Red Team Ya Zama Sarkar Samarwa Mai Kulawa: Abin da Tsarin TLPT na DORA ke Buƙata da Gaske

Threat-led penetration testing ba gwajin shiga ba ne da aka ƙara wa takardu. Tun da ka'idojin fasaha na tsari a ƙarƙashin Article 26 na DORA suka fara aiki ta Commission Delegated Regulation (EU) 2025/1190, kwaikwayon harin maƙiyi a fannin kuɗi na Turai ya koma aiki mai ƙarƙashin kulawa: yana da scope da aka ambata, yawan gwaji da doka ta ɗora, kasuwar masu samarwa da ke ɗauke da accreditation, da kuma ƙa'ida guda da ta sauya fasalin dukan aikin a hankali — dole ne mai ba da threat intelligence ya kasance daga wajen cibiyar da ake gwadawa. Yawancin bankuna sun ƙididdige kuɗin gwajin. Kaɗan ne suka ƙididdige kuɗin sarkar samarwa da gwajin ya dogara a kanta yanzu.

Taƙaitawa ga Shugabanni

Yanzu an fayyace tsarin, ba zane-zane ba. Commission Delegated Regulation (EU) 2025/1190, wanda aka wallafa a Jaridar Hukuma a 18 ga Yuni 2025, ya cika Article 26 na DORA da ka'idojin fasaha na tsari waɗanda suka shafi scope, hanyar aiki, sakamako, amfani da testers na ciki, da haɗin gwiwar hukumomin kulawa har da amincewa da juna tsakanin Ƙasashe Mambobi.

TIBER-EU ce harsashin. An gina tsarin a kan tsarin Turai na ethical red-teaming da threat intelligence ke jagoranta, don haka cibiyoyin da suka taɓa TIBER ba sa farawa daga sifili — sai dai shiga TIBER na son rai ne, wannan kuwa ba haka ba ne.

Shekara uku ita ce mafi ƙanƙanta, ba ita ce shirin ba. Cibiyoyin da aka naɗa suna gwadawa aƙalla kowace shekara uku a kan muhimman ayyuka, kuma hukuma mai iko na iya ƙara ko rage wannan yawan bisa bayanin haɗarin cibiyar.

Gwaji rabin abin da ake bayarwa ne kawai. TLPT na samar da shaida ga hukumar kulawa. Kayan aikin — dalilin zaɓen scope, threat intelligence, labarin harin, remediation da sake gwaji — su ne sakamakon da ke da muhimmanci, kuma ya kamata a gina su yayin aikin maimakon a haɗa su bayan an gama.

Abin da Ke Sauyawa da Gaske Sa'ad da Gwaji Ya Zama TLPT

Yawancin bankuna suna gudanar da tsaro na hari tuni. Saboda haka hankali kan ce a ɗauki TLPT a matsayin iyawar da ake da ita tuni sanye da murfin bin ka'ida. Wannan tunanin kuskure ne a wurare huɗu takamaimai, kuma kowanne yana da tasiri a kan kasafin kuɗi.

Tebur 1: Gwajin hari na yau da kullum idan aka kwatanta da TLPT a ƙarƙashin DORA

Fanni	Gwajin shiga na yau da kullum	TLPT a ƙarƙashin DORA
Wa ke yanke shawarar a gudanar da shi	Cibiyar, bisa yadda take son ɗaukar haɗari	Hukuma mai iko ce ke naɗa cibiyar; yawan gwaji aƙalla kowace shekara uku
Abin da ake kai wa hari	Tsarin da sashen tsaro ya zaɓa	Muhimman ayyuka ko ayyuka masu mahimmanci, har da waɗanda ke gudana a production da waɗanda aka fitar zuwa waje
Daga ina samfurin barazana ke fitowa	Hukuncin cikin gida ko ɗakin karatun tester kansa	Threat intelligence da aka ba da oda, daga mai samarwa da ke wajen cibiyar
Wa zai iya aiwatarwa	Duk mai samarwa mai iyawa, ko ƙungiyar cikin gida	Testers da suka cika sharuɗɗan Article 27; ƙungiyoyin ciki har zuwa gwaji biyu cikin kowane uku
Manufar sakamakon	Rahoton ciki da jerin ayyukan remediation	Shaida ga hukumar kulawa, inda sakamako da remediation ke ƙarƙashin bincikar hukuma da amincewa tsakanin ƙasashe

