What are the best strategies to ensure resilient systems in the face of cyber and physical risks?

Yes to some extent similar to profiles applied in safety critical systems where no single failure can lead to catastrophic end function. Here redundancy and dissimilarity (diversity) is applied to provide robust functional performance. Where there are no easy reversionary or safe defaults on detecting attacks then dissimilar and diverse voting can be applied

Redundancy and diversity in components is necessary but not sufficient to ensure resilience. Too often, both I&O and Engineering make the mistake of regarding resilience as an infrastructure problem. It's not. Applications and services need to be architected to deal with ephemeral resources and unreliable response times, or the hardware sits there happily running along despite the application crashing or just failing to work. Modularity and loose coupling are essential.

We need to design the system in a way that the ripple effect of damage is as small as possible. This can be done by introducing loose coupling in the system. The degree of redundancy should be such that it is not overwhelming the whole system in terms of maintaining the balance between the services. Enforce correct access control measures.

Redundanz kann helfen, habe aber in der Praxis erlebt, dass das redundante System durch den gleichen glitch lam gelegt wurde als das primäre System. Diversität wäre hier hilfreich ist aber einen Auditor/manager schwer zu erklären, es wirft Zweifel auf bezüglich die Integrität der Daten.

While redundancy is a necessary cost to achieve resiliency, the diversity cost is rarely justifiable when you look at the trade-offs you make in terms of productivity, quicker progress, etc,... many a time, diversity is the real blocker in improving the resiliency of the systems, even though the failure mode is known it would take a long time to fix and be resilient against that failure mode due to the diversity in the systems

Fail safe and safe to fail are two different approaches to dealing with risk and architecting for recovery and prevention, one focuses on robustness and another on impact.

Coupling breaks down into design-time and run-time coupling, with the latter contributing to resilience, e.g. through use of asynchronous messaging or circuit breakers. Those mechanisms help limit the blast radius of any disturbance.

Kopplung erkennt man auch am notwendigen Wissen, welche es vom Gegenüber benötigt. Je mehr über das Verhalten des Anderen benötigt wird, desto grösser ist die Abhängigkeit von Veränderungen dessen. Je weniger Wissen über das Verhalten bei anderen liegt, desto freier kann das eigene System angepasst werden. Die Resilienz wird erhöht, weil so Änderungen unabhängiger und schneller gemacht werden können. Der Austausch der Systeme untereinander kann über gemeinsam Definierte Objekte oder Ereignisse erfolgen.

An illustration of this idea is the concept of Compartmentalization. Compartmentalization involves the segregation of components or processes into distinct and isolated units. In organizational management, for example, compartmentalization may involve structuring teams or departments in a way that limits the flow of information between them (loose coupling). The goal is to contain the impact of failures or breaches and to create boundaries that contribute to a more manageable and secure system.

Modularität hilft bei der schnelle Anpassung von gefährdeten Systemen, sie kann aber gefährlich sein im Kontext von risikobewältigung, da die Auswirkungen von ein eingetretenes Risiko ein Domino Effekt kreieren kann, dass nicht mehr überschaubar ist.

While it's easy to cut up a system into small pieces and declare that modularity is solved, it is infinitely harder to cut up a system so that the new modules are loosely coupled now and in the future. What's worse is that it's really harder to detect failures and learn from them because if you fail to implement an architecture that follows Conway's law, you can easily use the reverse Conway maneuver to change the communication channels of the real world instead

Die lose Kopplung von Systemen muss eine dem Zweck entsprechende Kommunikation gewährleisten. Dazu müssen Confidentiality, Integrity und Availability bewertet und getestet werden.

Monitoring and feedback is rarely a strategy used to improve resiliency because it's so easy to declare that you have monitoring on the system by having 4 metrics. Monitoring is an implementation detail of system design review actionables. A proper strategy would be to do system design reviews to identify failure modes and focus on how monitoring can help in such failure modes.

