We’ve all seen how ransomware can bring businesses, local governments, and other organizations to their knees. In 2022, European countries were some of the most targeted by ransomware and security has been high on the agenda for both governments and businesses. The European Union’s Digital Operational Resilience Act (DORA) is intended to improve the way financial institutions manage data so that they are more resilient against ransomware and other cybersecurity threats.
What is DORA and what does it do?
DORA closes a critical gap in data management for banks. Before DORA, financial institutions did not manage all components of operational resilience—they managed operational risk related to the allocation of capital. Once companies are required to be in compliance with DORA in early 2025, banks’ responsibilities for operational risks will expand to include protection, detection, containment, recovery, and repair capabilities against information and communication technologies (ICT) incidents. DORA explicitly refers to information technology risks and creates rules for risk management, incident reporting, operational resilience testing, and third-party risk monitoring.
Complying with DORA is vital for banks based in or doing business in the EU, but compliance is about much more than simple data backup. To be prepared, financial institutions must find a new way to address security. They must have a plan, ready for execution, in a “day after attack” situation.
Challenges with Legacy Setups
A major stumbling block for organisations’ response plans are the limitations in the setup of their current architecture. Today, many banks have architecture based on a legacy approach of data management, where the main objective was to move as fast as possible from expensive to cheapest (from production to tape). The key metric of success was a low cost of ownership.
The major downside to only considering cost was that all other topics fall by the wayside. Business continuity, performance, simplicity, risk management, and ESG weren’t part of the equation.
The lasting implications of this approach are having a major impact on banks and other organisations as they are simply not set up to deal with today’s data challenges. Big data, fraud analysis, and regulatory requests are putting increasing pressure on resources. The banks’ original intentions were to save costs, but legacy architecture is having the opposite effect—the old setup is actually increasing cost of ownership.
Why Encryption is Key to Cost Efficient GDPR Compliance
Beyond Backup
Previously, security was based on a “drawbridge” design. Banks (and other companies) built walls to protect their IT. It was the time of firewalls, appliance merging routing, IP spoofing, antivirus detection, and more. But a key issue was not addressed in the “drawbridge” approach: a framework for steps to take in the wake of a security breach.
Modern data protection filled this gap in response to new security challenges. A critical part of preparing for resilience in the wake of cyberattacks is building the capability to ensure business continuity.
A New Resiliency Framework
Organisations need a plan for restarting core business applications so that banking functions can continue and must order these applications by levels of criticality to determine their order of restarting. This is a complex process for financial institutions that have thousands of applications. DORA addresses the complexity with its “five pillars” that provide a comprehensive digital resiliency framework for banking organizations:
- Set up and maintain resilient ICT systems and tools that minimize the impact of ICT risk.
- Continuously identify all sources of ICT risks in order to set up protection and prevention measures.
- Promptly detect anomalous activities.
- Create dedicated and comprehensive business continuity policies and disaster and recovery plans, ensuring a prompt recovery after a cybersecurity incident.
- Establish mechanisms to learn and evolve both from external events as well as the organization’s own ICT incidents.
Speed and Strategy for Business Continuity
The new context of DORA calls for financial institutions to define rules that allow simpler and more fluid data management. The first step is to redefine different data classification, with unique data moving easily from one category to another, following business requirements (from very hot to very cold).
Flash media solutions totally change the way we address data agility across silos. Flash performance and reliability enables a new way of working that financial institutions can benefit from now, which will also set them up for future challenges—all at a competitive cost, even for cold data.
Embedded features from Pure Storage are perfectly adapted to business continuity, allowing the financial industry to address business continuity for data, without compromise.
- SafeMode™, a data protection solution that’s built into FlashArray™, provides immutable snapshots of your data. SafeMode is built on the “Four Eyes Principle” currently used by the financial services industry for critical assets.
- FlashBlade® is the real hero for modern data protection. Its Rapid Restore feature dramatically increases the speed of data restoration, delivering a modern backup experience to restore systems in hours, rather than weeks—and protecting data wherever it resides.
Pure Storage’s approach to data management sets banks up for the future, with solutions that meet the requirements of modern data protection. If DORA will impact your organization, adopt a full-fledged strategic approach to ensure business continuity, and to meet the intent of the framework.