Layi na ƙarshe shi ne inda shirye-shirye kan raina yawan aikin. Ana rubuta rahoton gwajin shiga ne domin mutanen da za su gyara abin da aka gano. Ana rubuta fakitin TLPT ne domin hukumar kulawa da ba ta kasance a ɗakin ba, kuma dole ya sake gina dalilin da ya sa aka zana scope inda aka zana shi, abin da threat intelligence ta faɗa, abin da red team ta yi da gaske, da abin da ya sauya sakamakon haka.

Wa Ke Cikin Scope, da Dalilin da Ya Sa Ba Kai Ke Yanke Shawara Ba

DORA ba ta ɗora wajibin TLPT a kan kowace cibiya cikin iyakarta ba. Hukumomi masu iko ne ke gano cibiyoyin kuɗi da dole su gudanar da shi, suna la'akari da mahimmanci ga tsarin gaba ɗaya, girma, da bayanin haɗarin ICT; an cire ƙananan kamfanoni.

Sakamako biyu na biyo baya waɗanda ke da sauƙin ɓacewa.

Naɗi ba lambar yabo ba ce ta balaga. Idan aka ambaci sunanka, ma'ana hukumar kulawa ta ɗauki faɗuwarka a matsayin abin da ke da sakamako mai nauyi, kuma yana zuwa da wajibin yawan gwaji a ɗaure. Karatun da ya dace shi ne alƙawari na shekara uku mai ɗorewa tare da sayen sabis da ke tafiya da shi, ba aikin sau ɗaya ba.

Rashin naɗi ba keɓewa daga hujjar ba ce. Cibiyar da ba a naɗa ba tana da hakkin nuna gwaji na ci gaba mai daidaito a ƙarƙashin ka'idojin gwaji na gama-gari na DORA. Bambanci yana cikin tsarin hukumance ne, ba a gaban tsammanin ba.

Kasuwar Testers Ita Ce Matsalar da Ke Ɗaure

Wannan ɓangaren ya dace ya kasance a kan takardar hukumar gudanarwa, kuma ba safai yake bayyana a can ba.

Article 27 bai kawai buƙaci testers masu iyawa ba. Yana buƙatar testers waɗanda ke nuna iyawar fasaha da ta tsari tare da ƙwarewa ta musamman a threat intelligence, penetration testing da red teaming; waɗanda hukumar accreditation a wata Ƙasa Mamba ta ba da takardar shaida, ko kuma suke bin ƙa'idojin ɗabi'a ko tsarin ɗabi'a a hukumance; waɗanda za su iya bayar da tabbaci mai zaman kansa ko rahoton bincike da ya shafi kyakkyawan sarrafa haɗarin da gwajin kansa ke haifarwa; kuma waɗanda ke ɗauke da professional indemnity insurance har da kariya daga mugun hali da sakaci.

Tebur 2: Abin da Article 27 ke buƙata daga tester, da wanda yake fitarwa

Sharaɗi	Abin da yake gwadawa da gaske	Wanda yake cirewa daga kasuwa
Ƙwarewar da aka tabbatar a threat intelligence, penetration testing da red teaming	Cewa mai samarwa na iya gudanar da dukan sarkar, ba zoben guda ɗaya ba	Ƙananan kamfanoni masu ƙarfi a fannin cin gajiyar rauni amma ba su da sashen intelligence
Accreditation a wata Ƙasa Mamba, ko ƙa'idar ɗabi'a a hukumance	Matsayi da za a iya tabbatarwa maimakon suna kawai	Ɗaiɗaikun 'yan kwangila da ƙungiyoyin da ba a yi musu rajista ba
Tabbaci mai zaman kansa ko rahoton bincike a kan sarrafa haɗari	Cewa gwada bankin da ke gudana ba zai lalata shi ba	Masu samarwa da ba su da balagar shugabanci ta kansu
Professional indemnity insurance, har da mugun hali da sakaci	Cewa akwai kuɗi a bayan haɗarin	Kamfanonin da jarinsu ke da ƙanƙanta

Karanta waɗannan layuka huɗu tare sai fasalin kasuwar ya bayyana: adadi kaɗan na kamfanoni, mafi yawansu manya, kuma dukansu suna sayarwa ga kowace cibiyar da aka naɗa a faɗin Tarayyar Turai a kan agogon shekara uku ɗaya.

