08/26/2024 | Press release | Distributed by Public on 08/26/2024 08:24
The European Union has adopted the Digital Operational Resilience Act (DORA) to safeguard the cybersecurity and operational resilience of the European financial sector. In effect since January 2023, DORA requires compliance from all financial institutions operating in the EU by January 2025. But what is DORA? And how do DORA security requirements affect application security and reliability?
The Digital Operational Resilience Act (DORA) is a regulation that addresses the digital and cybersecurity resilience of financial institutions in the European Union. The regulation comprehensively addresses Information Communication Technology (ICT) risk management, harmonizing cybersecurity guidelines across the financial sector while considering the ever-evolving threat landscape.
DORA came into effect on January 16, 2023. Financial entities are expected to be DORA-compliant by January 17, 2025.
As the implementation date draws closer, it's imperative for financial institutions to acquaint themselves with the DORA regulation and take the essential measures for compliance.
DORA seeks to strengthen the cybersecurity resilience of the EU's banking and financial institutions by requiring them to possess the requisite processes, systems, and controls to prevent, manage, and recover from cybersecurity incidents.
DORA applies to more than 22,000 financial entities and ICT service providers operating within the EU and to the ICT infrastructure supporting them from outside the EU.
The regulation affects Banking, Financial Services, and Insurance (BFSI) services within the EU. This includes not only banks, insurers, and investment firms, but also payment processors, exchanges, market infrastructure entities, rating agencies, and other financial organizations.
DORA also applies to critical ICT providers that service the financial sector. Therefore, financial institutions need to map their critical third-party ICT dependencies and diversify suppliers, so they're not overly dependent upon a single provider or small group of providers.
The DORA regulation establishes uniform requirements regarding the security and reliability of network and information systems that support the business processes of financial entities. Application security and reliability are important to meeting these requirements.
DORA compliance initiatives can help drive a risk-based approach to application security, including exposure management, security testing, threat detection and response, and software supply chain security.
In the experience of Dynatrace customers, continuously monitoring, identifying, and addressing exposures-along with implementing more precise protection from exploit attempts-is crucial for maintaining a resilient IT environment. This proactive approach will ultimately make applications more secure and resilient to cyberattacks, which increases their overall reliability.
The following are Dynatrace's perspective on the DORA five pillars and why application security and reliability are important to complying with DORA.
Organizations must document a framework to identify and thoroughly assess potential ICT risks that could have operational effects on financial services. This involves analyzing the likelihood and potential effect of various threats, such as cyberattacks, natural disasters, and human error.
Automating processes to find, prioritize, and address exposure risk will enable compliance with this pillar. Based upon best practices in cybersecurity, Dynatrace suggests that organizations implementing its ICT risk framework consider the following factors in the context of application security and reliability:
Organizations will need a solid incident management program to meet incident reporting timeframes. Tools, processes, and policies that will enable monitoring, identifying, resolving, managing, and reporting incidents-internally to senior management and externally to regulatory authorities-are critical to meeting this requirement.
Some of the key DORA governance requirements to consider when selecting application reliability and security incident management tools, implementing processes, and developing policies to support a company's ability to meet the mandate include the following:
DORA requires organizations to assess their preparedness for handling ICT-related incidents and identify weaknesses, deficiencies, and gaps in digital operational resilience. To address this requirement, organizations will need a comprehensive digital operational resilience testing program with a range of assessments, tests, methodologies, and tools, approached in a risk-based manner.
From an application security and reliability perspective, DORA provides examples of appropriate tests that include open-source analysis, source code reviews, scenario tests, compatibility tests, performance tests, end-to-end tests, and penetration testing.
Key DORA governance requirements to consider when implementing digital operational resilience testing are the following:
Financial institutions rely on third-party vendors for various critical ICT services such as applications and cloud infrastructure. DORA emphasizes the importance of managing risks associated with some of these third parties. Managing risk includes evaluating the resilience of third-party providers and having appropriate risk mitigation strategies in place.
DORA encourages a more holistic approach to security. The regulation ensures that vulnerabilities in third-party applications do not become a weak link in the overall security posture. The following are some key governance requirements relevant for application security:
The Digital Operational Resilience Act requires that organizations share information and intelligence on cyber threats and vulnerabilities. By encouraging information sharing among financial institutions and authorities regarding cyber threats and incidents, DORA fosters collaboration and enhances collective understanding of the evolving threat landscape. This collaboration helps to improve overall preparedness and response capabilities across the financial sector.
DORA emphasizes that management is accountable for ensuring an organization's digital operational stability. It mandates that management guarantees the company's sufficient protection against ICT disruptions and cyber-attacks.
To maintain effective and reliable business operations, consider adopting the following application security best practices:
To assist you in complying with the Digital Operational Resilience Act, Dynatrace leverages its observability and security platform powered by the Davis AI engine, which combines causal, predictive, and generative AI. In supported environments, the Dynatrace Security Posture Management (SPM) solution automatically generates an analytic structure forthe compliance framework to identify and verify the regulation's technical compliance requirements.