17 / 17

Chapter 14: Resilience Engineering

نموذج إِمام التعليمي: إنطلاقة راسخة على خطى الأولين
وَأَعِدُّوا لَهُم مَّا اسْتَطَعْتُم مِّن قُوَّةٍ

"And prepare against them whatever you are able of power" - Qur'an 8:60

(Transliteration: Wa'aʿiddū lahum mā istaṭaʿtum min quwwatin)

Foundation: الاستعداد (Preparedness) and الصمود (Steadfastness)

⚡ Your Mission: Master resilience engineering to protect Saudi Arabia's critical infrastructure
افهم
Understand

Why resilience?
Core principles
Section: Core Concepts

مارس
Practice

4 Rs Framework
Hands-on planning
Section: Framework

اتقن
Master

Sociotechnical design
Production systems
Section: Design

ميز
Excel

Saudi leadership
Vision 2030
Section: Innovation

🚀 Framework Evolution: Shaping Resilience Engineering

افهم

Two Lenses for Mastering Resilience

🏭 Industrial Revolution 6.0 (IR 6.0)

Human-Centric Resilience (2020s)

  • Section 14.1 - Cybersecurity: Shifts from prevention to recovery (e.g., Shamoon attack recovery), prioritizing human operators.
  • Section 14.2 - Sociotechnical: Balances automation with human flexibility (e.g., emergency response systems).
  • Section 14.3 - Design Patterns: Creates adaptive architectures (e.g., NEOM's self-healing infrastructure).
  • Section 14.4 - Case Studies: Learns from global failures to build better systems.
Market Impact: IR 6.0 reduces downtime costs by 40% through human-centered resilience design.

📖 Islamization of Knowledge

أسلمة المعرفة (Proactive)

  • Section 14.1 - Cybersecurity: Derives security from trust (أمانة) and preparedness (استعداد).
  • Section 14.2 - Sociotechnical: Models human-system balance from Islamic consultation (شورى).
  • Section 14.3 - Design Patterns: Inspires redundancy from community support (تكافل).
  • Section 14.4 - Case Studies: Aligns recovery with patience (صبر) and perseverance.
Principle: Start with Islamic wisdom on preparedness, then integrate global resilience practices.
University Tool: Theoretical Framework
Market Test: Real Incident Response

🎯 Your Learning Approach (Mapped to Objectives)

  • ✅ Understand resilience vs reliability vs security (Objective 1, Section 14.1).
  • ✅ Master the 4 Rs framework (Objective 2, Section 14.2).
  • ✅ Design sociotechnical resilient systems (Objective 3, Section 14.3).
  • ✅ Apply to Saudi critical infrastructure (Objective 4, Section 14.4).
🤔 Quick Quiz: Which IR 6.0 Benefit Applies to Resilience? (2 mins)
⏱️ Timer: 2:00
A. Human operators adapt when systems fail
B. Technology prevents all failures
C. Automation replaces human judgment
D. Systems expect and recover from failures

🌍 Mission Context: Your Daily Reality

افهم
University Tool: Case Analysis
Market Test: Understanding System Failures
Right now: Every Saudi system you use has survived multiple attacks

🎯 Start With Your Experience (2 mins)

⏱️ Timer: 2:00

(Adapt for online/in-person; use breakout rooms for collaboration)

Quick Activity: Think about these scenarios:

  • Your bank app during a DDoS attack
  • Absher during Hajj season surge
  • Hospital systems during power outage

Question: What happens when they fail? How do they recover?

Notice: Systems fail, but critical services continue. How?!

💥 The Shamoon Attack Reality

  • • 35,000 computers wiped at Saudi Aramco
  • • Oil production never stopped
  • • Recovery in 2 weeks
  • • Lesson: Resilience > Prevention
🤔 Quick Poll: What made Aramco survive Shamoon?
A. Perfect security prevented damage
B. Critical systems were isolated and recoverable
C. They had better antivirus
D. Lucky timing

📚 What IS Resilience Engineering?