Cibiyoyin da suke ɗaukar sayen tester a matsayin aikin sayan sabis na yau da kullum da aka tsara kwata ɗaya gaba za su gano matsalar a mafi munin lokaci. Abin da ke da ƙaranci ba red team ba ne; red team ce mai cancanta, mai lokacin da ya dace kuma ba ta da cin karo da muradu a kan kadarorinka.

Ƙungiyoyin Ciki Suna Taimakawa, Amma Ba Za Su Iya Ɗaukar Nauyin Ba

Bankuna masu balagagen iyawar hari suna tambaya cikin hikima ko ƙungiyar cikin gida za ta iya ɗaukar wannan. Wani ɓangare, e.

An yarda da testers na ciki, bisa amincewar hukumar kulawa, isassun kayan aiki, da sarrafa cin karo da muradu — amma da iyaka biyu masu tsauri. Dole a yi kwangila da testers na waje duk gwaji uku, don haka ƙungiyar cikin gida za ta iya rufe gwaji biyu cikin uku a mafi yawa. Kuma dole mai ba da threat intelligence ya kasance daga wajen cibiyar a kowane gwaji, har da waɗanda ƙungiyar cikin gida ke aiwatarwa.

Ƙa'ida ta biyu ita ce mafi ban sha'awa, domin ba game da iyawa ba ce da gaske. Sashen intelligence na cikin gida ya san waɗanne matsaya ne za su zama masu ban haushi. Buƙatar intelligence ta fito daga waje kariya ce ta tsari daga red team da take gwada abin da cibiyar ta riga ta gamsu a gwada ta a kai a hankali — wannan shi ne irin faɗuwar da ke sa aikin ya zama mai kwantar da hankali maimakon mai koyarwa.

Sakamakon a shirye-shiryen aiki: gina iyawar cikin gida don zagayen da za ta iya rufewa, amma ɗauki intelligence na waje a matsayin abin kashe kuɗi na dindindin maimakon na lokaci-lokaci.

Masu Samarwa na Waje Suna Cikin Gwajin

Idan muhimmin aiki ko aiki mai mahimmanci ya dogara ga mai ba da sabis na ICT na waje, tsarin wannan mai samarwa na iya shiga cikin scope na TLPT, kuma ana iya buƙatar mai samarwar ya shiga.

Ga bankin jumla, wannan ba ƙaramin abu ba ne. Muhimman ayyuka a fannin biyan kuɗi, riƙe kadarori da sasantawa suna gudana da yawa a kan dandalin masu sayarwa, sabis da ake sarrafawa, da cloud. Gwajin da aka zana scope ɗinsa cikin gaskiya a kan muhimman ayyuka zai kai ga masu samarwa, kuma nan da nan tambayoyi uku suka iso waɗanda na kwangila ne ba na fasaha ba:

Kwangilar ta ba da izini? Sashe-sashen haƙƙin gwaji da aka rubuta don kimantawa ta yau da kullum sau da yawa ba sa tunanin red team da threat intelligence ke jagoranta tana aiki a kan production ba tare da an sanar da ma'aikatan aikin mai samarwa ba.
Wa zai ɗauki haɗarin idan gwajin ya haifar da matsala? Tsakanin bankin, tester da mai samarwa, dole a sasanta wannan a rubuce kafin zana scope, ba a yi ciniki a kai ƙarƙashin matsin lokaci ba bayan an yi ajiyar lokacin gwaji.
Mai samarwa zai iya hidimar kowa a lokaci ɗaya? Mai samarwa da aka mai da hankali a kansa yana hidimar cibiyoyi da yawa da aka naɗa, don haka yana fuskantar buƙatar lokaci ɗaya kamar yadda kasuwar testers take fuskanta — kuma ba shi da wani hakki ya ba ka fifiko.

