Tag Archives: security architecture

Series Wrap-Up: Reconstructing Time, Truth, and Trust in UK Financial Services Data Platforms

This series explored how UK Financial Services data platforms can preserve temporal truth, reconstruct institutional belief, and withstand regulatory scrutiny at scale. Beginning with foundational concepts such as SCD2 and event modelling, it developed into a comprehensive architectural pattern centred on an audit-grade Bronze layer, non-SCD Silver consumption, and point-in-time defensibility. Along the way, it addressed operational reality, governance, cost, AI integration, and regulatory expectations. This final article brings the work together, offering a structured map of the series and a coherent lens for understanding how modern, regulated data platforms actually succeed. Taken together, this body of work describes what I refer to as a “land it early, manage it early” data platform architecture for regulated industries.

Continue reading

From Threat Model to Regulator Narrative: Security Architecture for Regulated Financial Services Data Platforms

This article reframes security as an architectural property of regulated financial services data platforms, not a bolt-on set of controls. It argues that true security lies in preserving temporal truth, enforcing authority over data, and enabling defensible reconstruction of decisions under scrutiny. By grounding security in threat models, data semantics, SCD2 foundations, and regulator-facing narratives, the article shows how platforms can prevent silent history rewriting, govern AI safely, and treat auditability as a first-class security requirement.

Continue reading

Azure Data Factory: Why Can’t You Just Do the Simple Thing?

Azure Data Factory can route traffic through a corporate firewall with a fixed outbound IP… but only after you abandon the idea of “simple”. This article explores why a basic enterprise requirement turns into architectural theatre, and what that says about modern cloud platforms.

Continue reading

Cyber deception at UK scale: what the NCSC trials tell us — and what they still don’t

The NCSC’s cyber deception trials mark a shift from theory to evidence, testing whether deception can deliver real defensive value at scale. This article examines what those trials show — and what they leave unresolved. It argues that cyber deception is best understood as an evolution of honeypots, powerful but operationally demanding, and highly dependent on organisational maturity. While effective in well-instrumented environments, deception is not an SME-level control and risks being over-sold. Without clear metrics, safety discipline, and honest maturity gating, its promise remains conditional.

Continue reading