capabilities increase the surface attack area and risk profile.

Today, threat actors can target specific industries that have multiple dependencies. Concurrently, transnational crime syndicates can cut out intermediaries and launch campaigns without ever having to leave their own homes, giving them in-house theft and extortion capabilities.

And, all of this is happening because an organization inherits a third party’s risks, threats and decision-making. Gone are the days where you could operate your local, regional or even national business with little care about what was going on halfway across the world.

You need to be ready for disaster recovery as external forces – no different than natural hazards – can knock out your operations. So how do you prepare and improve your resiliency posture?

The Risk Assessment is Your Mitigation Tool

The introduction of NIST Special Publication 800-39, Managing Information Security Risk: Organization, Mission, and Information System View opens with the following:

Information technology is widely recognized as the engine that drives the U.S. economy, giving industry a competitive advantage in global markets, enabling the federal government to provide better services to its citizens and facilitating greater productivity as a nation.

There is your foundational statement. If you want to operate and remain competitive in global markets, your engine is information technology. And because even local markets are integrated and impacted by global trends, not even they can operate in isolation anymore.

Think about it like this: if you are a local food producer, you may think you have a level of isolation, but are you relying on a national payment processor to perform your financial transactions? If yes, you are caught in the web.

In other words, unless you are operating using the barter system, you better have, as a minimum, some type of crisis management plan in place, even if you are a small local business.

So how do you plan? Well, here are two important first steps:

  1. Really, I mean really, understanding makes your business tick.
  2. Perform a risk assessment that encompasses reasonably expected geopolitical and socio-economic risks (and NIST Special Publication 800-30, Guide for Conducting Risk Assessments is a helpful resource if you do not know how to start).

Reasonableness matters. For example, worrying about how to respond to a nuclear strike from a geopolitical enemy is probably beyond your scope, whereas losing a payment processor (say, because the same geopolitical enemy is ready to attack the processor because of some government policy) is something to be concerned about. Why? Because you may need a new payment processor after they get hit!

A reasonable risk assessment will draw out these types of issues and ultimately, you may find that the assessment can change some of your business relationships. You are inheriting their risks and that may just be well beyond your risk tolerance.

Slowly Decouple from Global Threats, If You Can

Decoupling completely from external threats is unlikely. We are too integrated, globally, and the only remedy is increased regional capabilities, which require a reorientation of resources and capital expenditure to rebuild capabilities. That’s an entirely different sort of risk appetite some may not be ready for, but you really want to cut out as many external pressures as possible.

For example, you may decide to own and operate more data centers to monitor or choose to walk away from certain markets. One has a cost, the other presents a loss. Understanding your business and the risk assessment help you may that decision.

Industry Information Sharing

There is one more option: the industry working together. It’s actually not too uncommon, but intra-industry cooperation can fly under the radar. Industries have a pretty good idea of who is trying to target them, so if your organization can get over the hump of working with the competition for a common defense mechanism (call it an “off the books” relationship with implied non-disclosures and non-competes), the sector becomes more resilient.

These relationships are nuanced and delicate, as they are not necessarily public-private partnerships (being a part of a PPP can sometimes increase your exposure). Instead, it is industry working together for common defense with an agreement not to exploit each other’s vulnerabilities for market gain.

Bringing It All Together

Are there more issues this journey could have touched on? Yes, but with what we have passed through, you can be confident that you are walking with an incredible amount of coverage. In the next and final piece, we put all these issues together to give you a sense of what a holistic organizational resilience program can look like and what its outcomes should be.

More from Incident Response

When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule

In February 2023, X-Force posted a blog entitled “Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers” that details the capabilities of a sample attributed to the Lazarus group leveraged to impair visibility of the malware’s operations. This blog will not rehash analysis of the Lazarus malware sample or Event Tracing for Windows (ETW) as that has been previously covered in the X-Force blog post. This blog will focus on highlighting the opportunities for detection of the FudModule within the…

Breaking Down a Cyberattack, One Kill Chain Step at a Time

In today’s wildly unpredictable threat landscape, the modern enterprise should be familiar with the cyber kill chain concept. A cyber kill chain describes the various stages of a cyberattack pertaining to network security. Lockheed Martin developed the cyber kill chain framework to help organizations identify and prevent cyber intrusions. The steps in a kill chain trace the typical stages of an attack from early reconnaissance to completion. Analysts use the framework to detect and prevent advanced persistent threats (APT). Organizations…

Defining the Cobalt Strike Reflective Loader

The Challenge with Using Cobalt Strike for Advanced Red Team Exercises While next-generation AI and machine-learning components of security solutions continue to enhance behavioral-based detection capabilities, at their core many still rely on signature-based detections. Cobalt Strike being a popular red team Command and Control (C2) framework used by both threat actors and red teams since its debut, continues to be heavily signatured by security solutions. To continue Cobalt Strikes operational usage in the past, we on the IBM X-Force…

What is a Red Teamer? All You Need to Know

A red teamer is a cybersecurity professional that works to help companies improve IT security frameworks by attacking and undermining those same frameworks, often without notice. The term “red teaming” is often used interchangeably with penetration testing. While the terms are similar, however, there are key distinctions. First and foremost is the lack of notice from red teams. Pen testing may be scheduled in advance to assess the ability of specific security measures to handle a simulated attack; red team…