Aikin sashe-sashen kwangila yana da lokacin shiri fiye da na gwajin kansa. Ya dace a saka shi cikin samfurin sabunta kwangila yanzu, bisa dalili guda kuma bisa hujja guda kamar kowane haƙƙin shiga na hukumar kulawa.

Abin da Masu Kariya Suka Bin Aikin

Red team da ta yi nasara shiru ba ta koya wa cibiya kome sosai ba. Darajar tana cikin sake gina abin da ya faru: abin da aka fitar, abin da aka gano, abin da aka ɗaga, da tsawon lokacin da kowane mataki ya ɗauka.

Alƙawari uku ne ke bambance aikin da ke haifar da shaida da wanda ke haifar da labari.

Sanya kayan aunawa domin sake ginawa kafin gwajin, ba yayinsa ba. Idan ba a riga ana adana detection telemetry a matakin da ya dace ba, binciken bayan aikin ya koma abin tunawa kawai. Wannan ita ce hanya mafi yawaita da aikin da ya yi nasara a fasaha ke haifar da rauni a fakitin shaida ga hukumar kulawa.

Auna lokaci, ba sakamako kaɗai ba. Ko red team ta cimma manufarta ita ce mafi ƙarancin ban sha'awa cikin abin da aka gano. Lokaci har zuwa gano farko, lokaci har zuwa daidaita alaƙa da maƙiyi, da lokaci har zuwa killacewa su ne lambobin da ke bayyana iyawar kariya, kuma su ne lambobin da ke inganta tsakanin zagaye.

Rufe da'irar zuwa blue team da gangan. An gina haɗin gwiwa da ƙungiyar kariya cikin tsarin maimakon a haɗe ta daga waje, kuma ita ce ke juyar da aiki guda zuwa iyawa mai ɗorewa. Cibiyar da ta gudanar da gwajin, ta ƙaddamar da rahoton, kuma ba ta sauya kome da za a iya gani ba, ta cika yawan gwaji ne kawai kuma ba ta koyi kome ba.

Littafin Aiki

Tabbatar ko kana sa ran naɗi, kuma ka shirya kamar an naɗa ka. Lokacin shirin sayen sabis ya yi tsawo har jiran sanarwa a hukumance ya zama zaɓin mai tsada.
Sanya sayen tester a shirin shekara uku na gaba, ba jadawalin aiki guda ba. Tantance ƙungiyar masu samarwa bisa sharuɗɗan Article 27 — accreditation ko bin ƙa'idar ɗabi'a, rahoton tabbaci, professional indemnity insurance — tun kafin a buƙaci lokacin gwaji.
Yi kwangilar threat intelligence na waje a matsayin tsari mai ɗorewa. Ana buƙatarsa a kowane zagaye ba tare da la'akari da wanda ke aiwatar da gwajin ba, don haka ba kuɗin da ke canjawa ba ne.
Gyara sashe-sashen kwangilar masu samarwa a wannan kwata. Haƙƙin gwaji, wajibin shiga, rabon haɗarin matsala. Wannan yana da mafi tsawon lokacin shiri cikin kome a nan kuma ba aikin injiniya ba ne.
Ɗaga matakin detection telemetry kafin aikin farko. Fakitin shaida yana da inganci gwargwadon abin da aka rubuta yayin da red team ke aiki.
Ba da rahoton lokutan, ba hukuncin ba. Lokaci har zuwa ganowa, daidaita alaƙa da killacewa, wanda ake bibiya cikin zagaye da zagaye, shi ne ma'aunin da ke nuna wa hukumar kulawa iyawa maimakon abin da aka yi don bin ka'ida.

Cibiyoyin da za su tafiyar da wannan cikin kwanciyar hankali ba su ne masu red team na ciki mafi ban sha'awa ba. Su ne waɗanda suka ɗauki wajibin gwaji mai kulawa a matsayin matsalar sarkar samarwa da ta shaida da wuri har suka warware ta cikin nutsuwa.