افهم
University Tool: Conceptual Analysis
Market Test: Identifying Resilient Systems

🔍 Discover It Yourself (3 mins)

⏱️ Timer: 3:00

(Adapt for online/in-person)

With your neighbor, classify these approaches:

Scenario Reliability/Security/Resilience? Why?
99.999% uptime goal ? Your answer...
Firewall blocking attacks ? Your answer...
Manual backup when system fails ? Your answer...
Learning from failures ? Your answer...

99.999% uptime: Reliability - Preventing failures
Firewall: Security - Blocking attacks
Manual backup: Resilience - Accepting failure, having alternatives
Learning: Resilience - Improving from experience

Sommerville (2015): "The ability to maintain continuity of critical services in the presence of disruptive events"
Market Reality: Companies that focus only on prevention lose $2.5M per hour during unexpected failures.

⚖️ Resilience vs Reliability vs Security

افهم
University Tool: Comparative Analysis
Market Test: Choosing the Right Approach

🎮 Live Simulation: The Banking Problem (5 mins)

⏱️ Timer: 5:00

(Adapt for online/in-person; simulate with scenarios)

Scenario: You're designing Al Rajhi Bank's system

  • Reliability approach: 99.999% uptime servers
  • Security approach: Military-grade firewalls
  • Resilience approach: Backup systems + manual procedures

Challenge: Sophisticated attack happens anyway!

A) Reliability saves you (servers don't fail)
B) Security saves you (firewall blocks it)
C) Resilience saves you (backup systems activate)
D) Nothing helps

Why Option C? Resilience assumes failures WILL happen and prepares recovery. Reliability (A) can't prevent new attacks. Security (B) can be bypassed. Only resilience (C) ensures continuity.

Market Reality: SAMA now requires all banks to have resilience plans, not just security.

Key Differences

Aspect Reliability Security Resilience
Goal Prevent failures Prevent attacks Survive anything
Assumption We can eliminate faults We can block threats Failures WILL happen
Focus Technical perfection Access control Recovery & adaptation
Saudi Example STC 5-nines uptime NCA frameworks Shamoon recovery
Islamic Principle إتقان (Perfection) حماية (Protection) صبر واستعداد (Patience & Prep)
إِنَّ مَعَ الْعُسْرِ يُسْرًا

"Indeed, with hardship comes ease" - Qur'an 94:6

(Transliteration: Inna maʿa l-ʿusri yusrā)

🔄 The 4 Rs Framework

مارس
University Tool: Framework Application
Market Test: Incident Response Planning

The 4 Rs in Action

👁️
Recognition
Detect problems
→
🛡️
Resistance
Reduce impact
→
🚑
Recovery
Restore critical
→
🔧
Reinstatement
Full restoration

🎭 Role Play: Apply 4 Rs to Absher Outage (4 mins)

⏱️ Timer: 4:00

(Adapt for online/in-person)

Scenario: Absher is under DDoS attack during Eid travel rush

Team Roles:

  • Recognition Team: How do you detect the attack?
  • Resistance Team: What immediate defenses activate?
  • Recovery Team: Which services restore first?
  • Reinstatement Team: How do you return to normal?

Recognition: Traffic monitoring alerts, response time degradation
Resistance: Rate limiting, CDN activation, traffic filtering
Recovery: Critical services (passport renewal) first, non-critical later
Reinstatement: Full services restored, logs analyzed, defenses improved

Saudi Implementation Examples

System Recognition Resistance Recovery Reinstatement
SADAD Transaction monitoring Load balancing Priority payments Full service
Tawakkalna Health alerts Backup servers Core permits All features
Hajj Systems Crowd sensors Overflow handling Safety first Normal flow
Market Reality: Companies with mature 4Rs frameworks reduce incident costs by 60%.

