{"id":46026,"date":"2024-04-08T09:45:17","date_gmt":"2024-04-08T08:45:17","guid":{"rendered":"https:\/\/www.innovationnewsnetwork.com\/?p=46026"},"modified":"2024-04-08T09:45:17","modified_gmt":"2024-04-08T08:45:17","slug":"ramping-up-security-to-meet-operational-resilience-rules","status":"publish","type":"post","link":"https:\/\/www.innovationnewsnetwork.com\/ramping-up-security-to-meet-operational-resilience-rules\/46026\/","title":{"rendered":"Ramping up security to meet operational resilience rules"},"content":{"rendered":"
Operational resilience is the ability to prevent, withstand, recover, adapt and learn in the face of disruption, including cyber events.<\/p>\n
Currently, it represents a far-reaching set of issues that are increasingly important to private sector organisations and lawmakers alike. In both the EU and the UK, stronger regulatory frameworks are evolving<\/a>, accompanied by serious consequences for those who fail to comply.<\/p>\n For instance, the Digital Operational Resilience Act (DORA)<\/a> and the NIS2 Directive<\/a> are two major pieces of European cybersecurity legislation aimed at strengthening operational resilience and cybersecurity across various sectors, including finance. While they share common goals, they focus on different aspects and have distinct scopes of application.<\/p>\n Designed to strengthen IT security across a wide range of financial entities, DORA comes into force in early January 2025.<\/p>\n It focuses heavily on improving resilience \u201cin the event of a severe operational disruption.\u201d It is relevant to financial services industry organisations that supply services inside the EU. Failure to comply can result in penalties of up to 2% of the total worldwide revenue for any organisation found to be in breach.<\/p>\n For any business leaders that operate within the parameters set out by GDPR, the jurisdiction rules will have a familiar ring about them, and the UK\u2019s position outside of the EU will, for many organisations, be an irrelevance.<\/p>\n The NIS2 Directive has been active since January last year. It aims to improve the level of cybersecurity protection across the EU, with an emphasis on harmonising security requirements and reporting obligations. In addition, it encourages member states to integrate new areas, such as supply chain security, vulnerability management and cyber hygiene, into their national cybersecurity strategies. The Directive also promotes improvements in knowledge sharing, collaboration, the development of an EU-wide vulnerability registry, a Crises Liaison Network and improved cooperation, among other measures.<\/p>\n In the UK specifically, regulators<\/a> have looked closely at the role played by Critical Third Parties (CTPs) \u2013 external organisations whose services are vital to the operational integrity and operational resilience of financial institutions. CTPs could include cloud service providers such as AWS or Microsoft and a range of other technology businesses that play a key role in supporting the sector. Additionally, the Cross Market Operational Resilience Group<\/a>, chaired by the Bank of England, provides detailed guidance on operational resilience for the financial services sector, which, whilst not legally binding, acts as a good base for best practice.<\/p>\n Our recent survey conducted at the Cloud & Cyber Security Expo at Tech Show London<\/a> in March with 100+ cloud professionals indicated that awareness remains low around new compliance obligations. Nearly half \u2013 46.5 % \u2013 were unsure of their organisation\u2019s ability to comply with supply chain regulations and frameworks such as NIS 2 or SBOM<\/a>. And of those respondents who work in the finance sector, 30% were unaware of the Digital Operational Resilience Act (DORA). Just over a third \u2013 35% \u2013 were confident of their organisation’s ability to comply.<\/p>\n Additionally, the shift towards cloud-native technologies, with their distributed systems and microservices architectures, presents a new set of challenges for regulatory compliance and operational resilience. This environment, characterised by dynamic resource scaling to meet demand, introduces complexities in maintaining compliance amidst the fluid nature of containerised deployments and autoscaling practices.<\/p>\n Autoscaling, a hallmark of cloud-native environments, allows for efficient resource management but necessitates a nuanced approach to operational resilience. The ability of systems to automatically adjust resources complicates adherence to stringent regulatory frameworks, requiring organisations to adopt innovative monitoring and management strategies that align with the fluid dynamics of cloud-native operations.<\/p>\n So what impact are these regulations making (or will they make) in practical terms, and what technology priorities should organisations address to ensure compliance?