Exploring Resilience with DORA: Crypto Survival Guide - Anne-Grace Kleczewski

Transcript

[Music] hello everyone I hope the coffee already kicked in for everyone everyone is motivated and ready to jump into the first legal topic well it will not be that legal it's a legal presentation that's targeted at people working on the technical aspect it's about operational resilience of the in the financial sector and specifically of all the ICT infrastructure so really if you're a Dev what do you need to take think about what will the regulator point out as being a potential shortcoming and I've picked this picture of like a cat you'll see there's a lot of cats in my presentations trying to make law fun as

announced uh sitting on broken computers this whole presentation is about what do we do when the systems just go down what do we do to avoid that users complain the regulator points out some shortcomings by saying we were not prepared for the situation like what happens there so what is Dora to start with well Dora is something that was already published a while ago when we think about the first draft of this digital operational resilience um framework was published in 2020 since 2022 we have the actual final text uh it entered into FS already two years like more nearly two years ago and it's effective since January this year how come that we haven't heard more

about Dora so far it's not as if it popped out of the blue everyone was mentioning Ma MAA and am May a Casp is defi excluded what do we do do I need to publish a white paper this was the major topic but the thing is Dora was out there too and people don't seem to realize that there are consequences to this regulation as well if you're in the crypto sector now what is digital operational resilience like a complicated word like something that seems very theoretical but as I mentioned it's simply ensuring that you will be able to provide a service even if part of your ICT infrastructures goes down how do you ensure you have integrity that the data will not be hacked will not be uh manipulated how do you ensure that the system doesn't

completely break down and you cannot provide your financial service anymore so it's basically about minimizing the risk beforehand just to make sure that you just end up with fisha being like damn I did not take this into account what do we do now which is a good thing right so is just is it just another break in the wall where there was already something out there in the EU so I focus on the European context here doesn't mean that there's nothing in Switzerland but the EU is kind of the interesting jurisdiction lately so we had a cyber security directive the thing is uh I mean it was applicable regardless the sector but only to essential and important entities and specific types of infrastructures as well so most of the providers are like we're not concerned we don't need to take take this into account it's all

fine now with Dora everyone needs to take it into account if you provide something in the financial sector you provide an ICT uh service or like you rely on ICT assets door is something you need to keep at the back of your mind and it's regardless the size I'll dive into this a bit more so it's another break in the wall although there was already something beforehand but it's one that we really need to look at now is it a recipe for Success what do we have in Dora concretely well we have risk management testing information sharing incident reporting both for ICT assets meaning anything internal or the infrastructures that you control and decide to implement that you will be updating maintening and so on but also

for ICT third party service providers so anyone to whom you're outsourc specific activities like any ICT provider there so anything external now web free and Dora what happens there well when you look at the scope of Dora you see clearly crypto asset service providers so all the casps everyone that is currently in the process of obtaining a license in the EU and you see this ICT third party service provider think like what does that mean con concretely and the cyber security directive as I mentioned the one that most people were not really caring about well you had a thresholds but when you think about it those thresholds are often met by any major project that um already had some VC funding and I mean

cloud computing you have increasingly decentralized cloud computing projects uh anything that like trust service providers and so on you have increasingly decentralized projects or like even centralized projects in the web free sector that try to mimic this kind of Serv services that were typically more like Web Two based so actually maybe you need to take this into account by now now Dora what do we target specifically from that list so any centralized web free provider be like a a trefi entity integrating web free or um just CI and exchange integrating web free um aspects well you need to take this into account anyone who falls under the scope of MAA then you also have fake defi because this is the major question what is defi

currently when can I be sure that I don't need to care about Mika well we are still discussing this there like there's some guidance Danish authorities provided some guidance we have a report um that was published by the European banking Authority and Asma recently that clarifies the landscape but it's not supposed to be taken into account as a source of Truth For What means decentralization on MAA it's I can express disclaimer at the beginning of the report so we still have a lot of questions there but a lot of projects even if we take a very broad understanding of decentralization clearly don't fall onto it like guess I label myself as Defi and people are supposed to assume I'm defi but all these projects once we have more clarity will potentially need to care about Dora

as well and then web free infrastructures but then what if these infrastructures are the centralized we will dive into it a bit further like what do we do with Dora if there's no one responsible I just have this decentralized Oracle there's no one I'm talking to there's like an anonymous team what do I do there well on top of that is the idea of a critical third party service provider so you provide a service but on top of that well if I fail nothing works anymore and you may have a systemic risk I mean we had plenty of occasions in the web free system where the failure of one actor triggered the failure of others um and that you can hardly substitute as well so when you have let's imagine a

