Security chiefs whose companies operate in the EU should be exploring DORA now – Source: www.csoonline.com

If your enterprise operates in Europe, you should care about the Digital Operational Resilience Act (DORA), which took effect on January 17. DORA, also known as Directive (EU) 2022/2555 of the European Parliament, aims to enhance and build the EU’s cybersecurity capabilities and it has been hanging like the Sword of Damocles over the heads of EU financial entities,

For those to whom DORA applies, compliance is expected. The first set of technical standards is out now and the next will come into force on July 17, 2024. A key element concerns third-party service providers, specifically those which are classified as “critical.”

Companies, either directly or via third-party service providers, are expected to have to establish a number of key processes:

• ICT risk management.
• Incident reporting and management.
• Information sharing and cybersecurity.
• Supervisory framework for third-party providers

Roll up your sleeves and explore DORA

To say the implementation of DORA will be a challenge is an understatement. Rare is the enterprise, large or small that doesn’t use third-party providers. Those with the more robust IT and information security maturity may have a leg up.

I say may have a leg up, because not knowing what you don’t know could turn out to be costly. Not only from a perspective of vulnerability but also from a fiscal perspective. This will be especially ticklish for smaller entities whose third-party service providers provide a critical core service, not a supplemental contextual presence.

At the recent BlackHat EU I had the opportunity to chat with Julie Albright, chief operating officer of runZero, and the company’s global technology evangelist Wes Hutcherson about what they are seeing as their primary concerns around DORA and its attendant surveys, attestations, and inspections.

I posited it looked like a heavy lift, perhaps too heavy for the smaller enterprises. Hutcherson opined that companies rarely know of all the assets within their enterprise which would fall under DORA’s ICT rubric — processes and measures that organizations implement to manage the risks associated with using third-party information and communication technology service providers.

In his own writing on DORA, Hutcherson notes that “over 60% of connected devices are invisible to defenders and unmanaged assets were linked to seven out of 10 breaches” in the last year. Yet, all assets must be part of resilience testing. He further cautions that the magnitude of the fines for non-compliance will be an eye-opener — the CISO will want to be sure the chief financial officer is part of any DORA adherence team.

DORA penalties reach into the tens of millions of euros

A DORA penalty review completed by Avenga compared its financial costs to those of the General Data Protection Regulation (GDPR) under which fines may reach 20 million euros or 4% of total global turnover (fiscal).

Providers of ICT services, be they in-house or third-party, may see fines within DORA of 2% of “annual worldwide turnover” or 1% of a “company’s average daily turnover worldwide. And this is where it really gets painful — individuals and their companies may be fined up to one million euros.

If you are a third-party service provider, the fiscal hit is even greater, with corporate fines of up to five million euros and individual fines of 500,000 euros for “failure to meet DORA’s standards.” Avenga notes that a “company failing to comply with DORA and GDPR will face almost certain financial peril.”

In addition to the CFO, one will also wish to have the head of procurement and contracting as part of the DORA team, as putting the requirements for DORA compliance into contracts is not only prudent, but it may in fact save a company from financial disaster.

Knowing what assets fall under DORA’s purview is essential

I turned to Curtis Simpson, CISO, for Armis for his thoughts on what his peers should be addressing in order to ensure alignment with DORA’s expectations. It was not surprising to see how he picked up on the lack of visibility into assets as the key issue.

“As of January 2025, financial organizations will have to attest to the resilience of their attack surface to meet DORA’s stringent requirements,” Simpson said. Yet many struggle to effectively complete the first step in maintaining compliance — identifying and managing all assets within their expanding environment.

“Understanding ‘what do I have?’ is an incredibly important question for security teams and can be a nearly impossible challenge without the right solutions in place, given the growing number of physical and virtual assets organizations rely upon,” Simpson said. “However, it’s not only essential (and possible!) to answer this question on its own but to more broadly address the goals of DORA to ensure operational resilience.”

It is important for CISOs and others in the DORA compliance team to understand that if you’re not proactively hunting and discovering devices on your network and relying on spreadsheets to tell you who owns what, you really need to move into the second quarter of the 21st century on the quickstep.

DORA is all about enforcing resilience

Resilience is the keyword, according to Simpson, “It’s all about minimizing the potential for material business impacts as the result of a cyber incident through a holistically proactive approach that addresses the entire life cycle of managing cyber threats.”

Another process of tremendous import for every CISO is that when a device is procured its lifecycle should already be projected through redundancy and the point where the device retired safely into IT asset disposition (ITAD) for the safe retiring of the asset.

“CISOs should prioritize shifting from a reactive to a proactive cybersecurity stance by gaining a clear grasp on every facet of cyber threat exposure management: asset discovery and management, early warning threat detection, vulnerability discovery, prioritization and remediation,” Simpson said.

“This will not only enable continuous compliance with DORA’s forward-looking directives, but it will also strategically empower security teams to protect the entire attack surface and manage their organization’s cyber risk exposure in real-time to strengthen cybersecurity overall against existing and emerging threats.”

Compliance does not equate to security, according to the old adage, but compliance with DORA and GDPR will, as Simpson points out, “strategically empower security teams,” and isn’t that is a desired outcome for every CISO?