My View - Cyber resilience is about people, not just technology

VIEW - Jean-Pierre Walle, group manager security assurance, Health New Zealand

A cyber incident can start with a single click and its impact can ripple far and wide.

When systems are disrupted, the challenge is not just restoring the technology, it is restoring trust. In healthcare, our work is ultimately about people, and that is an important perspective to bring to any cyber incident.

Responding successfully

A successful cyber response is not just about containing an attack or removing a threat from your environment: in many ways, that is when the real work begins.

When an organisation suffers a cyber incident, something more important than technology is affected - trust. Patients, customers, partners, suppliers and staff all want answers, they want to understand what happened, whether they have been affected, and what is being done to prevent it from happening again.

Many organisations focus heavily on prevention, but resilience requires us to think about what happens next. No organisation can eliminate every risk so the real test is how effectively you recover when things go wrong.

Do you know how you will communicate with affected people? Do you have accurate contact information if you need to reach them? Do you understand your privacy and regulatory obligations? Have you thought about how you will restore confidence once systems are back online? These questions are not technical questions, they are people questions.

Building trust

Another lesson is that trust is not rebuilt by saying everything is fine again. People increasingly expect evidence, not just attestations. They want to see what has changed. That means rolling out multi-factor authentication, being open about lessons learned, and demonstrating the actions taken to strengthen security. 

Showing the action you have taken can be just as important as restoring the technology itself.

Throughout my career, I have seen organisations underestimate the human impact of cyber incidents. The immediate focus is often on restoring systems, but recovery is about much more than technology, it is about restoring confidence in your organisation, your services, and your people.

I have also seen the toll incidents can take on those responding to them. Cyber events can place enormous pressure on teams: long hours, public scrutiny, and the responsibility of supporting affected people can create significant stress.

Resilience is not just about systems being able to recover, it is about ensuring people can recover too. Whether you are delivering healthcare, financial services, education, electricity, transport or government services, people depend on your organisation. When trust is disrupted, rebuilding it takes time, effort and preparation.

Putting people at the centre

Technology sits at the centre of modern organisations, but people sit at the centre of every recovery.

That is why cyber resilience is not simply a technology challenge, it is also a people challenge.

If you want to contact eHealthNews.nz regarding this View, please email the editor Rebecca McBeth.

Read more VIEWS

Return to eHealthNews.nz home page