Tambayoyin da Ake Yawan Yi

Kowace cibiyar da DORA ke sarrafawa dole ta gudanar da TLPT?
A'a. Hukumomi masu iko ne ke gano cibiyoyin da dole su aiwatar da shi, bisa mahimmanci ga tsarin gaba ɗaya, girma da bayanin haɗarin ICT, kuma an cire ƙananan kamfanoni. Cibiyoyin da ba a naɗa ba suna ci gaba da kasancewa ƙarƙashin buƙatun gwajin juriyar aiki na dijital na gama-gari na DORA — tsammanin bai ɓace ba, tsarin hukumance ne kawai ya ɓace.

Sau nawa cibiyar da aka naɗa dole ta gwada?
Aƙalla kowace shekara uku, tana rufe muhimman ayyuka ko ayyuka masu mahimmanci. Hukuma mai iko na iya buƙatar yawa mafi girma ko mafi ƙanƙanta bisa bayanin haɗarin cibiyar da yanayin aikinta.

Za mu iya amfani da red team namu?
Har zuwa gwaji biyu cikin kowane uku, bisa amincewar hukumar kulawa, isassun kayan aiki da sarrafa cin karo da muradu; dole a yi kwangila da testers na waje duk gwaji na uku. Daban da haka, kuma a kowane zagaye, dole mai ba da threat intelligence ya kasance daga wajen cibiyar.

Masu samarwa da muka fitar zuwa waje dole su shiga?
Ana iya buƙatar su. Idan muhimmin aiki ko aiki mai mahimmanci ya dogara ga mai ba da sabis na ICT na waje, tsarin wannan mai samarwa na iya shiga cikin scope na gwajin kuma ana iya buƙatar mai samarwar ya shiga — shi ya sa dole a sasanta haƙƙin gwaji da rabon haɗarin matsala a cikin kwangila tun da wuri.

Muna gudanar da aikin TIBER-EU tuni. Mun bi ka'ida ke nan?
Kana da kyakkyawan matsayi, domin an gina tsarin a kan tsari guda, amma su biyun ba iri ɗaya ba ne. Shiga TIBER na son rai ne; wajibin DORA yana ƙarƙashin kulawa, yana ɗauke da yawan gwaji da doka ta ɗora, kuma yana zuwa da takamaiman sharuɗɗan tester da tsarin amincewa tsakanin ƙasashe da ka'idojin fasaha na tsari suka gindaya.

Manazarta

European Parliament and Council of the European Union, 2022. Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA). Brussels: Official Journal of the European Union. Ana samu a: European Parliament and Council of the European Union, 2022..
European Commission, 2025. Commission Delegated Regulation (EU) 2025/1190 supplementing Regulation (EU) 2022/2554 with regard to regulatory technical standards on threat-led penetration testing. Brussels: Official Journal of the European Union. Ana samu a: European Commission, 2025..
European Central Bank, 2026. TIBER-EU: European framework for threat intelligence-based ethical red-teaming. Frankfurt am Main: European Central Bank. Ana samu a: European Central Bank, 2026..

Bita ta ƙarshe 2026-08-06.

Sake buga wannan labari

Red Team Ya Zama Sarkar Samarwa Mai Kulawa: Abin da TLPT ke Buƙata — Sebastien Rousseau

Tsarin TLPT na DORA ya mai da red teaming wajibi mai kulawa. Matsalolin da ke ɗaure su ne kasuwar tester, yawan gwaji, da masu samarwa na waje.

An lasisin wannan labari a karkashin Creative Commons Attribution 4.0 International. Sake bugawa na bukatar nuna asalin URL na asali.

Red Team Ya Zama Sarkar Samarwa Mai Kulawa: Abin da TLPT ke Buƙata — Sebastien Rousseau

Tsarin TLPT na DORA ya mai da red teaming wajibi mai kulawa. Matsalolin da ke ɗaure su ne kasuwar tester, yawan gwaji, da masu samarwa na waje.

Originally published at https://sebastienrousseau.com/ha/2026-07-29-threat-led-penetration-testing-dora-tlpt-banks-2026/ by Sebastien Rousseau.
Licensed under CC-BY-4.0.

SEBASTIEN ROUSSEAU FOUNDER · ENGINEER