5 Ways to DORA-Proof Your Business With Confidential AI

Aaron Fulkerson | CEO

2024-08-30

•

5 min read

As the countdown to the enforcement of the Digital Operational Resilience Act (DORA) begins, financial institutions and the ICT companies that support them are gearing up for a significant shift. DORA, set to take effect in early 2025, aims to fortify the financial sector against the growing threats of cyberattacks and data breaches. The act is anchored in five pillars: ICT risk management, incident reporting, digital operational resilience testing, third-party risk management, and collaborative information sharing. Adhering to each of these pillars requires a robust and resilient digital infrastructure. But how can businesses ensure they are fully DORA-compliant?

The answer lies in adopting confidential AI, like the platform offered by Opaque Systems. Opaque’s solution provides the tools necessary to not only comply with DORA’s requirements, but also to enhance digital resilience, and make it quick and easy to do so.

1. ICT Risk Management: Proactive Defense with Confidential AI

DORA requires organizations to have comprehensive ICT risk management processes and state-of-the-art security measures. Opaque’s confidential AI platform meets these requirements by using hardware-based Trusted Execution Environments (TEEs), which keep data encrypted at rest, in transit, and during computation. This approach helps financial institutions reduce the risk of unauthorized access and data breaches, and enables them to perform automated risk assessments without risking data exposure.

Overall, our platform's encryption capabilities ensure that financial institutions can securely manage their data throughout its lifecycle, and take proactive defense measures against cyber threats.

2. Incident Reporting: Swift, Secure, and Compliant

In the event of a cyber incident, DORA mandates timely and detailed reporting to regulatory bodies. Opaque’s platform supports this by enabling real-time monitoring and detailed audit trails, which uniquely support efficient incident management. These techniques can help businesses perform root cause analyses to pinpoint the origins of security incidents, and quickly report them to the appropriate organizations such as the European Banking Authority (EBA).

Our platform’s capabilities not only power compliance with DORA’s reporting requirements, but also ensure that financial institutions can quickly address and mitigate cyber threats.

3. Digital Operational Resilience Testing: Simulating Threats Safely

DORA emphasizes the importance of regular digital resilience testing to prepare for potential cyberattacks. Organizations that use Opaque’s solution are able to rigorously test their systems against cyber threats and ensure they are prepared to tackle real-world scenarios, such as attacks by bad actors. The ability to securely process encrypted data allows our customers to easily meet this DORA requirement and provide a verifiable audit trail to prove adherence.

For instance, Accenture, in collaboration with UC Berkeley and Opaque Systems, is working with government agencies to enable cyber security agencies and telcos to securely share data on suspicious IP addresses and malicious activities. This collaboration aims to protect citizens from cyber threats by facilitating secure data sharing and analysis, ensuring that sensitive information remains confidential throughout the process.

4. Third-Party Risk Management: Secure Data Sharing with Partners

Managing third-party risk is a critical component of DORA. Opaque’s platform enables secure and confidential data sharing with third-party vendors and partners. By leveraging confidential computing, organizations can share data with third parties without exposing it to unauthorized access, thus minimizing the risk of data breaches. This capability certifies that all parties involved in the financial ecosystem maintain the same high standards of data protection.

5. Collaborative Information Sharing: Strengthening Industry-Wide Security

DORA encourages collaborative information sharing among financial institutions to enhance industry-wide security. Opaque’s platform facilitates this by enabling secure, encrypted information exchanges between organizations. Our team pioneered verifiably private data collaboration during our research and development of a multiparty collaboration and competition platform at Berkeley RISELab in 2021, led by a team that included our co-founders Ion Stoica and Raluca Ada Popa. This platform enabled multiple data owners to perform joint analytics and machine-learning model training on collective data—without revealing their individual data to each other—and served as the foundation for our Confidential AI platform.

By maintaining data confidentiality during collaboration, financial institutions can share insights and threat intelligence without compromising sensitive information, thus contributing to a more resilient financial sector. For example, the Royal Bank of Canada (RBC) leverages confidential AI to securely merge merchant data and credit card transactions for more effective targeted advertising. By creating a secure environment, the technology ensures that data from multiple parties can be combined without compromising the privacy of any individual or entity involved. This approach allows RBC to deliver personalized advertising while maintaining the highest standards of data security.

Future-Proofing Your Business with Confidential AI

As the implementation of DORA approaches, financial institutions and their ICT partners must ensure their infrastructures are equipped to meet the regulation’s stringent requirements.