new type of technology that doesn't have a direct substitute and you integrate that in your systems by saying this is so great I'll be the first one to use it what is your backup plan like what who do you rely on so basically you're integrating a critical third party and on top of that has no substitute and that you need to take into account in your risk assessments as I I'll will mention afterwards so a lot of infrastructures could be critical meaning the obligations on D will be even bigger now what's the fuss all about like why do we care so this is the scope we know why operational resilience matter in general now what happens with Dora well first in terms of risk management they just ask you to think twice before integrating anything be it

an asset or a third party provider and to document everything and then documenting can be a pain plus you need to like audit it internally and potentially externally so what they said is like this proportionality depending on the size the risk exposure uh who is interacting with you we will not force you to provide a 100 page report on everything you need to adjust it to the actual operations but still you need to do something at least you cannot say we'll figure it out over time you're supposed to have documentation for everything and there's a lot of aspects it's we'll see it afterwards then also the management body Bears a responsibility for the management so if ever something happens and people can just say hey you have not planned in

advance while you were supposed to do there is some obvious responsibility there you need to map all the ICT assets and all the third- party service providers nowadays when you check a lot of products you kind of are not aware of all the dependencies you need to figure out what they rely on you often have it listed in the documentation but sometimes it's not complete sometimes it's not updated and then you still need to figure out some additional aspects so here you're supposed to have somewhere a clear map of everything that happen so that you can figure out who failed and who you need to reach out to now a lot of questions it seems easy you just need to manage the risk and foresee things but to evaluate the risk what will be the due diligence standard there if you integrate AI agents if if

you integrate some Innovative zq proofs okay you're supposed to assess the risk but you're discovering new risks as you go as the landscape evolves we've seen this with defi like there was some risks like even economic risk that people were not taking into account at first and realize them afterwards so what is the due deligence standard if I did an assessment at one point in time I need to update it but what if something seems obvious in hindsight but was not back in the time how will the authorities assess that uh methods for incident detection this is a a great thing actually because instead of just relying on some security providers notifying an incident on telegram you're supposed to proactively monitor everything and just realize it yourself not wait for someone to post on

Twitter Hey guys you're hacked today you're supposed to realize it yourself and not wait for someone to tell you that um so this is a good thing but how do you then remedy the issues you like you've point out so imagine you integrate uh decentralized infrastructure you're supposed to react ASAP but you don't control the infrastructure in the first place so what do you do um incident communication this is great because often communication in the web fre sector is quite hectic when an incident occurs you just have some people communicating a lot do I need to like what information is basically the user entitled to like having this in advance also helps internally to avoid that um like the lawyer is just appalled by what you published afterwards because you had a

strategy in advance now also you're supposed to integrate only to that are reliable and adequate for your activity but if you integrate a decentralized infrastructure can it be deemed reliable in the first place can I rely on something that could be modified by a dowo vote can I rely on something that I actually don't control you need to have continuity policies as well but under that posing the whole system is that enough like how do we ensure that if ever uh one aspect of the system fails I still can continue providing the service like in many cases what we see is just that everything is posted is that okay for how long can it be posted so very practical questions

there you're suppos also to um conduct an impact analysis and know in advance if something fails what's the extent of like the potential harm who is affected how far does it go so you canot just leave it aside and say we'll see once this happens it's just a risk you're supposed to figure it out in advance which is great because unfortunately in practice what we see is that because we need to go so in the web free space these things are left aside it's like we're going to figure out the major risks and the rest let's see as we go here it's like a very I would say it's actually part of a recipe for Success so Dora is good in that respect you're supposed to think twice before you do something which is great because we always say um innovate break things and just apologize afterwards maybe not when

it comes to finance and Technical aspects because if you build something and want people to on board buildings with you maybe you want to give them at least small guaranties that the whole infrastructure will not break down um and then backup policies and Recovery procedures I mean it's quite obvious when some systems are starring um like even encrypted copies of private keys and so on well you'll be surprised some of these projects don't figure out backup policies from the beginning it's like oh we have a first implementation then we'll figure out the backup second okay but what if happens something happens in the first weeks what do you do there but also is it relevant in a web context blockchains all decentralized ledgers so if some information is already on blockchain it means that this actually doesn't make

sense in a web free setting so when do you need to back up something when do you need to have recovery procedures and those kind of things and especially like what do you do when there's no possible recovery procedure in the first place now when the risk materializes it's also very interesting because currently you'll have a notification something happens but it's basically it now here breaking news you need to you can voluntarily report threats which is great you can we have like let's say a better understanding of what's happening in a web free space because for now if something happens you maybe don't necessarily want to disclose it to the public but if at least authorities are aware of like all the threats out there

