The missing link in cyber resilience
"When signals cannot be connected and interpreted together, organisations often lose valuable time deciding whether they are facing a genuine threat or simply another alert.”
Cybersecurity has become one of the biggest priorities for organisations across South Africa. Businesses continue to invest in security platforms, monitoring tools and threat detection technologies in an effort to strengthen their cyber resilience.
Yet despite these investments, many organisations remain uncertain about how prepared they really are to respond when a cyber incident occurs.
According to Dell Technologies’ Global Cyber Resilience Insights research, 63% of practitioners believe leadership overestimates their organisation’s readiness for a major cyber event.
That gap between perceived readiness and actual recovery capability highlights an important challenge for organisations as they strengthen their cyber resilience strategies.
According to Musa Masungwini, Security and Resiliency Platforms Specialist at Dell Technologies South Africa, the issue is not necessarily a lack of visibility.
“Most organisations already have extensive security capabilities in place and generate significant volumes of security data every day,” says Masungwini. “The challenge is that much of this information exists in isolation.
“When signals cannot be connected and interpreted together, organisations often lose valuable time deciding whether they are facing a genuine threat or simply another alert.”
This confidence gap is becoming increasingly significant as cyberattacks grow in sophistication and speed. While security teams receive thousands of alerts across multiple platforms, the real challenge lies in determining which signals require immediate action and which represent normal operational activity.
Detection is no longer the biggest challenge
Many organisations believe that improving cyber resilience requires more monitoring tools or more sophisticated detection capabilities. In reality, enterprise environments already generate enormous amounts of security-relevant information.
Primary storage platforms monitor unusual behaviour. Backup environments detect unexpected changes in data, while object storage platforms identify abnormal access requests. Individually, these events may appear insignificant. Together, however, they can reveal the early stages of a developing cyberattack.
“The problem isn’t detecting activity,” explains Masungwini. “The real challenge is having sufficient confidence in what those signals collectively mean. Without that confidence, organisations often delay action until the threat has already escalated.”
Why the storage and data layer matters
Cyber resilience discussions often focus on networks, endpoints and security operations centres. However, the storage and data layer is where critical business information resides and where many of the earliest indicators of compromise first become visible.
Rather than treating storage as passive infrastructure, organisations should recognise its role as an active participant in cyber resilience. When intelligence from storage, backup and data protection environments can be viewed together, security teams gain a far clearer understanding of what is happening across the organisation.
Turning isolated alerts into meaningful intelligence
The growing complexity of modern IT environments means different infrastructure platforms often generate alerts independently of one another. While each platform may identify unusual behaviour, none has sufficient context to determine whether those events are connected.
A cyber resilience control plane addresses this challenge by normalising and correlating signals across the storage and data layer before they reach existing security platforms. Rather than presenting security teams with multiple isolated alerts, it provides a contextual assessment based on correlated activity across systems.
“Cyber resilience isn’t about replacing the security investments organisations have already made,” says Masungwini. “It’s about enabling those technologies to work together more intelligently so that organisations can respond with greater confidence.”
From detection to coordinated response
Correlating signals is only part of the equation. Equally important is the ability to coordinate protective actions when a developing threat is identified. As confidence increases that an attack is taking place, organisations can automatically initiate appropriate defensive measures, including protecting critical recovery points, preserving snapshots and restricting access where necessary.
By coordinating actions across production and protection environments, organisations can reduce the delay between detecting suspicious activity and taking meaningful action, improving their ability to recover quickly should an attack occur.
Building greater confidence
As cyber threats continue to evolve, organisations are recognising that resilience is no longer measured by the number of security tools deployed. Instead, it depends on how effectively those technologies work together to provide actionable intelligence and enable timely decision-making.
“Cyber resilience is ultimately about confidence,” concludes Masungwini. “When organisations can understand what their infrastructure is telling them and respond before threats escalate, they move from reacting to cyber incidents to actively strengthening their resilience.”
©Higher Education Media Services.