As the Digital Operational Resilience Act (DORA) enters its second year of enforcement across the European Union, financial institutions face the ongoing challenge of proving the effectiveness of their risk management frameworks. This year, EU regulators are concentrating more on the practical application of DORA, particularly in the areas of Information and Communication Technology (ICT) incident analysis and risk oversight. This focus raises a critical question for security operations centers (SOCs): Is there sufficient visibility to detect and manage intrusions effectively?
The Importance of Continuous Monitoring
DORA does not specify a particular security setup, but it emphasizes the need for continuous visibility in ICT environments to identify potential risks. Continuous monitoring goes beyond maintaining an inventory of network activities; it involves identifying deviations from expected operational patterns. Article 9 of DORA mandates financial entities to consistently oversee their ICT ecosystem’s security and function, implementing strategies to reduce ICT risks.
A thorough asset inventory outlines the systems owned or operated by a financial institution, while configuration records show intended interactions. However, these measures alone may not provide comprehensive insights into system communications, especially across legacy systems or unmanaged devices. To counteract AI-speed threats, it is essential to have a detailed overview of network communications, as unmonitored system connections may expose vulnerabilities.
Detecting Anomalies with Context
Article 10 of DORA requires financial institutions to quickly identify unusual activities, including network performance issues. Establishing thresholds for initiating incident responses is crucial. While security alerts are abundant, they often create noise that obscures genuine threats. The true challenge lies in determining whether an alert signifies a larger incident. Network Detection and Response (NDR) tools can correlate data from various sources, providing the context needed to understand the scope and impact of incidents.
NDR systems analyze structured network data to help analysts connect seemingly unrelated alerts, such as a suspicious login and an abnormal network communication. This context is vital for establishing the full scope of an incident, especially given today’s rapidly evolving threats. NDR facilitates compliance with Article 19’s reporting requirements by ensuring rapid access to comprehensive network evidence.
Managing Third-Party Risks Effectively
Articles 28 through 30 of DORA focus on managing ICT risks related to third-party service providers. While contracts and vendor assessments outline access rights and operational limits, network data reveals the true functionality of third-party software and connections within an IT environment. If vendor credentials are compromised, NDR can help detect changes in network activity, allowing institutions to question whether interactions remain within approved boundaries.
As financial entities advance into DORA’s second year, network visibility remains a crucial component in meeting the requirements of continuous monitoring, anomaly detection, and incident response as outlined in Articles 9 and 10. By leveraging NDR, organizations can gain insights into system communications, identify anomalies, and trace incident pathways, ensuring they meet DORA’s stringent requirements.
Corelight’s Network Detection and Response (NDR) solution offers open and explainable data to uncover elusive threats and expedite triage. By maintaining protocol-level context, Corelight facilitates comprehensive investigations, enabling analysts and AI to derive conclusions from well-rounded evidence rather than isolated alerts. For more insights into Corelight’s capabilities, visit their website.
