MITRE Releases Tool to Design Cyber-Resilient SystemsMITRE Releases Tool to Design Cyber-Resilient Systems

Cyberattacks are on the rise and enterprise defenders are protecting an increasingly expanding and complex attack surface. For many organizations, the focus is shifting away from prevention to resilience — to maintain essential business functions during an attack and recover quickly without losing too much downtime. Toward that end, MITRE has released the Cyber Resiliency Engineering Framework (CREF) Navigator, a free visualization tool for engineers designing cyber-resilient systems.

The Navigator helps organizations customize their cyber-resiliency goals, objectives, and techniques as aligned by NIST SP 800-160, which outlines standards on developing cyber-resilient systems. MITRE integrated the MITRE ATT&CK techniques and mitigations into the Navigator tool to help engineers understand how the systems they are designing could be targeted.

Resiliency is something that is engineered into the system — it doesn't just happen. The CREF framework guides engineers along four key principles: Anticipate (informed preparedness), Withstand (continue business functions even while under attack), Recover (restore business functions after an attack), and Adapt (change to minimize impact of attack).

The tool makes it possible to search and visualize the cyber-resiliency framework so that engineers can "make educated and informed choices," said Shane Steiger, MITRE's principal cybersecurity engineer, in a statement.

Companies are looking at cyber resilience as part of their strategy to prevent incidents and mitigate losses when they occur, according to Cisco's annual "Security Outcomes Report": A full 96% of executives surveyed named security resilience as high priority. The report identified some actions that helped increase resilience:

Automated support for organizations interested in building stronger defenses for their critical infrastructure will be available in a future version, MITRE says. "We plan to keep evolving the Navigator as the discipline of cyber-resiliency engineering matures," MITRE's Steiger said in a statement.