Prioritizing DORA Compliance and Resilience with HYCU’s Andy Fernandez

This is Textron tv. Hey everyone. Welcome back here to Techstrong tv.

My next guest, he actually, he's been on here before, he is Andy Fernandez. Andy is Senior director product marketing at Haiku Kui, not the poem people. Um, if you remember those from school.

Um, let's welcome him. Andy, welcome to Text Trunk tv. How are you, man?

Thank you so much, Alan. Happy to be here. Um, and happy to hear any haikus.

People would like to volunteer our way. I'm sure they must throw a lot at you, right? Oh, yeah.

Um, Andy, before we go down a, a path that I wasn't contemplating here and trying to think of some good haikus, let's talk a little bit about you. Um, as I mentioned, you've been on here before, but give people a sense of your journey to becoming senior director product marketing here. Yeah, absolutely, Alan.

I'm, I'd like to say, but I'm probably not one of the few people who's been born and raised in the world of data protection. So, you know, over the last decade, uh, my entire career, both in product marketing and product management, has been focused exclusively on data protection, disaster recovery, business continuity, and helping organizations protect and recover their data in very different ways. I've come from the traditional data center to virtual to SaaS and cloud, and it's been, it's been quite a, quite a run just focused on helping people recover their data.

Absolutely. Um, you know, and 10 years ago we weren't talking about ransomware. Now we are obviously, but, uh, um, you know, there, there's been a, a renewed, uh, emphasis on data and data security, I think over, since Covid, let's say, right?

So over, let's say the last four years, five years. Um, but you know, it's a new year. It's a new year and new new happenings.

One of the big things this year is the Dora regulations. That's GORA. Not to be confused with Dora research from, well, now it's Google it.

Originally it was, uh, uh, Jean Kim and Jez Humble, and Dr. Nicole Forsgren, but that's a different Dora, right? For high performing IT teams.

Dora is the, uh, uh, compliance statutes, statutes and, uh, kind of framework put in place by eu. But you know what, it applies to US financial institutions. If they're doing any business over in the eu, and that probably includes 99% of US financial institutions, right, have some interaction with EU business and therefore are, are, uh, responsible for Dora.

But before we get into Dora, Andy, let's talk Haiku. What's Haiku about? Yeah, absolutely.

Uh, Alan Haiku is the fastest growing data protection company in the world. Our focus and where we come from is protecting critical infrastructure. But as we talked about at the beginning, Alan, just 10 years ago, you know, let's say even before that, when I started my career, it was all about just the data center.

Ransomware wasn't a conversation. Cloud wasn't a conversation. SaaS wasn't a conversation.

The world has changed so drastically, uh, and so much faster than the traditional industry that we needed a data protection vendor that could evolve and adapt to what we actually have to, which is a bit of a mess when you actually think about it from a technology stack perspective. And that's what Haiku is able to do, is protect data. No matter where it is, cloud SaaS on-prem, it's making sure that you have full control.

com, you can read through our story, our vision, and our, our approach to, to data protection. com, HYCU. Absolutely.

At h ha, right? Not H-A-I-K-U, like the boom, or did they get that out there? So Andy, we called them how, who Haiku is how they get there.

There might be some folks out here who are unfamiliar with Dora, right? Yeah. Or at least this Dora, right?

As it relates, how, what, what, how would you describe that to them? Yeah, absolutely. So I would say Dora is probably some of the best legislation and directive that is actually applicable to the times that we exist in.

And just for those, as you mentioned, Dora is not the research, it is not Dora the Explorer as the kids watch. It is the Digital Operational Resilience Act. And all it means is we take a look at where we are today.

And the reason I'm focusing so much on change is because Dora is trying to tackle that change. 10 years ago, every organization was running their digital estate, let's call it all of their applications, uh, everything that they're leveraging for communication, for file storage, for ip in a data center. All of a sudden, people not only are still using data centers, but they lift and shift to the cloud.

Maybe they modernize a bunch of applications, especially during covid. We're also seeing it today in, in how fluctuating the on-prem world is. But most importantly, the use of SaaS applications completely exploded.

Anyone with a credit card in an organization can start using a critical SaaS application that all of a sudden is logging critical customer data. So the compliance directives, the cybersecurity regulation, posture management, has always been years and years behind where companies actually are today. And this is so important from a cybersecurity perspective.

Why think about the eu? Think about the political implications of disrupting the financial supply chain of organizations and customers in the eu. Just a few SaaS applications, of course, there are thousands of SaaS applications.

If any one of those gets disrupted, if there's a supply chain attack, if somebody makes a mistake, we've seen this with CrowdStrike, we've seen this with public cloud vendors, even in the eu, accidentally configuring something and taking entire regions down. This is always going to happen. People are going to exploit these applications.

People are going to make mistakes, and customers themselves are going to make mistakes. In the past, everything was in a data center, so I could just protect that and I'd be okay. I had my backups.

But in the world of SAS and the world of cloud, all of a sudden my data is everywhere, all at once. And regulation hasn't really evolved to catch up to that. And that's what Dora is.

Dora is saying, we understand what your supply chain looks like today. We have to make sure that we protect not only you and your customers, but make sure that the vendors that you trust are following these requirements. So when something bad happens, people are resilient, people can recover.

Customers are not effective. So when we look at Dora, all it is is saying, look, you're no longer just requiring on physical and virtual apps. You're using a flurry of applications in cloud, cloud hosted, or SaaS.

You might not even know what they are, but you have to start protecting them. You have to understand what they are. You have to discover those assets.

You have to make sure that you're protecting it, and you have to make sure that you are recovering it as well. So, Alan, when I say Dora is probably the best of all regulation, it's one of the few out there that are actually cutting edge and saying, this is the modern problem. This is how we're going to tackle it.

But at the same time, it creates a massive challenge for organizations to actually become compliant. Absolutely. Absolutely.

I, I mentioned in the beginning, Andy, just because you're a US based institution doesn't exempt you or insulate you from having to comply with Dora the same way. It doesn't help you with GD uh, GDPR. Right, Exactly.

Um, You know, I, I think the, the nexus is relatively a low bar for whether or not you come in contact with EU regulation. So I, I'm wondering, do you ever run into any US based financials who say, oh, oh, no, that doesn't apply to us. Yeah, absolutely.

It's a, uh, it's a distribution. It's a bell curve when you think about it at the beginning. No one thinks it applies to them, then all of a sudden everyone figures out it applies to them.

And then you have a couple of stragglers. Um, but the reality is there's two ways in which everyone is going to be affected by this. The first one is, if you have European entities, if you have European customers, even if you're a technology company, Ava, not just a financial institution, but a technology company with financial customers in the eu, that is an important thing for you to be Dora compliant.

The other piece that it impacts all of us is, this is probably one of the best, most accurate evolved pieces of legislations. There are going to be copycat legislations, not only within other industries in the eu, you're already seeing it with infrastructure, with what's called NIST two or NIS two regulation. You're gonna see it in Australia.

You're going to see it in the us. So short term, if you have European entities or lots of European customers, even if you have 50 employees, even if you have a hundred employees, that is going to apply to you as well. And for everybody else, that same approach is coming, whether it's healthcare, whether it's retail, whether it's legal, that same approach is also coming.

Absolutely. So Andy, when, when it comes to, to this though, you know what to do about it, right? How, how so much I've been in security 25 plus years, and my philosophy when it comes to compliance is if I do good security, I get compliance as a byproduct, right?

If I do compliance for compliance alone, I get what I call least common denominator security, right? Relative. That's the low bar true with Dora, or is Dora a different animal?

I, I'd say Dora is a different animal. I I know exactly what you mean. We call it, uh, um, checklist security, which is, Hey, did you do this?

Yeah. Did you do this? Cool, cool.

Did you actually test it? Not really. Where, where Dora really evolves is think about where we are today.

You know, we, no one knew what ransomware was 15 years ago. Now it's all we can talk about. This is where we see organizations in the industry spending over, what, $200 billion a year in US American, uh, cybersecurity budgets.

Yet every day you continue to see organizations fall, you see real disruption. You see very, very negative impacts on business, on people's lives. So we're spending more than ever on security, yet things are still happening.

Where we see Dora really evolve if saying, look, we understand you have a security posture. You have your incident response. You have your, your seam, you have everything on the firewall side.

You've always had that, and you're always refreshing that. What you don't have is the plan for when that fails, and that is backup and recovery. So Alan, not only is it now making sure that organizations have actual backups when something happens in breaches, but they're actually making people test too, right?

So an entire pillar and association, Dora, is resilience testing where you have to buy. And it's a mandatory approach, depending on how critical this apps is. You have to test your response.

You have to test your recovery. So what I would say here is, of course, there are going to be things that are not covered in Dora that are best practices from a security perspective. But just by asking for backups, asking for resilience testing, and a continuous framework, I'd say that's a pretty good approach for most organizations.

And Alan, from what we're noticing in conversations in the field, most people are not even close to meeting that type of compliance. Interesting. Very cool.

Andy, people wanna maybe get more information from Haiku on this. com. Absolutely.

com, if you go and you click on solutions, you're gonna find an entire Dora page. We've built a checklist. It has nothing to do with haiku.

It's simply, I am a financial institution. I've got a mix of all types of applications, and I need to know how do I meet these very stringent backup and recovery requirements. You'll find a full checklist there available for you, um, where you can go through.

And it is very extensive. Uh, it's something that I recommend everyone does, uh, even outside of financial institutions. Cool.

Just wanna check my notes real quick here. Um, I, I know you got your checklist is that, is there a name to the solution for Dora that you guys are pushing Yes. Or Offering?

Yes, absolutely. So after finding out what Dora it was and how in depth it was around requirements, um, we started to look in the market and started having conversations with our customers. And one of our partners, uh, in the world of Atlassian, uh, tis, they're a global IT services partner, largest in the world of Atlassian.

They saw the requirements that Dora had, they saw the massive gap in backup and recovery. They saw what Haiku is able to do in protecting that with over 80 integrations. And what they realized was, a, for an organization to get started today and actually start becoming Dora compliant, first they need to actually build a framework, and then they need to identify and map out all of their assets.

This actually, uh, means that if I'm a regular organization, I'm hiring people, if not entire department, to actually start this process. It's expensive, it's cumbersome, and it's super difficult. So what we've done with this partner and with other solution partners, like, uh, land Sweeper, net fire is we built an entire GRC solution, a full GRC solution that says from the beginning, we'll help you actually automatically discover everything that falls under door requirements for compliance.

And we will make sure that every single pillar from asset discovery to response and recovery are all included in that as well. And what this does, Alan, is not only saying, look, we're a great technology for backup. They're a great technology for asset discovery.

Those folks do this. It's a single solution that automates it. Um, so it starts with the checklist, but then it starts with, well, I actually have to do this, and you need a real GRC solution to be able to do so.

And that's where we've partnered with Dali Anis, lamp sweeper, and organizations like App Fire. Fantastic. Andy, thanks for coming on Tech Shark tv.

Happy New Year to you and all our friends at Haiku. We'll hope to have you back on soon, especially as we get, get maybe closer to the RSA season. Um, but for now, that's it.

We're gonna take a break on Textron tv. We'll be right back.