Article 9 of the Digital Operational Resilience Act now requires EU financial institutions to implement mandatory authentication and access controls. Non-compliance creates direct regulatory and security exposure.
DORA Article 9 establishes legal obligations for authentication mechanisms and access control across EU financial entities. The regulation mandates robust credential management as a core operational resilience requirement.
Financial firms must enforce multi-factor authentication, enforce least-privilege access principles, and maintain strict credential lifecycle management. The rules apply to banks, investment firms, payment processors, and other regulated financial service providers.
Breach scenarios under DORA include inadequate password policies, unmonitored privileged account access, and systems without revocation controls. These gaps create direct pathways for unauthorized access to critical financial infrastructure.
Compliance requires documented authentication frameworks, regular access reviews, and audit trails for all credential usage. Institutions face enforcement action and penalties for gaps in these controls.
The regulation reflects rising operational risks tied to credential compromise. DORA treats credential management not as a technical best practice, but as a mandatory financial control mechanism.
Tailscale disclosed a critical vulnerability in its SSH implementation that allowed attackers to gain root access through insecure argument handling. The flaw has been patched in recent versions.
A new study found that social media platforms referred over 5.7 million visits to nonconsensual deepfake pornography sites between December 2025 and March 2026, with YouTube and X accounting for the majority of traffic.
Vancouver Police Department has implemented a discreet button on its website that instantly closes the page and clears browser history when clicked. The feature is designed to help domestic violence survivors quickly hide their browsing activity.
Europe's digital identity wallet age verification system will only work on iOS and Android devices, excluding alternative mobile platforms. The technical specification has drawn criticism from privacy advocates and open-source developers.