Würde m.e. Sinn machen, hat aber die Herausforderung, dass der Verantwortlicher bereit muss sein Geld für diese Funktionalität auszugeben, vor das etwas passiert und nicht im Nachhinein. Theoretisch gibt es hier die Möglichkeit der „anti-fragility“, je mehr ein System angegriffen wird, je resilienter wird es. Beispiel brute force dos attack, wenn man in der Lage ist die Infrastruktur schneller zu skalieren als der angriffsvektor wird das System immer ‚stärker‘. Bin aber kein techie müsste man abklären ob dies mit einer virtuelle Infrastruktur möglich wäre.

Monitoring and Feedback are key to a resilient system. Beyond just monitoring for realtime problems, the bigger win is use of all of the historical monitoring data to empower statistical logic, AI and ML to forecast problems before they occur. Equally important is to put this data into the customer's hands so they can use these tools to build solutions that target their specific architectures, workflows and challenges. We've moved from a world where red / green lights were all that monitoring is to one where that's the fire alarm, but fire prevention is what it's all about. Paul tagvs.com

AI, anyone? ;-) The foundational principles supporting both 'Monitoring and Feedback' and 'Adaptability and Learning' derive from established standards and methodologies, including but not limited to Six Sigma, ISO/IEC 27001, ISO 9001, TQM, and NIST RMF. Performance evaluation involves systematically assessing processes and outcomes to ensure their alignment with standards and objectives. Continuous improvement is then pursued by leveraging the insights gained from performance evaluations to enhance efficiency and adapt to changing requirements.

To my comment on Monitoring - yes. Intelligent and adaptive systems with fault tolerance and more importantly fault avoidance is the key to resilience. Big data, AI and ML are the tools to get the job done.

Das Lernen darf sich nur innerhalb festgelegter, vom System nicht änderbarer Grenzen bewegen. Diese Grenzen können durchaus von außen angepasst werden und sind soetwas wie eine ethische oder Moral-Richtlinie.

Schnittstellen zwischen den Komponenten und Modulen müssen ebenfalls kontinuierlich überprüft und wenn notwendig, überarbeitet werden. Unsauber definierte oder verwitterte Schnittstellen lassen ungewollte Fremdeinflüsse zu.

You only know if your system is resilient if you injected a disturbance and the system absorbed it and kept operating. This is the essence of chaos engineering and testing in production: injecting disturbance is the worst thing you can do to a robust system (those don't like disturbance) but the best thing you can do to a resilient system (because it'll become more resilient). The term for this behavior is "Anti-Fragile" after Nassim Taleb's book. Think vaccination: you inject a disturbance to improve the resilience of the system "human body"

If "A" sends "B" a Synchronous message, "B" needs to be running and "A" is stalled until "B" responds. If "A" sends "B" an Asynchronous message, "B" doesn't even need to be there, let alone be ready to respond if the messaging infrastructure is in-place. When "B" eventually arrives and wakes up, it can process the message from "A", however long ago it was sent, and reply to the message. The response from "B" is the same if it responds within a nanosecond or a year, so neither "A" nor "B" necessarily needs to change to cope with this failure case, so the system are simpler and more resilient too.

Zero Trust. We've come from a world where security was a 'network problem', but today we know that no network is safe in and of itself. Endpoint applications need to bear the responsibility for being the enforcers against all things bad, regardless of the trust level in a network, and needs to report on everything it encounters so evolving exposures can be identified and mitigated against early. Not to say that a network can be anything but tightly security-managed, but the buck stops at every endpoint for risk / safety. This is especially important in multi-tenant / multi-region cloud workflows where many loosely coupled functions play together.

A recurring theme across the preceding five concepts revolves around a methodology known as Defense in Depth. Defense in depth is a comprehensive strategy employed to safeguard systems by deploying multiple layers of security measures. This approach recognizes that relying solely on one line of defense is insufficient, and instead, it emphasizes a diverse and layered defense system. By adopting a defense in depth strategy, organizations create a more resilient and robust defense posture against cyber and physical threats.

The best strategy to ensure system resiliency encompasses a defense-in-depth approach. This layered security approach implements multiple security controls and protections simultaneously creating security redundancy. No single solution guarantees complete security. A combination of measures like MFA, access controls, data encryption, and user training provide a more comprehensive defense against cyber threats.