The path to collective cyber resilience

As the world embraces the power of digital technologies, organizations everywhere now face the pressing need to manage a complex ecosystem of interdependencies. The proliferation of IT, OT and smart products within the Internet of Things — combined with an expanding threat landscape, evolving regulatory requirements and growing reliance on supplier networks — make the need for cyber resilience across entire ecosystems paramount.

What is the key to success in today’s dynamic environment? It’s digital trust. By adopting an ‘ecosystemic’ approach grounded in the principles of digital trust, more coordinated and resilient digital networks become a reality. ‘Ecosystemic’ thinking can provide a paradigm shift in how mutual digital dependencies may be viewed and has significant implications for how effectively we can work together.

This article seeks to examine the key elements of 'ecosystemic thinking’ — highlighting the need for long-term strategies and a holistic approach that is helping to make a difference today for some of the world’s leading organizations. It also looks at three essential steps to ecosystemic thinking that can help boost cyber resilience for a new era of challenges in this hyper-connected world. Companies that enable digital trust and collaboration across their ecosystem can position themselves to survive and thrive amid the challenges of a soaring threat landscape. Where to start? This article poses three fundamental questions businesses should ask themselves to transform ecosystem efficiency and security in a world of change. 

To become truly resilient in today’s reality — where the rapid pace of change is accelerating — organizations should look at the system as a whole or, at least, the digital ecosystems in which they operate.

Modern companies are not simple, stand-alone entities but increasingly part of interconnected networks — ecosystems — that can cut across sector boundaries and provide new opportunities for innovation, efficiency and growth. In today’s hyper-connected environment, digital trust becomes critical as increased interconnections unleash significant new challenges and the need to transform resilience.

Organizations are increasingly dependent today on third, fourth and fifth parties within their supply networks. While this level of collaboration offers significant benefits, it also introduces new risks that should be managed. The European Union Agency for Cybersecurity (ENISA) lists ‘Supply Chain Compromise of Software Dependencies’ as the top threat in its Foresight Cybersecurity Threats for 2030 report.^[i] As CISOs become more aware of growing supply-chain risks, mistrust and the expansion of third-party risk management controls are on the rise.

Meanwhile, government institutions globally are recognizing their responsibility to ensure a collective approach to bolstering digital resilience and fostering digital trust. In many of the latest National Cyber Security Strategies that recently have been published, national cybersecurity agencies or similar institutions describe the need for a resilient digital ecosystem.^[ii] At the same time, the increasing influence of government bodies on resilience — through regulations such as the EU’s new Network and Information Security Directive (NIS2), its Critical Entities Directive (CED), the Digital Operational Resilience Act (DORA) and the Cyber Resilience Act (CRA) — adds a new dimension of pressure and complexity for companies. As the landscape evolves, so must resilience strategies if companies hope to thrive.

Lastly, citizens and consumers of digital technology have increasing expectations for the reliability and trustworthiness of the digital products and services they rely on. Meeting these changing expectations through a transparent approach to digital trust is becoming a key differentiator for organizations.

Driven by the need for information sharing, trust technologies such as privacy-enhancing technologies (PETs) and blockchain potentially enable and fuel collaboration between ecosystem partners. Instead of mere compliance-driven agreements between organizations, collaboration, will ultimately benefit the organizations involved.

It’s revealing and informative to consider how an ‘ecosystemic’ perspective is already making a difference for many leading companies. These global giants recognize that their production processes, efficiency, and competitiveness rely on a wide array of suppliers in diverse sectors.

In some cases, they provide a platform on which other partners can prosper or share resources that ultimately benefit the entire ecosystem, including the platform provider. In other cases, the goal is to make the entire ecosystem resilient.

A leading chipmachine maker, for example, recognizes that its high-tech manufacturing process completely relies on numerous diverse suppliers, and a costly cyberattack on any of these companies could disrupt its entire business. To make the system as a whole resilient, it has begun sharing resources meant for its own security with its partners and vice versa.

Many organizations, amid limited financial resources, skills and technology, might prefer to focus on maturing their own cybersecurity before looking at suppliers’ security. But beware — that approach represents a short-term gain in the face of a much-needed long-term approach as the threat landscape expands and grows in sophistication.

There should be a new way of thinking that moves from short-term gains to long-term strategies — moving from individual security to collective resilience. Establishing a truly cyber-resilient ecosystem requires a long-term vision and a strategic step-by-step approach: