Cyber defense is the organized work of preparing for, withstanding, and recovering from hostile activity against systems.
It is the operational side of protection, concerned with detection, containment, continuity, and learning after an event.
How it works
Defense assumes that some hostile activity will get past prevention, so teams practice how to notice it and how to keep essential work running.
Plans name decision makers, communication paths, and the order in which services are restored.
The same availability concerns extend to operators of power, water, health, and transport, where public safety depends on connected operations.
Planning at that scale stays general: know dependencies, rehearse recovery, and do not publish detail that would help an intruder.
Concrete examples
- A hospital keeps a paper fallback for a short list of critical care tasks in case the network is unavailable.
- A water utility rehearses who may isolate a control segment and who informs the public if service is degraded.
- A transit operator stores an offline copy of restoration contacts so a network outage does not hide the response plan.
Protective measures
- Write a defense plan that names decision makers and the order in which you restore essential services.
- Rehearse that plan with the people who would actually execute it, including nights and weekends.
- Map which business services depend on power, water, health, or transport partners, and keep that map private.
- After every serious event, record what detection missed and change the plan before the next quarter.