it can enhance like the whole knowledge of the ecosystem and how we prevent them in the long term and then you it's a compulsory to report major incidents to the authorities I mean I'll dive into it on the next slide a bit more you could Outsource this by saying okay I don't handle that part I have a security firm they do all this thing but you're still responsible for the whole notification system and then that's pretty cool you have templates so you know what information to fill in exactly and this also exists on the cyber security directive but the fun part uh Dora kind of goes far in terms of I know that the speed of reaction when something happens is very fast anyways if you get hacked you react in the next hours you create a war room you do something you just

figure out where did the funds go how do we react do we pose everything but still it means that you need to handle all of these aspects from like a traceability technical perspective and on top of that you're supposed to have someone maybe with some legal background to figure it out who is able to um notify this and fill in like the basic information within 24 hours then they'll transfer this information to the Rel like the authorities will transfer it to the relevant other authorities which may even give you some advice which is great but then you're already supposed to have a report within 72 hours clearly the team will not sleep at that point like these deadlines are super short so I'm quite curious how this will be implemented in practice by most

actors because 24 hours just to notify fine but prepare a report while handling all the rest just think about the web free ecosystem major players VC funding teams of like 20 people great you have a five people team they really need a lot of Red Bull and coffee to prepare that and then a final report within one month same it really will you have after one month all the necessary information depending on the type of technology that was involved it may be a bit complicated to figure out as well um then and so what what is the the issue here if you're a centralized actor all of this makes sense it's basically like a good uh let's say a golden standard rule book it should be

more or less easy to implement depending on your size the only thing that will be a blocker here is like what if I want to inter integrate decentralized infrastructures or like defi in the broad sense the first question is like is defi a service or is it an asset is it something I'm integrating under my responsibility with all these mentioned shortcomings I don't control it so how do I react to those kind of things can I actually integrate defi or is it a service but if is it a but if it's a service who am I Contracting with one of the main let's say uh ways of controlling third party ICT service providers is by having like Dora is requiring an adequate agreement in place I mean most of us know how things work

uh in the defi space it's going to be telegram messages and then like yeah guys we're partnering up this is not an adequate agreement and if you need an agreement who do you executed with is a proposal approved by the Dow supposed to be in agreement like how does that work I'm not sure the authorities will accept that so you already have a blocker there is if I am a centralized entity trying to integrate defi either I do it under my responsibility and expose myself to higher risk of maybe the authority is pointing out that this was not a very reasonable approach or I try to on board them as a service but then I have a major blocker does that mean that all this hype of integrating trefi and CI with defi will be kind of put to an end well how can we

circumvent that it will be very interesting to see in practice how the different National authorities in member states react um to this kind of Integrations that in the the US apparently can work out so uh let's see how Europe works with that um so this is a major thing and the other aspect is I'm a defi project so okay maybe I'm somewhere on the edge I'm uh tending towards de centralization but I have some centralization points authorities realize that like it was supposed to be a Casp so first of all you have not don't have a license you should have one okay I'll go for a license then Dora how do I Implement Dora I gave part of the control away to a community how do I work this out and this kind of things um so basically it goes down to this

currently defi I I I reuse this slide quite often this is like how I perceive defi currently you can do whatever you want no one is controlling that it's all on under your own risk is this beautiful beach where you can swim as you want but if a shark comes over no one will save you now with Dora even if you're believe you're not subject to Dora what you could do is take it as guidance have I foreseen in the codes something that will allow people to feel a bit more secure do I know exactly the risk of what I'm launching as a product it's great it's um it's a public good but you don't want to create public goods that can backfire meaning even D5 projects

should have a look at Dora and just consider if I was centralized would I be able to meet this requirements because I'm decentralized how can I meet them in a decentralized fashion just to reassure people and this is basically the end but I hope this inspired you to think about what you're building if you're a builder and if you have a project just to think yeah maybe I'm offering something that has something at stake and I don't want users to complain afterwards just because I wanted to innovate at all cost without thinking about the consequences thank you very much yeah now my question is of course the

mitigation action as you mentioned they totally different totally different challenges compared to compared to an ICT classical approach my my question from framework perspective all those topic that you mentioned they are part the the challenge or the topic management documentation proper uh SLA agreements they're already part of iso 27001 so from a regulation standpoint what's the difference or what where is the different Focus from Dora compared to the iso 27001 it's just to make people aware that you need to follow this kind of Standards because it's industry practice like when you say something is industry practice and it's a good standard it's just business partners where expect this

from you but there are like no actual sanctions other than you will not be able to interact with specific Partners here you have a regulation with some consequences and if you don't comply you know that there will be sanctions scare people it's exactly to scare people it's the same um I would compare it to anything that's related to CSR like Corporate social responsibility it was always in the landscape of saying like oh you're supposed to do good and take things into account but once you integrate it into a regulation like damn now I really need to do that so it's exactly the same thank you [Music]