Getting ready for the EU Digital Operational Resilience Act (DORA)

For financial entities, and indeed most other businesses today, apps and data are now mission critical. Fully protecting these assets with technology such as a robust web application firewall (WAF) is vital, both to comply with DORA and to ensure continued operations during a distributed denial of service (DDoS) assault and other attacks.

DORA also requires financial entities to promptly detect anomalous activities, including ICT network performance issues and related incidents, as well as the identification of potential material, single points of failure. In the case of a serious incident, the financial entity must notify regulators, affected clients and partners. They'll then have to report on progress towards resolving the incident and produce a final report analyzing the root causes.

To meet those requirements, financial entities need full visibility of the performance and security status of their apps. This is where the F5 Distributed Cloud Console can play a big role. Designed to provide consolidated end-to-end visibility of the entire app estate, it ticks most of the boxes for DORA's digital resilience compliance.

The F5 Distributed Cloud Console also helps with some of DORA's more nuanced demands. For example, financial entities must test their ICT tools, systems and processes at least every three years using penetration tests.

Until recently, this type of activity was the domain of expert, and often expensive, "white hat" hackers. This is no longer the case, and it is now feasible to automate the entire process.

Earlier this year, F5 launched its Distributed Cloud Web App Scanning solution, which enables organizations to continuously monitor the Internet, public repositories, exposed servers, and other sources to consolidate external-facing app services, data, and vulnerabilities. On top of that, they can also conduct automated penetration tests, identify potential vulnerabilities, get evidence of issues, and receive remediation guidance to improve security and ensure compliance.

Greater automation means it is for more cost-effective to run continuous penetration testing, rather than on a project-by-project basis, to ensure the timely release of new products and services.