How to build and maintain cyber-resilient systems