Metrics that Matter for Critical Infrastructure Cyber Resilience

Critical infrastructure services in North America face accelerating threats from both nation-states and other sophisticated threat actors. Governments globally are grappling with how to best balance incentives, support, and direct oversight. Meanwhile, critical infrastructure owners and operators face significant challenges with technology, staff resources, and expertise to better manage cyber resilience.

For instance, the healthcare industry is labeled a critical infrastructure sector. The cyberattack that took down Change Healthcare, which provides technology used to submit and process insurance claims and handles about 14 billion transactions a year, has been described as “the most significant and consequential cyberattack in American history.” The attack provides a real-world example of the blurry lines between public and private sector targets, and between nation-state and criminal hackers.

Learning Objectives:

• Review trends in cyber threat activities that organizations may see
• Outline useful metrics to determine the cyber resilience in different critical infrastructure sectors
• Evaluate the tools available to address these kinds of threat activities
• Develop actionable recommendations to build flexibility to respond to evolving threats