Pillar 09 · Operate
A realistic maturity baseline for post-quantum migration in financial services, mapping NIST, EU, UK and Canadian regulatory signals against what firms have actually built.
Apply security updates on a schedule with reboots gated to a maintenance window and reporting that tells you what happened: unattended-upgrades on Linux, PSWindowsUpdate on Windows.
The default Docker daemon runs as root and the docker group is effectively root. Here is how to run rootless Docker on Ubuntu 24.04, and where not to.
Wire Trivy into GitHub Actions so the pipeline fails on fixable HIGH and CRITICAL CVEs, ignores the unfixable noise, caches the DB and annotates the PR.
Test and lower environments full of copied production data are the soft underbelly of the data estate. Generate synthetic data that preserves shape, not people.
Unattended TLS renewal done properly: a certbot systemd timer, a deploy hook that reloads nginx only on real renewal, a dry-run to prove it, and expiry monitoring.
A Trivy scan reporting 400 CVEs is unactionable and trains the team to ignore the scanner. Here is how to filter to what you can fix and kill the noise at its root: the base image.
The second DORA TLPT cycle is where assurance is won or lost. A scoping playbook for widening critical-function coverage, refreshing threat intelligence and following remediation through.
Every source logs in its own shape, so detections and reports end up brittle and source-specific. Normalising telemetry to OCSF gives you one event model detections, retention and regulator queries can all be built against once.
Run a private CA with step-ca, issue short-lived leaf certificates to each service, verify both ends with mutual TLS, and automate renewal via systemd.