👥 Sociotechnical Resilience

مارس
University Tool: Systems Thinking
Market Test: Human-System Integration

💭 Think About It: Why Do Systems Really Fail? (3 mins)

⏱️ Timer: 3:00

Discuss with your neighbor:

  • When was the last time pure technology failure caused a disaster?
  • How many failures involve human factors?
  • Can we eliminate human error?
Key Insight: "People are very good at adaptation. Software is not."
Resilience requires both technical systems AND the humans who operate them.

The Human Factor

❌ Person Approach

Blame individuals for errors:

  • "Operator mistake"
  • Punishment & retraining
  • Same errors repeat

Islamic view: ظلم (Injustice)

✅ Systems Approach

Accept human fallibility:

  • Design better systems
  • Multiple safeguards
  • Learn from failures

Islamic view: رحمة وحكمة (Mercy & Wisdom)

Market Reality: 70% of security breaches involve human factors, not technical failures.
Industry Tool: Use chaos engineering (Chaos Monkey) to test human-system resilience.

🧀 Swiss Cheese Model

اتقن
University Tool: Defense in Depth
Market Test: Layered Security Design

🧀 Live Demo: Build Your Defense (5 mins)

⏱️ Timer: 5:00

(Adapt for online/in-person; use paper or digital boards)

Activity: Design defense layers for a Saudi bank

  1. Draw 5 cheese slices (defense layers)
  2. Put holes in each (vulnerabilities)
  3. Arrange so holes don't align
  4. Label each layer (firewall, auth, encryption, etc.)

Swiss Cheese Visualization

Firewall
Auth
Encryption
Monitoring
→
Failure only when ALL holes align!

Applied to Saudi Systems

Layer Defense Vulnerability (Hole) Backup Layer
1. Network Firewall Zero-day exploits IDS/IPS
2. Application Input validation Logic flaws WAF
3. Identity Nafath 2FA SIM swapping Biometrics
4. Data Encryption Key theft Access logs
5. Human Training Social engineering Verification procedures
🤔 How many layers should you have?
A. As many as possible
B. Enough to prevent alignment, balanced with usability
C. Exactly 5 layers
D. One strong layer is enough

🏗️ Designing Resilient Systems

اتقن
University Tool: Architecture Design
Market Test: Production System Building

Critical Service Identification

🎯 Prioritization Exercise: Hajj Systems (4 mins)

⏱️ Timer: 4:00

You manage Hajj digital services. Rank by criticality:

  • [ ] Crowd monitoring & safety alerts
  • [ ] Hotel booking system
  • [ ] Emergency medical dispatch
  • [ ] Social media updates
  • [ ] Payment processing
  • [ ] Transportation scheduling

Critical (Must survive):
1. Emergency medical dispatch
2. Crowd monitoring & safety

Important:
3. Transportation scheduling
4. Payment processing

Nice to have:
5. Hotel booking
6. Social media

Design Patterns for Resilience

💾
Redundancy

Multiple copies
Different locations
SAMA: 3 data centers

🎭
Diversity

Different implementations
Multiple vendors
NCA: Multi-cloud

🏥
Graceful Degradation

Reduce features
Maintain critical
Tawakkalna lite mode

🔄
Rapid Recovery

Automated failover
Quick restart
Absher: 5-min recovery

# Resilient Architecture Example
class ResilientBankingSystem:
  def __init__(self):
    # Multiple database replicas
    self.primary_db = Database("primary")
    self.secondary_db = Database("secondary")
    self.emergency_cache = LocalCache()
  
  def process_transaction(self, transaction):
    try:
      # Normal path
      return self.primary_db.process(transaction)
    except PrimaryFailure:
      # Automatic failover
      self.alert_ops_team()
      return self.secondary_db.process(transaction)
    except TotalSystemFailure:
      # Degraded mode - critical only
      if transaction.is_critical():
        return self.emergency_cache.process(transaction)
      else:
        return "Service temporarily unavailable"

