A businessman using his laptop with a padlock icon and internet networking icons as HUD in the foreground

NIS2, DORA and the Significant Role of Encrypted Storage—Expert Insights

Watch Video
Oct 2024
Blog Home

As organizations come to grips with increasing numbers of cybersecurity attacks, it is important for them to understand and comply with the latest regulations.

Previously, we interviewed David Clarke, a seasoned cybersecurity expert, to discuss the changing behaviors toward encrypted storage. This time, we asked David to offer his thoughts on the NIS2 Directive and the Digital Operational Resilience Act (DORA) and their implications.

Clarke’s extensive experience includes managing security for the world’s largest private trading networks and running one of Europe’s biggest security operation centers. Here are the key insights—along with the full video from this interview.

Overview of the NIS2 Directive

The NIS2 Directive aims to enhance the cybersecurity resilience of critical infrastructure across the EU. As Clarke explains, this directive targets sectors that, if compromised, could significantly impact a large portion of the population. This includes industries such as aviation, shipping, farming, major retail chains, and many others. Additionally, NIS2 now includes managed IT service providers, given their potential to affect numerous clients if compromised.

The directive emphasizes the importance of cyber resilience and third-party management. Companies must also demonstrate that they are managing their IT suppliers effectively to meet the required cybersecurity standards. Failure to comply can result in fines of up to 2% of global revenue (or €10 million, whichever is higher). Even in the absence of a breach, companies can still be fined for not providing adequate evidence of compliance.

Understanding the DORA Regulation

DORA (Digital Operational Resilience Act), on the other hand, focuses exclusively on the financial sector. Coming into force in January 2025, it mandates stringent cybersecurity measures to ensure the operational resilience of financial institutions.

Clarke highlights that DORA’s fines can reach 1% of global revenue, with the possibility of daily fines if issues are not rectified promptly. DORA requires financial institutions to conduct threat-led penetration testing and ensure there are no single points of failure in their systems.

Incident Reporting and International Data Transfer

Both NIS2 and DORA require detailed incident reporting to the relevant regulatory bodies. Clarke notes that DORA specifies a 72-hour reporting window, with clear guidelines on what information must be included, like the number of customers affected and the nature of the risks.

Regarding international data transfers, Clarke emphasizes the need for secure practices. DORA, for instance, requires businesses to test their business continuity plans and provide evidence of their effectiveness. This ensures that companies can handle incidents and demonstrate their preparedness.

Turning Compliance into a Business Opportunity

Clarke believes that regulatory compliance can be a significant business opportunity. Demonstrating alignment with cybersecurity and data protection standards can open doors to government contracts and partnerships with larger companies. These entities often require smaller companies to provide evidence of their cybersecurity measures to mitigate liability risks.

The Advantages of Hardware-Based Encryption

To comply with NIS2 and DORA, USB drives must have robust security features. Clarke points out the importance of hardware-based encryption, which offers several advantages over software-based solutions. Hardware-based encryption is a closed ecosystem that provides strong security and protections against attackers.

Software encryption on mobile storage—on the other hand—can be easily removed through reformatting, compromising compliance and increasing the risk of data breaches. Additionally, password-protected and software-encrypted files can be hacked using easily accessible password-guessing tools available online.

When asked if organizations should look toward NIST’s FIPS certification as the gold standard: “Absolutely.” Clarke asserts, “There's been quite a few cases where people have claimed they've got better security and encryption and it hasn't fulfilled, it's been broken.”

Kingston IronKey D500S and Keypad 200 drives offer FIPS 140-3 Level 3 (pending) certification, so that organizations can be confident that sensitive data is protected, with one of the strongest military-grade encryption protections on the market today. For high-capacity storage, the FIPS 197-certified IronKey Vault Privacy 80 external SSD drives scale up to 8TB, allowing air-gapped backups of critical data.

Conclusion

Cybersecurity threats continue to intensify and spread, which is why directives and regulations like NIS2 and DORA play a key role in ensuring the resilience of critical infrastructure and financial institutions. Clarke’s insights underscore the importance of compliance, effective incident reporting, robust security measures and utilizing hardware-encrypted storage. By embracing these regulations, organizations can not only enhance their security posture but also gain an edge by leveraging compliance as a competitive advantage.

Watch the full video

#KingstonIronKey

Kingston’s Ask an Expert icon on a circuit board chipset

Ask an Expert

Planning the right solution requires an understanding of your project's security goals. Let Kingston's experts guide you.

Ask an Expert

Related Videos

Trisha holding a Kingston IKLP50 USB flash drive 4:19

Simple PC Backup Tips

Remembering to back up frequently can evade even the most experienced tech enthusiast. We’ll cover some simple tricks to ensure you can easily back up regularly.

Trisha holding a IKVP80ES next to some graphics of a shield, a screen with code, and a padlock 5:38

The right way to securely store and access your files

For creatives producing content for high-profile clients, encrypted storage can secure your important files and help you fulfil your security responsibilities.

Trisha holding a giant 2.5” SSD next to a M.2 SSDs with a lock and Windows icon 5:02

Software vs Hardware Based Encryption

There are two main types of encryption - software encryption and hardware encryption.

Trisha looks at her screen in shock and consternation, a skull and crossbones and hazard triangle on the screen. 3:59

How to Secure Your Online Accounts

How to maximize your online security by taking steps to protect your presence.

Kingston IronKey Articles

Related Articles

Blog Home