How to encrypt data in use for DORA compliance

EU Regulation 2022/2254, also known as the "Digital Operational Resilience Act" or DORA, serves as a binding directive for risk management in the financial sector. It aims to enhance digital operational resilience, extending its coverage to third-party Information and Communication Technology (ICT) service providers. DORA's main objective is to mitigate vulnerability to ICT disruptions and cyber threats across the entire financial ecosystem. In fact, DORA applies to all financial industry players, including banks, insurers, ICTs, and even cryptocurrency service providers. Dora will be enforced from January 17, 2025. Non-compliance will be fined by the corresponding authorities.

Grasping DORA and its intricacies can be challenging. Specifically, Article 9, paragraph 2, in the first cornerstone of DORA, mandates financial institutions to monitor and control all ICT systems for resilience, continuity, integrity, and confidentiality during the processing chain. To this end, the article specifically mandates data encryption at rest, in transit, and in use. Encryption of data in use isn't typically done today and can be difficult to achieve in practice. How to address this?

Mainly, two technologies allow for data encryption in use. These are homomorphic encryption and confidential computing. Generally, homomorphic encryption is unpractically compute intensive and doesn't scale to real-world workloads. In contrast, confidential computing is highly practical and only incurs low overheads. It can be used to protect virtually any type of workload and scales just like normal IT. Confidential computing features are already available in most server CPUs from Intel and AMD—all that is required, is the right software underpinning to leverage these. For more on confidential computing, read our whitepaper.

Delving deeper into this technology, we must distinguish that not all confidential computing solutions are created equal. The data protection levels can vary vastly between solutions. Some solutions only shield parts of your applications, while others make all of your data completely invisible to the infrastructure underneath. 

Constellation, the world's first always-encrypted Kubernetes, works by encrypting the entire Kubernetes cluster, ensuring that no one, not even your cloud admin, can access the sensitive data of your customers.

Contrast, instead, allows for a higher level of granularity. It integrates seamlessly with managed Kubernetes engines like AKS and enables you to encrypt data at the container level.