🏥 Case Study: Resilient Healthcare System

اتقن

🏥 Design Challenge: Sehhaty Resilience (5 mins)

⏱️ Timer: 5:00

(Budget: 10M SAR; Scale: 30M citizens)

Build resilient Sehhaty for Saudi healthcare:

  • Critical: Emergency records, current medications
  • Important: Appointment booking, test results
  • Nice-to-have: Health tips, fitness tracking

Your task: Design architecture that survives cyberattacks

Resilient Architecture:

  • Local hospital caches for emergency data
  • Blockchain for medication records (tamper-proof)
  • P2P sync between hospitals during outages
  • Manual paper backup procedures
  • Dedicated emergency access terminals
Market Reality: MOH requires all hospitals to maintain 72-hour offline capability.

Implementation Details

Component Normal Mode Degraded Mode Emergency Mode
Patient Records Full history Last 6 months Critical only
Prescriptions Electronic SMS backup Paper + phone
Lab Results Real-time Batch upload Phone/fax
Appointments Online booking Call center Walk-in only

⚖️ The Efficiency-Resilience Trade-off

اتقن
Critical Decision: Maximum efficiency OR ability to survive?

The Eternal Conflict

For Efficiency vs For Resilience Saudi Example
Just-in-time ⚖️ Buffer stocks Aramco oil reserves
Automation ⚖️ Human oversight NEOM smart city
Centralization ⚖️ Distribution Government services
Specialization ⚖️ Cross-training Hospital staff
Lean operations ⚖️ Redundancy Banking systems

💭 Real Dilemma: Air Traffic Control (3 mins)

⏱️ Timer: 3:00

Scenario: Controllers print flight strips (paper backups)

Management: "Waste of paper! Everything is digital!"

Controllers: "When system crashed in 2019, paper saved lives!"

Question: What would you decide and why?

Balanced Approach: Keep paper for critical flights, reduce for routine. Cost of paper < cost of one crash. Islamic principle: الاحتياط (precaution) is wisdom.

خُذِ الْعَفْوَ وَأْمُرْ بِالْعُرْفِ

"Take what is given freely, enjoin what is good" - Qur'an 7:199

Balance between extremes is the Islamic way

🇸🇦 Saudi's Resilience Revolution

ميز
Vision 2030: From Shamoon victim (2012) to global resilience leader

🛢️ Aramco 2.0

Zero
Production impact from cyber
  • 35,000 PCs destroyed
  • Oil never stopped
  • 2-week recovery
  • Now: Quantum-ready

🏙️ NEOM Resilience

100%
Self-healing infrastructure
  • AI-powered recovery
  • Predictive resilience
  • Zero-downtime goal
  • Human-AI partnership

🕋 Hajj Systems

3M+
Pilgrims protected
  • Crowd AI monitoring
  • Health tracking
  • Multi-language support
  • 24/7 resilience

🏦 Financial Resilience

99.99%
SAMA uptime requirement
  • Real-time backup
  • Cyber resilience drills
  • 48-hour recovery
  • Global standards

Innovation Showcase

Saudi's National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) now mandates resilience planning for all critical sectors.

💼 Your Resilience Engineering Career Path

ميز

12-Month Roadmap to Excellence

Months 1-3: Foundation
  • Master Chapter 14 concepts
  • SANS resilience training
  • Chaos engineering basics
Months 4-6: Certifications
  • ISO 22301 (Business Continuity)
  • CISSP concentration
  • NCA ECC certification
Months 7-9: Real Experience
  • Internship at NCA/Aramco
  • Incident response team
  • Tabletop exercises
Months 10-12: Leadership
  • Design resilient system
  • Present at GISEC
  • Mentor junior engineers

Saudi Career Opportunities

Company Role Salary (SAR) Growth
Saudi Aramco Resilience Engineer 380,000+ Extreme
NEOM Infrastructure Resilience Lead 420,000+ Extreme
NCA Cyber Resilience Specialist 320,000 Very High
SAMA Financial Resilience Analyst 290,000 High
STC Network Resilience Engineer 280,000 High