<\/p>\n Across the current financial industry ecosystem, for example, there is an increasing reliance on the provision of agile, scalable and reliable applications, with Kubernetes and DevOps among the platforms and methodologies playing an important role in software development and delivery strategies. In this context, resilience and security are \u2013 understandably \u2013 key considerations.<\/p>\n Operational resilience ensures that organisations working with Kubernetes and cloud environments deploy robust, secure infrastructure and applications capable of swiftly recovering from disruption. This includes implementing best practices for Kubernetes security, ensuring high availability and disaster recovery capabilities, and effectively managing third-party risks associated with cloud service providers.<\/p>\n Operational resilience in these environments also involves continuous monitoring, incident response planning, and regular testing of recovery procedures to ensure that the organisation can maintain its critical functions under a variety of adverse conditions.<\/p>\n In relation to DevOps, which has become a widely adopted software development methodology globally, security can be improved by integrating advanced measures directly into development and deployment processes. This includes implementing \u2018Compliance as Code\u2019, which integrates automated compliance checks within the CI\/CD pipeline.<\/p>\n The most effective approaches enforce compliance policies and regulatory requirements directly in the infrastructure as code (IaC) templates and container configurations. This ensures that every deployment automatically adheres to necessary compliance standards, reducing manual review processes and the potential for human error.<\/p>\n This should be accompanied by the use of immutable security policies for containerised applications and Kubernetes clusters. By defining strict security policies that cannot be altered once a container or service is deployed, this approach ensures that any attempts to change the security posture can only be made through the CI\/CD pipeline, enforcing consistency, audibility, and compliance with existing security standards.<\/p>\n Looking more closely at the issues associated with CTPs or the wider supply chain, the creation of a Software Bill of Materials (SBOM) is a critical component in ensuring the security and integrity of software applications and their dependencies. This approach is increasingly relevant in the context of broader cybersecurity strategies and compliance with regulatory requirements such as DORA and is important for several reasons:<\/p>\n However, while SBOMs provide a comprehensive inventory of all the components present in a software application, including those that may not be actively loaded into memory or called during runtime, these inactive components can still pose security risks.<\/p>\n Inactive but vulnerable components could potentially be used as part of an exploit chain or become an active threat later if the application\u2019s functionality changes over time.<\/p>\n Therefore, SBOMs are a critical tool for risk management in the supply chain, but they must be part of a larger holistic security. It’s essential to consider the security implications of all components within a software application, even if they are currently unused. Maintaining a comprehensive SBOM and regularly reviewing it for vulnerabilities, even in inactive parts, are crucial security practices.<\/p>\n Additionally, alongside utilising SBOMs, organisations must take a more comprehensive approach to vulnerability management, including continuous monitoring, prioritisation, and proactive remediation.<\/p>\n Organisations must act now to stay ahead of the curve and ensure compliance with emerging regulations. Some concrete steps they can take include:<\/p>\n Looking ahead, these represent just some of the key considerations for organisations operating in and around the finance industry ecosystem. In a climate where the role of regulation seems likely to increase even further, organisations that can integrate security into their development processes now will be better placed to adopt future changes in regulation as they emerge.<\/p>\n It’s essential to consider the security implications of all components within a software application, even if they are currently unused. Maintaining a comprehensive SBOM and regularly reviewing it for vulnerabilities, even in inactive parts, are crucial operational resilience practices.<\/p>\n","protected":false},"excerpt":{"rendered":" Meeting operational resilience targets is crucial for cybersecurity measures to be successful across multiple industries. Discover more here.<\/p>\n","protected":false},"author":22,"featured_media":46034,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[830],"tags":[530],"acf":[],"yoast_head":"\nThe role of Critical Third Parties in meeting operational resilience targets<\/h3>\n
How can organisations be compliant, secure, and agile simultaneously?<\/h3>\n
\n
\n