What housing can learn from cloud architecture frameworks
Our reliance on technology keeps growing, data has never been more valuable to running our business and the threat from bad actors has never been worse, hence cyber risk now sitting near the top of the list as one of the most concerning problems of our time.
Being well prepared is now a competitive advantage; after all, did you think twice about shopping at M&S following last year’s data breach?
Cyber security is no longer ‘just an IT problem’. Every organisation is a potential target and every individual has a role to play in protecting against threats. Not all attacks are highly sophisticated either – the Prime Minister, Andy Burnham, was recently targeted by a hoax caller, demonstrating how effective even relatively unsophisticated attacks can be when they exploit human trust rather than technical vulnerabilities.
In housing, we’ve seen common incidents: systems taken offline, data breaches, high profile ransomware attacks and months of recovery work costing far more than the incident itself or indeed the cost to prevent them in the first place. But why is housing such a big target and where do we see risks increasing?
- AI and automation: hackers use AI to find software gaps, generate flawless phishing emails and orchestrate autonomous network scans.
- Industrialised cyber-crime: ‘ransomware-as-a-service’ lowers the skill barrier, allowing amateur criminals to buy ready-made attack software.
- Increases in state sponsored espionage: foreign intelligence groups target government, academic and defence for strategic advantage.
- Expanded digital footprint: the rapid shift to cloud services, connected devices and automated corporate processes create more entry points.
Why is data the most vulnerable target?
- Direct financial gain: databases containing customer PII, credit cards or login credentials are easy to sell or exploit for fraud.
- Extortion leverage: threat actors steal files and threaten to leak them, shifting the pressure to reputational and regulatory damage or just leak them for financial gain.
- High interconnectivity: the UK’s reliance on digitised services and cloud infrastructure, means data repositories are numerous, centralised and accessible via the supply chain.
Organisations are right to focus on the core fundamentals, such as strong authentication, staff awareness, secure backups, prompt patching and a tested incident-response capability. Combined with effective governance and data minimisation, these significantly reduce the likelihood and impact of breaches and ransomware attacks. Yet somehow this hasn’t translated into readiness. A 2023 National Housing Federation survey found that only four per cent of housing providers felt that they were fully prepared for a ransomware attack, with nearly half saying they were unprepared for disaster recovery.
Why is housing a target?
Housing providers are shaped by decades of mergers and stock transfers, and these tend to leave behind a slightly different patchwork of repairs systems, asset registers, CRM platforms and finance tools. That patchwork is hard enough to manage day-to-day; for an attacker, it’s a gift, multiplying the entry points and making it hard to say with confidence where tenants’ data actually lives.
The sector also relies on a small pool of specialist software vendors so a single supplier compromise can cascade across dozens of housing providers at once. For example, the Capita breach exposed data across 90 different organisations.
This is compounded by a recruitment challenge because housing providers are struggling to find, train and retain talent.
Combine these constraints with the increased demand for digitisation and you get an uncomfortable conclusion: the sector is being pushed to digitise faster than its technical maturity allows.
No silver bullet
The instinctive response to a rising threat is to buy another new tool, putting more barriers in place for change. The risks often end up sitting on registers and compounding over time, the IT security team just gets pulled from one project to another and the technology debt gets buried under a growing pile of the latest initiatives.
What’s often missing is an over-arching view of the architecture, an understanding of where data sits, coupled with a data and platform strategy and a set of regularly-reviewed architectural patterns.
Without the proper governance of data, security, connectivity, implementation and disaster recovery then serious problems can spiral out of control. That doesn’t mean the biggest, most expensive solution is the answer; matching all of this to the strategic needs of the business is the first step towards a restful night’s sleep and making the correct decisions at the correct time.
A proven idea from the cloud
This is precisely the gap that a well-architected approach is designed to close, and it’s a methodology we run regularly with our clients. The same structure applies to any platform or stack an organisation is running; AWS, Azure, GCP, Snowflake and others all publish their own version of this framework and the underlying pillars translate across them.
The idea originates with the major cloud providers, who developed ‘well-architected’ frameworks to give customers a consistent, best-practice lens for assessing a technology environment across a defined set of pillars, typically comprising security, reliability, operational excellence, performance and cost.
Rather than auditing against a fixed checklist, the review works through each pillar systematically, asking qualitative questions about what is actually in place, what is the business need, what’s assumed but unverified, and what would break under pressure.
Because housing providers must respond to regulatory demands quickly, there isn’t always the time, budget or resources to follow these frameworks when systems are first implemented. With the fundamentals missing from the start, it then becomes increasingly difficult to catch up.
As a result, we often approach this with a three-phase, six-week plan to tackle the challenges that might be hiding beneath the surface, in a risk based practical approach:
- System assurance: review the current platform through hands-on peer reviews, assessing data platforms through the full stack.
- Data-strategy advisory/alignment: workshops with the business to truly understand the need and balance the solution to the purpose.
- Embedding architectural standards: implement safeguards and guidance so that when problems are identified and resolved, there are then patterns to prevent them recurring.
To achieve these aims, we run six weeks of structured workshops with the people who actually run and use the systems in question, such as IT and data teams, repairs and compliance leads, information governance and often a board-level sponsor.
The workshops map how tenant and property data actually flows between repairs, asset management, compliance and finance systems; who has access to what and why; where third-party vendors sit in that chain and how their security posture is assessed; and how quickly the organisation could evidence a compliant response if a regulator ever asked.
The review produces key findings and a scoring matrix, developed across a number of tried-and-tested implementations, aligned to the following pillars:
- Security;
- Operational excellence;
- Reliability;
- Performance optimisation;
- Cost management;
- AI governance & readiness.
These findings are then prioritised against risk and value factors, and you can actively track which activities turn the dial to raise or lower organisational risk and costs. Each report balances long-term strategy with operational risk and safety, using four key drivers.
The output isn’t a generic tick-box security and architecture report. It’s a risk-based list of recommendations across the data architecture, aligned to the value drivers in your business strategy.
The benefits often extend beyond security into cost optimisation, resilience and speed, and all specific, actionable and ranked by the actual likelihood and impact of each finding, not by how easy or interesting each fix is.
Making the case internally
For an IT or data leader seeking board attention and budget, this structure matters because “we might get attacked” rarely wins investment. A prioritised, evidenced list of specific risks, such as “this vendor relationship”, “this unencrypted data flow” or “this gap in incident response”, tied to a recognised framework and a clear cost of inaction, is a very different conversation. It also gives boards something to revisit and track progress against over time in an achievable backlog, rather than a one-off audit that gathers dust.
The sector doesn’t need to wait for the next high-profile incident to make this case. The organisations that treat that as an opportunity to properly architect their data and security posture, rather than bolting on yet another point solution, will be the ones still standing, reputation intact, when an attacker comes looking for the weakest link in the chain.
Kaz Sahota is the head of commercial (housing) at The Dot Collective.
