The Psychology of Building a Resilient Cybersecurity Team

Resilience is important in any workplace. It’s been a particularly high-profile issue since the COVID-19 pandemic began. But what, exactly, is resilience? And how do we encourage resilient people to function successfully as a cybersecurity team?

Academic researchers define resilience as “the ability of a substance or object to spring back into shape” or “the capacity to recover quickly from difficulties; toughness.”

In cybersecurity, organizational resilience is often characterized in technical terms. To be resilient is to be ready to detect, defend, and respond to a completely new and unknown type of attack.

But technology is only one piece of the puzzle when you’re dealing with the complexity of a wicked problem – one that’s impossible or difficult to solve because of contradictory and changing requirements.

With this type of threat, your team’s preparedness – how people respond and work together under pressure – will determine how resilient your organization is. But with wicked problems, it’s impossible to define a procedure to guide your cybersecurity team.

Building team resilience here requires a different approach: regularly exercising your team in a collaborative testing environment with real-world, as-they-happen cyber threat scenarios. This develops technical thinking and people skills, as well as adaptive expertise. It also builds the cognitive agility needed to respond successfully to unexpected and unknown threats.

This is hugely important because if your people aren’t resilient, your system won’t be either.

Resilience is vital because it can help mitigate the impacts of cyberattacks. Research shows these harms can be physical, digital, economic, reputational, societal and psychological.

Such psychological harms can damage the people component of your cybersecurity capability. This reduces resilience and increases risk.

No. Resilience isn’t a personality trait. It’s something that can be learned at an individual and group level. When you build resilience skills within a cybersecurity team, the effect is transformative.

Regularly exercising and rehearsing crisis situations as a team also strengthens relationships. “No one is an island; people everywhere survive and thrive by pulling together,” one guide to building team relationships notes. “Ironically, however, organizations are finding it harder, not easier, to build successful teams.”

Defensive and offensive cybersecurity teams need to exercise their skills in complex scenarios that resemble the ones they encounter in their day-to-day work. This helps them to perform optimally when real-life incidents occur.

You can then capture data to identify your team’s knowledge gaps in real time – helping you to hone skills and track progress. By doing this, you ensure your teams are keeping pace with attackers and strengthening your organization’s overall cyber resilience.

Researchers from the University of Manchester reviewed studies about workplace resilience and identified four components of resilience. These are confidence, adaptability, social support, and purposefulness.

Confidence 

• The confidence that you have the skills, knowledge, and judgment to use the best techniques and make the right calls.

Adaptability

• Regular exercises are the only way to help teams consciously develop the agile thinking skills they need. This allows them to make connections between previous decisions and decide how to apply – or not apply – these insights during a real incident.

Social support

• Strong relationships require you to build trust. Don’t test them under pressure – build them through rehearsals and save difficult conversations for times when the environment is calm.
• Diversity of thought is important. A wide pool of knowledge, skills, and judgment provides more rounded solutions to problems. Depth of understanding is also important and encourages creative solutions to emerge by trying different techniques.

Purposefulness 

• The ability to adapt positively, learn and grow from experiences and progress toward goals.
• This requires self-awareness.

So, resilience isn’t just a trait – it’s built through continual development and exercising. Imagine the power of a cybersecurity team doing this together.

And building resilience works. Studies on resilience are evidence-based, not theory-based. The University of Manchester research found that “resilience training for workers may have beneficial consequences.” These benefits include improved wellbeing (i.e., reduced stress, depression, and anxiety) and increased confidence in the ability to cope with stressful events.

Organizations need to improve how they respond to cyberattacks. This is what we at Immersive Labs aim to support with our new Cyber Team Sim. It helps to:

Exercise your organization’s cyber professionals regularly in complex and realistic environments that are launched in minutes.

Evidence team capabilities by measuring and benchmarking against industry peers to build confidence, identify gaps in knowledge, upskill, and demonstrate ROI.

Equip teams with access to scenarios that reflect the latest threats – helping to develop the skills needed to defend the organization and mitigate risks.

¹Robertson, I., & Cooper, C. L. (2013). Resilience [Editorial]. Stress and Health: Journal of the International Society for the Investigation of Stress, 29(3), 175–176. https://doi.org/10.1002/smi.2512

²Agrafiotis, I., Nurse, J. R. C., Goldsmith, M, Creese, S and Upton, D. (2018). A taxonomy of cyber-harms: Defining the impacts of cyber-attacks and understanding how they propagate. Journal of Cybersecurity, 2018, 1 – 15 doi: 10.1093/cybsec/tyy006