Resilience to cyberattacks is an organization’s ability to maintain its critical processes and gradually restore the rest of its systems when protective measures have failed to prevent an incident. For a television station, this ability means keeping broadcasts and transmissions running, even if the newsroom temporarily loses access to its digital tools. In other sectors, it may mean continuing to care for patients, maintaining a production line, or tracking the location of a shipment. Preparedness requires identifying essential processes, reviewing dependencies, protecting backups, controlling access, evaluating connections with third parties, and conducting authorized penetration tests. Being protected reduces risk. Being prepared allows an organization to continue operating when an incident does occur. Resilience against cyberattacks enables an organization to maintain its essential processes and recover its systems in an orderly manner when protective measures have not been sufficient.What does it mean to be prepared for a cyberattack? Resilience against cyberattacks involves preserving an organization’s ability to maintain its essential processes when its usual tools or systems are no longer available. It is not limited to trying to prevent incidents; it also involves knowing how to continue operating and gradually return to normalcy. Somewhere in the world, a television newsroom watched as several of its channels went dark. At first, no one suspected a cyberattack. When a signal disappears, the natural assumption is that some piece of equipment has failed. But then other systems stopped working. Some computers began behaving strangely, and unauthorized activity was also detected on some of the network’s digital channels. Then came an order as simple as it was unsettling: “Turn off the computers.” All of them. The newsroom suddenly found itself facing something that seemed impossible: it had to prepare the next newscast without the digital tools it had been using for years. Someone found a whiteboard. Sheets of paper appeared, pulled from a photocopier that no one used anymore. The script began to be written with a marker, and changes were crossed out by hand. Pens had returned to the newsroom. The scene seems made up, but it recreates a possible scenario based on situations that can arise when a cybersecurity incident affects a television station’s systems. And it explains quite well a term we use a lot in technology: resilience. In a situation like that, its meaning was quite simple: to keep functioning when what you take for granted stops working. Or, to put it in more business-friendly terms, being prepared to continue operating when protection isn’t enough.Why does greater connectivity also increase technological dependence? Digitization allows us to work more nimbly, share information in real time, and automate processes. At the same time, it creates dependencies among networks, servers, applications, vendors, and external services that can jeopardize business continuity when an incident occurs. Over the past few decades, we’ve connected practically everything. We work from anywhere, share information in real time, automate processes, use cloud services, and open our systems to employees, customers, and suppliers. All of this has allowed us to be faster and more flexible. It has also created dependencies that aren’t always obvious until something stops working. Television is a good place to observe this because the result can literally be seen on a screen. Furthermore, today’s television has little in common, technologically speaking, with that of a few decades ago. Behind the cameras and in the studios, we find video over IP, networks, servers, storage, software, automation, cloud services, and connections to a multitude of external systems. Everything is much more interconnected. And a problem can also spread much further. In the audiovisual projects we work on at Telefónica, this has even changed some of the questions we ask when designing an infrastructure. It’s no longer enough to ask ourselves how we want it to work. We also have to think about what should happen when something stops working. Because the problem, in reality, isn’t unique to television. Any company can temporarily lose access to the tools it uses, its documents, or the systems through which it serves its customers. It may discover a vulnerability in a vendor or, in certain incidents, identify unauthorized activity that had not been detected previously. That’s why there’s an idea that, to me, sums up this change quite well: Cybersecurity is no longer just about protecting computers. It’s about protecting an organization’s ability to continue operating.How do penetration testing and ethical hacking help prevent cyberattacks? Penetration tests, or pentests, allow organizations to search for vulnerabilities in a controlled and authorized manner before they can be exploited in an attack. These exercises must be adapted to the operational context to prevent the tests themselves from compromising the services they are intended to protect. Of course, the first priority is to prevent the incident from occurring in the first place. And one of the most effective ways to determine how well we’re protected is to have someone attempt to attack us before a real attacker does. That’s where pentests—or penetration tests—come in. Cybersecurity specialists search, in a controlled and authorized manner, for potential vulnerabilities and attempt to determine how far they could go by exploiting them. Other ethical hacking exercises can go even further and test not only the systems but also our ability to detect and respond. At Telefónica, we consider these types of tests particularly valuable when the technology supports processes that cannot be stopped. In the audiovisual world, there is also an obvious peculiarity: it wouldn’t make much sense to test the security of a television set by causing it to stop broadcasting. That’s where we need to combine two types of expertise. We must understand how an attacker might act, but we also need to have a thorough understanding of the technology that keeps a TV station on the air to know what we can test, when we can do it, and what the consequences might be. Then there are many other, far less flashy measures: updating systems, properly securing backups, controlling access, and reviewing third-party connections. They don’t usually make headlines. But every properly designed control can help reduce the chances that an attacker will gain access to critical assets.What happens when a cyberattack bypasses security measures? When an attack manages to bypass security measures, the organization needs to identify the affected systems, contain the incident, and assess which components it can shut down while trying to preserve its essential functions. These are decisions that should be planned in advance of a crisis. Being protected is not the same as being prepared Let’s return to our newsroom. While the journalists were preparing the newscast with pen and paper, the technicians were trying to figure out how far the attack had spread. They needed to decide what they could shut down without causing exactly what they were trying to avoid: the television