📝 Assignment: Design Resilient National System

ميز
Design a complete resilient system for Saudi Arabia's critical infrastructure

Choose ONE National Challenge:

  1. 💳 SADAD payment network
  2. 🚗 Absher services platform
  3. 📱 Tawakkalna health system
  4. 🏥 Sehhaty medical records
  5. ✈️ GACA air traffic control
  6. 🏦 SAMA banking network

Deliverables (EMAM Framework)

Phase Weight Requirements Rubric
افهم 20% Why resilience > security, threat analysis Clear analysis with Saudi context – 10/20; Islamic principles – 10/20
مارس 30% Apply 4 Rs, Swiss cheese model Complete framework application – 15/30; Practical scenarios – 15/30
اتقن 30% Resilient architecture, critical services Technical design depth – 15/30; Production-ready – 15/30
ميز 20% Innovation, Vision 2030 alignment Creative solutions – 10/20; Saudi impact – 10/20

Submission Requirements

  • Due: Next week
  • Format: PDF + GitHub repo
  • Must include: Chaos testing scenarios, recovery procedures
  • Bonus: Working prototype, AI-powered resilience

Tools to Use

  • Chaos Monkey for testing
  • Kubernetes for container resilience
  • Terraform for infrastructure as code
  • Prometheus for monitoring

🎯 Key Takeaways - Chapter 14 Mastery

Summary: "Resilience engineering accepts that failures are inevitable and focuses on maintaining critical services through recognition, resistance, recovery, and reinstatement" (Sommerville, 2015)
🧠 Core Concepts

• Resilience > Security
• Accept failure
• Human factors

🔄 4 Rs Framework

• Recognition
• Resistance
• Recovery
• Reinstatement

🧀 Swiss Cheese

• Multiple layers
• Different types
• No alignment

⚖️ Trade-offs

• Efficiency vs resilience
• Automation vs flexibility
• Balance needed

Success Formula

Technical Excellence + Islamic Patience + Saudi Context + Global Standards = Unbreakable Systems

Self-Reflection Prompts

  • Can you explain why resilience > security to a CEO?
  • How would you apply 4 Rs to a real incident?
  • What's your personal efficiency-resilience balance?

🤝 Your Resilience Engineering Commitment

إِنَّ اللَّهَ يُحِبُّ إِذَا عَمِلَ أَحَدُكُمْ عَمَلًا أَنْ يُتْقِنَهُ

"Allah loves when one of you does work, that they perfect it" - Hadith

(Transliteration: Inna Allāha yuḥibbu idhā ʿamila aḥadukum ʿamalan an yutqinahu)

Every system you build protects lives, data, and national infrastructure.
افهم

Foundation

Accept failure

Plan recovery

مارس

Application

Practice 4 Rs

Test resilience

Learn from failures

اتقن

Excellence

Design for chaos

Human-system balance

ميز

Innovation

Lead Saudi resilience

Global standards

Protect millions

Reflection:

  • Which Saudi system needs resilience most?
  • How will you balance efficiency and resilience?
  • What's your first resilience project?
  • How will you prepare for the unexpected?

🙏 شكرًا - Your Journey Begins Now

وَقُل رَّبِّ زِدْنِي عِلْمًا

"My Lord, increase me in knowledge" - Qur'an 20:114

Resilience engineering evolves with every incident - keep learning!

You now understand how to build systems that survive anything
From preventing failures to thriving through them - you're ready!
📧 Contact

Office Hours: By Email

Email: arnoor@kau.edu.sa

📅 Next Class

Chapter 15

Reliability

Monday, 2:30 PM

📝 Due Soon

Assignment

Next week

Start TODAY!

🎯 Resources

Blackboard

Chaos tools

NCA guidelines

بروف: أديب بن رضا نور

See you next class, إن شاء الله
Remember: When systems fail, you make them rise again!