Why Isolated States Build Cyber Resilience Differently
Most cyber-resilience frameworks quietly assume a certain kind of state. Connected. Allied. Welcome in the rooms where standards get written and threat intelligence gets shared.
Take that away, and the frameworks stop making sense. Not because the underlying problems change, but because every recommended solution assumes access the state does not have.
I have spent years circling this question. My undergraduate thesis in cybersecurity engineering was a comparative analysis of VPN solutions for peer-to-peer content delivery, using Iran as the case study. The fieldwork included interviews with people who depended on VPNs just to reach their families under network restrictions. I have also lived through national-scale internet shutdowns myself, months at a stretch, while running a consulting practice. So this is not an abstract topic for me. It is the anchor of everything I write on this site.
What resilience means when you are connected
For a well-connected state, cyber resilience is mostly a portfolio problem.
You diversify suppliers so no single vendor failure takes you down. You buy redundant transit from multiple international carriers. You join information-sharing bodies so you hear about threats early. You call allies when an incident exceeds your capacity.
Every one of those moves depends on the outside world being available to you. Redundancy assumes there are alternatives to switch to. Information sharing assumes someone will share with you. Mutual aid assumes someone will pick up the phone.
Two states that cannot make those assumptions
Iran and North Korea are the two clearest cases of states building cyber resilience under isolation. They are usually lumped together. They should not be, because they answer the problem in almost opposite ways.
ISOLATION — TWO ANSWERS TO THE SAME PROBLEM
IRAN · substitution on top of connection
+-------------------------------------------+
| global internet ................... KEPT |
| National Information Network ... domestic |
| national CERT | local cloud | mirror apps |
+-------------------------------------------+
-> degrade gracefully, stay online for trade
NORTH KOREA · minimize the surface instead
+----------------------------------------+
| global internet ......... a tiny few |
| Kwangmyong intranet | Red Star OS |
| little external infrastructure to lose |
+----------------------------------------+
-> forfeit the internet's value, accept the costIran: substitution on top of connection
Iran remains connected to the global internet, but it has spent well over a decade building a parallel domestic layer, widely known as the National Information Network. The idea, as described in Iranian policy documents and outside analyses, is that core services — payments, government portals, messaging, hosting — should keep functioning on domestic infrastructure even if international connectivity degrades or is cut.
Alongside the network layer sits an institutional layer: a national CERT function, domestic hosting and cloud providers, and locally developed apps that mirror foreign services.
I want to be precise about what I am doing here. I am describing an architecture, not endorsing the constraints that shaped it. Analytically, the pattern is substitution: for each external dependency, build a domestic stand-in, and keep the global connection for everything the substitutes cannot do. Iran needs the global internet economically, so it cannot simply unplug. The result is a layered system designed to degrade gracefully rather than fail completely.
North Korea: minimizing the surface instead
North Korea took the other road. Rather than building substitutes on top of global connectivity, it minimized the connectivity itself. The Kwangmyong national intranet serves domestic users, while access to the actual internet is restricted, as consistently reported, to a very small group. The country even maintains its own operating system, Red Star OS.
That is not resilience through redundancy. It is resilience through a tiny attack — and dependency — surface. There is very little external infrastructure to lose, because very little was ever relied on.
The trade-off is severe. A near-air-gapped national network forfeits most of the economic and scientific value of the internet. North Korea can accept that trade in ways Iran cannot, because their economies and societies depend on connectivity to completely different degrees.
What isolation actually changes
Put the two cases side by side and you can see isolation reshaping resilience strategy across at least four dimensions.
Procurement. Sanctioned states cannot simply buy the market-leading firewall, endpoint agent, or cloud service. That pushes them toward open-source software, domestic development, and sometimes riskier gray channels. It also means no vendor support contracts, no official patches through normal channels, and no one to call when a product breaks.
Information sharing. Threat-intelligence relationships, incident-response networks, and standards bodies are built on trust between members. Excluded states either build parallel relationships or operate partially blind. I will come back to this exclusion problem later in the series, because I think it is one of the least examined issues in cyber governance.
Talent. Isolation cuts both ways on people. It accelerates brain drain, but it also forces serious investment in domestic training pipelines, because importing expertise is not an option.
The threat model itself. A connected enterprise plans for downtime and data loss. An isolated state plans for the possibility that the external world becomes unavailable entirely — or hostile. That assumption changes what you build first, and it explains architectures that look irrational from a purely commercial point of view.
Why anyone else should care
It is tempting to file all this under "edge cases." I think that is a mistake, for two reasons.
First, the assumptions of the mainstream frameworks are getting shakier for everyone. Supply-chain shocks, export controls, and the fragmentation of the internet into regulatory blocs mean that even well-connected states are starting to ask isolation-shaped questions: what do we do if a critical foreign dependency disappears? The isolated states have been running that experiment, at scale, for years. Their results — the successes and the costly failures — are data.
Second, exclusion has costs for the excluders. A state cut off from patching channels, threat feeds, and coordination bodies becomes a weak point in a network everyone shares. Malware does not check passports.
Where this series goes
This piece is the anchor for a longer series on cyber governance and policy, written from a practitioner's seat rather than a think-tank one. My background is hands-on — systems administration, SOC work, building a security program inside my own startup — and I am now finishing a graduate degree in international relations, where I plan to take this exact comparative question further as thesis research.
In the pieces ahead, I will get concrete: what a CSIRT actually is and why governments should care, how CSIRT capacity building works as a governance project, what a minimum viable national cyber-governance stack looks like, how the major critical-infrastructure frameworks compare, and where deliberate self-reliance ends and forced disconnection begins. I will also write about what national-scale shutdowns do to the people and businesses under them, from experience.
One framing rule for the whole series, stated once here: when I analyze how systems behave under constraint, I am studying resilience. I am not endorsing the constraint. Those are different things, and I intend to keep them separate on every page of this site.