station going off the air. And those kinds of decisions shouldn’t be improvised in the middle of a crisis. Companies spend a lot of time designing how we want to work when everything is running smoothly, and perhaps we should spend a little more time thinking about how we want to do it when things go wrong for various possible reasons. In our case, it’s very easy to visualize: a television station has to keep broadcasting, so the broadcast and transmission are almost sacred. In other businesses, it will be something else: treating a patient, maintaining a production line, or knowing where a shipment is. Every organization has something it simply cannot afford to lose. That old saying is very appropriate here: Si vis pacem, para bellum. If you want peace, prepare for war. For a television station, that preparation requires determining what the minimum viable level of operation is.What does a company need to maintain in order to keep operating during a crisis? Every organization must identify its critical processes, determine which ones to restore first, and define the minimum level of operation it needs to maintain while restoring the rest of its systems. This requires understanding which processes are truly critical, which ones we would restore first, and to what extent the alternatives we’ve prepared are truly independent. Because having two networks or two systems doesn’t always mean being twice as protected. If both depend on the same thing, a single incident can affect both. We may have invested heavily in redundancy and discover, just when we need it most, that we hadn’t built resilience. Disaster recovery is a capability aimed at strengthening the continuity and recovery of audiovisual services. In some cases, organizations invest in protection but not necessarily in preparedness. That is the difference between being protected and being prepared.How can a television station recover after a cyberattack? Recovery does not have to happen all at once. An organization can prioritize its essential functions, first restoring the systems necessary to maintain service and then gradually restoring the rest of its capabilities. The television station in this story finally managed to resume broadcasting. It didn’t restore all its systems at once. First, it brought online only what it needed to get a secure signal back on the air. The rest followed later. When the crisis was over, a program schedule covered in cross-outs was left on one of the tables in the newsroom. It was written in pen. Perhaps that sheet of paper explained better than any presentation what it really means to be prepared. We can’t guarantee that nothing will go wrong. We can try to prevent it, put up barriers, test our defenses, and reduce the risk as much as possible. And we can also prepare to carry on if all that isn’t enough. That night, a newsroom accustomed to working with some of the most advanced technologies had to fall back on one of the simplest. A pen. So perhaps the question worth taking away from this story is another: If the digital tools our company depends on were to disappear for a few hours tomorrow, would we know how to keep working? Because, in the end, no one is really looking for the word “resilience.” What organizations need is something much more straightforward: to be prepared to keep functioning. The goal isn’t to make the pen disappear forever. It’s about not having to look for it for the first time when everything else has already shut down.How can cybersecurity for audiovisual infrastructures be strengthened? Audiovisual cybersecurity requires combining technical knowledge of threats with specific expertise in IP video, broadcasting, transmission, networking, storage, automation, cloud services, and connections to external systems.For those who want to look behind the scenes If a television station might end up relying on pen and paper to keep a news program running, it’s worth asking what happens before it reaches that point and how we can prepare to avoid having to do so. In the audiovisual sector, that answer also has many specific nuances that we’ve barely been able to touch on here. Telefónica’s teams specializing in audiovisual and broadcast services delve into the specific risks of these infrastructures, how to prevent them, how to detect potential attacks, and how to design systems capable of recovering and continuing to provide service. This is the technical aspect we have deliberately left out of this article. Because behind every image that reaches a screen lies far more technology than we see. And protecting it means ensuring that we can continue to see it.Innovation, Security, and Digital Trust The continuity of audiovisual services demonstrates that access to advanced digital technologies must be based not only on innovation and connectivity, but also on security, preparedness, and resilience. In this context, Telefónica has taken on the clear challenge of becoming the best gateway for citizens to access digital technologies. Moving toward this goal means helping ensure that digital infrastructures and services can evolve with trust as a quality standard and with mechanisms that help maintain their availability in the face of potential incidents.Frequently Asked Questions What is resilience against cyberattacks? It is an organization’s ability to maintain its essential processes and gradually restore its systems when an incident disrupts its normal operations. What is the difference between being protected and being prepared? Being protected involves implementing measures aimed at reducing the risk of an incident. Being prepared means also having defined how the organization will continue to function if those measures fail to prevent it. What is a pentest? A pentest, or penetration test, is a controlled and authorized exercise in which cybersecurity specialists search for potential vulnerabilities and assess how far an attacker could go by exploiting them. Which processes should a company restore first? The priority depends on its business activity. Each organization must identify which functions it needs to maintain to continue operating at a minimum level and which systems support those functions. For a television station, broadcasting and transmission are particularly important. Why doesn’t redundancy always guarantee resilience? Because two networks or systems may share the same dependency. If that dependency is compromised, the same incident can compromise both alternatives. What is disaster recovery? Disaster recovery encompasses capabilities aimed at restoring systems and services after an outage, establishing recovery priorities based on the organization’s needs. What measures help reduce the risk of a cyberattack? The article highlights controlled penetration testing, system updates, backup protection, access control, and reviewing connections with third parties. What are the specific characteristics of audiovisual cybersecurity? It must take into account infrastructures that integrate video over IP, networks, servers, storage, software, automation, cloud services, and connections to external systems, while also considering the need to maintain broadcast continuity. More info here
——————————————————-
Click Here For The Original Source.
