Cyber recovery: assurance beyond prevention
Helio Digital Bank runs 60% of its workloads in a single cloud region and relies on an external identity provider for customer login. A ransomware tabletop exercise assumed the primary region was unavailable for 24 hours. The exercise revealed that the bank could restore its core ledger from immutable backups, but the backups had never been restored into a clean environment, the identity provider's contract promises a four-hour service credit but no recovery commitment, and the call tree for out-of-band customer communications was 18 months out of date. The bank's cyber recovery objective is 12 hours, but the last full restore test took 31 hours and required two engineers who have since left. MFA is enforced for staff but not for the 30 third-party support accounts with privileged access. The board wants to know whether the bank is cyber resilient. The CISO wants to buy a new endpoint detection tool.
1. Assess whether the bank can claim to be cyber resilient. What evidence would you present to the board?
Read the worked answer
No-not on current evidence. Cyber resilience is the ability to withstand, adapt to and recover from a cyber event, not the number of prevention tools. The bank has a stated 12-hour cyber recovery objective but has demonstrated 31 hours, in a test that has not been repeated in a clean environment and depended on two engineers who have left. That is a capability gap, not a documentation gap.
The identity provider is a single point of failure for customer login. A four-hour service credit is a commercial remedy, not a recovery commitment. The out-of-band communications tree is 18 months old, so the bank may not be able to tell customers what is happening. Thirty privileged third-party accounts without MFA are an exposed lateral movement path.
Board evidence should include: the last clean-room restore result and independent observation; recovery time by important business service against tolerance; data integrity and reconciliation results; identity fallback test; communications test; privileged access review; and a remediation plan with dates. The board should be told that prevention maturity and recovery maturity are different, and that the bank currently has a recovery gap.
2. The CISO requests funding for endpoint detection. How should the board weigh this against the gaps found?
Read the worked answer
Endpoint detection may be justified, but it should not be funded as a substitute for the recovery gaps. Use a risk-reduction test: which investment most reduces the likelihood or impact of a severe but plausible event on an important business service within tolerance? The unanswered recovery questions-clean restore, identity resilience, privileged access, communications-directly affect the bank's ability to recover. Endpoint detection mainly affects detection and containment; it may reduce the chance of a large event, but it does not prove recovery.
A defensible board decision is to fund endpoint detection in phases if threat intelligence and control gaps support it, while ring-fencing funding for recovery testing, a clean recovery environment, identity fallback, privileged access management and out-of-band communications. Set conditions: endpoint detection success measures (coverage, detection time, containment time) and recovery milestones. Avoid an either/or debate. Ask the CISO to present a combined roadmap with dependencies and residual risk if either is delayed.
3. Design a cyber recovery test that would give the board credible assurance.
Read the worked answer
Design for credibility, not theatre. Scenario: ransomware compromises the identity provider and encrypts production storage, with data exfiltration and public disclosure risk. Make it severe but plausible and agreed by the board.
Scope: end-to-end card and payments service, including the ledger, identity, payment provider, customer communications and regulatory notification. Exclude key engineers and require the team to use only documented runbooks. Restore into an isolated clean environment and validate data integrity and reconciliation before reopening. Test degraded manual fallback for login and payments.
Success criteria tied to tolerance: time to detect, contain, restore and reconcile; percentage of transactions processed in degraded mode; customer contact time; evidence of data integrity. Use independent observers and capture decision logs.
Include business decision-makers, not only IT. Include the identity provider and payment provider in the exercise or test their failure separately. Produce a report with observed recovery time, gaps, owners and dates. Repeat after remediation. A test that only proves a data-centre failover is not a cyber recovery test.