Systems: Fourth level

Know

• SYS-4-CY-K1

  Cyber resilience is an organisation's ability to anticipate, withstand, recover from and adapt to attacks and data breaches.

  Learn card: Cyber resilience

  No organisation can stop every attack. Cyber resilience is the ability to keep going despite attacks: to anticipate them, withstand them, recover from them and adapt afterwards.

  A resilient organisation plans ahead. It keeps offline backups, has an incident response plan that staff have practised, and knows who to call.

  After an incident it learns lessons and improves, so the next attack does less damage.

  Cyber resilience is about an organisation's ability to...

  never be attacked anticipate, withstand, recover from and adapt to attacks buy the most expensive software avoid using computers

  Which is an example of being resilient?

  Having a tested plan and clean backups to restore from Hoping it never happens Paying any ransom quickly Turning off all security to save time

  Check my answers
• SYS-4-CY-K2

  A resilience framework gives a structured way to identify and assess cyber risks and plan recovery.

  Learn card: Resilience frameworks

  A resilience framework gives an organisation a step-by-step way to manage cyber risk, instead of guessing.

  Typical steps: identify what matters most (data, systems, people), work out the risks to it, assess each risk by how likely it is and how much harm it would cause, put protections in place, and plan how to detect, respond and recover.

  Ranking risks by likelihood and impact helps decide where to spend time and money first.

  What does a resilience framework provide?

  A structured way to identify and assess risks and plan recovery Free antivirus software A list of hackers A new network

  A risk that is very likely and would cause serious harm should be...

  ignored dealt with first dealt with last kept secret

  Check my answers
• SYS-4-CY-K3

  Digital forensics is collecting and analysing digital evidence after a cyber incident.

  Learn card: Digital forensics

  Digital forensics is collecting and analysing digital evidence after a cyber incident, to find out what happened, how the attackers got in, what they did and what was affected.

  Evidence includes log files, emails, files and the contents of memory and disks. Investigators copy evidence carefully so that it isn't changed, and record who handled it.

  Putting events in order on a timeline shows how the attack unfolded. That helps fix the weakness, and the evidence may be used by the police.

  Digital forensics means...

  designing websites collecting and analysing digital evidence after an incident fixing broken screens writing new software

  Why do investigators put log entries into a timeline?

  To work out what happened and in what order To delete them To make them shorter Logs are never used

  Check my answers

Do

• SYS-4-CY-D1

  Respond to changing cyber-attack scenarios or simulations and explain the decisions made.

  Incident Room

• SYS-4-CY-D2

  Explain why security has to be balanced against usability, cost and ethics.

  Trade-off Console

  Builds on: SYS-4 Computing Science: network hardware manages and controls data flow; local v distributed trade-offs (p.19)

Reflect