Business Continuity in the age of Cyber Attacks

Business continuity is the capability to sustain critical functions during and after disasters, but increasing digital transformation has shifted the most likely and disruptive threat from traditional events (fires, floods, disease outbreaks) to cyber attacks. As organizations rely more on IT systems, cloud services, and mobile work, attack surfaces expand while adversaries—often nation state-backed or using nation state-level methods—become better funded, more organized, and more destructive. Because attackers only need one exploitable weakness, breaches are treated as inevitable; continuity planning must therefore align tightly with cyber security to limit short-term operational impact and enable rapid recovery, including scenarios of prolonged, targeted, and infrastructure-destroying attacks.

Destructive malware and “wiper” attacks underscore why perimeter defenses and standard online backups are insufficient. NotPetya’s impact on A.P. Møller-Maersk illustrates extreme failure modes: core directory and network services were damaged, thousands of servers and applications were destroyed, tens of thousands of laptops were rendered unusable, and access to file shares and print capability was lost, contributing to an estimated $350m in lost revenue. The document argues for integrated Business Continuity and Cyber Security teams built around shared business impact analysis, prioritization of essential functions, and coordinated incident response and disaster recovery.

Key enablers include privileged access management (least privilege and just-in-time admin rights), segmented networks and Zero Trust to stop lateral movement, offline/offsite backups resilient to total IT failure, joint playbooks and exercises with clear chains of command, and technology investments that emphasize detection, response, and recovery. Security intelligence platforms, AI/ML-supported analytics, and SOAR capabilities support faster, more informed responses, while DevSecOps embeds continuity and security into architecture, development, and operations.

• Business continuity aims to maintain critical business functions during and after a disaster.
• Cyber attacks are characterized as the most likely threat to business continuity due to rising IT dependency.
• NotPetya contributed to an estimated $350 million in lost revenue for A.P. Møller-Maersk.
• NotPetya caused severe damage to DHCP and Active Directory services at Maersk.
• NotPetya destroyed 49,000 laptops and eliminated print capability at Maersk.
• NotPetya disabled access to all file shares and 1,200 applications at Maersk.
• NotPetya destroyed 1,000 applications and 3,500 of 6,200 servers at Maersk.
• The Mirai botnet attack in October 2016 hit DNS provider Dyn and took offline services including Airbnb, AWS, Box, GitHub, Netflix, PayPal, Reddit, Spotify, and Twitter.
• Shamoon attacks are identified as occurring in 2012 and 2016 and targeting Saudi energy companies.
• A BadRabbit variant in November 2018 infected a Maersk employee’s device via the Interfax website, and automated protection limited the impact to one device.

• “Cyber attacks that breach security defenses have become inevitable”
• “Organizations need to adopt a broader approach to security and Business Continuity in the face of changing attacks across an ever-widening attack surface”
• “Perimeter cyber defenses are no longer enough in the face of modern cyber attacks”
• “Integrating Cyber Security and Business Continuity is a priority if both are to be successful”
• “Privileged Access Management essential to Cyber Security and Business Continuity”
• “People and processes are just as important as technology to achieving security and continuity goals, and should not be overlooked”
• “Develop joint security/continuity playbooks to set response procedures for a range of attack scenarios”
• “Technology investments should be focused on supporting Business Continuity”
• “Plan for the worst in terms of detection, response, recovery and improvement of both security and continuity capabilities”
• “Assume there will be cyber attacks and that network defenses will be breached.”