# Resistance

**In short:** Resistance is how well a system keeps operating while a malicious actor attacks it. ISO/IEC 25010 lists it as a security sub-characteristic. It is about withstanding attacks, not only blocking them.

## Explanation

ISO/IEC 25010 is a standard quality model for software products. It defines resistance as a security sub-characteristic: how well a product or system sustains operations while a malicious actor attacks it.

**How it differs from its neighbors**

- Confidentiality means only authorized parties can access data. Resistance is about continuing to operate under attack.
- Authenticity means proving that an identity is the one claimed. It is not about operating under attack.
- Resilience, as the Software Engineering Institute describes it, protects critical capabilities from harm caused by adverse events in general. Resistance is narrower, because it covers attacks only.

**Ways to keep operating under attack**

- Stop attacks and code flaws from exhausting resources. Then a distributed denial-of-service (DDoS) attack, which floods a system with traffic, does not cause downtime.
- Use redundancy (extra copies of components) and diversification (different implementations). Both limit the damage of one cyberattack, because it cannot take out all copies.
- Authenticate and authorize every actor. Minimize access by privilege, scope, and time. This limits exposure and reduces how far corruption can spread.
- Assume breach, a Zero Trust principle. Design compensating controls that limit damage if a primary defense fails. This is defense in depth.
- Detect attacks, respond to them, and recover. This preserves or restores security assurances during and after an attack. An incident response plan is part of readiness.

**Finding and testing the right attacks**

Threat modeling identifies and prioritizes the attack vectors that matter. Periodic penetration tests then check the defenses by simulating real-world attacks.

## Example

An online ticket shop expects traffic floods when popular events go on sale. The team lists likely attacks in a threat model. They add limits so that no single client can use up all resources. They run several copies of the checkout service. Admin tools require sign-in and grant only the access each role needs. An incident response plan says who reacts and how the shop recovers. A yearly penetration test checks that these measures hold.

## Trade-offs

Security controls should block attackers without blocking legitimate users. Setting that balance between security and availability takes care.

Security can also work against reliability. Security-focused design may add points of failure and operational complexity. Each defense for resistance therefore needs a check on what it adds to the system.



## Checks

- The document defines resistance as keeping operations running while under attack, separate from confidentiality and authenticity.
- Threat modeling identifies and prioritizes the relevant attack vectors.
- Access is authenticated, authorized, and minimized by privilege, scope, and time.
- Controls prevent attacks and code flaws from exhausting resources, so attacks like DDoS do not cause downtime.
- An incident response plan covers detecting, responding to, and recovering from attacks.

## Related

- [Security](https://arc.fuet.ch/concepts/quality-attributes/security.md)
- [Security Tactic](https://arc.fuet.ch/concepts/tactics/security-tactics.md)
- [Security Scenario](https://arc.fuet.ch/concepts/quality-attributes/security-scenario.md)
- [Availability](https://arc.fuet.ch/concepts/quality-attributes/availability.md)
- [Confidentiality](https://arc.fuet.ch/concepts/quality-attributes/confidentiality.md)
- [Authenticity](https://arc.fuet.ch/concepts/quality-attributes/authenticity.md)
- [Integrity](https://arc.fuet.ch/concepts/quality-attributes/integrity.md)
- [Recoverability](https://arc.fuet.ch/concepts/quality-attributes/recoverability.md)

## Sources

- [ISO 25010](https://iso25000.com/index.php/en/iso-25000-standards/iso-25010?start=5) — iso25000.com, accessed 2026-11-09
- [System Resilience Part 5: Commonly-Used System Resilience Techniques | CMU Software Engineering Institute](https://www.sei.cmu.edu/blog/system-resilience-part-5-commonly-used-system-resilience-techniques/) — sei.cmu.edu, accessed 2026-11-09
- [Security design principles - Microsoft Azure Well-Architected Framework | Microsoft Learn](https://learn.microsoft.com/en-us/azure/well-architected/security/principles) — learn.microsoft.com, accessed 2026-11-09