Recommended setup:
1. Primary connection — business-grade fibre 500 Mbps with SLA.
- Why: SLA guarantees uptime + repair times. Financial firms cannot afford prolonged outages.
2. Backup connection — 4G/5G mobile line.
- Why: Automatic failover if fibre fails. Compliance regulators require continuity.
3. Firewall + IDS/IPS at network edge.
- Why: Filter inbound threats; detect intrusion attempts. Logged for audit.
4. Internal LAN — wired Ethernet (Cat6a) for all workstations.
- Why: Faster, more reliable than Wi-Fi. Physical access required to tap — more secure than radio.
5. Separate guest Wi-Fi — isolated VLAN.
- Why: Visitors can have internet without any path to corporate systems.
6. VPN with multi-factor authentication for remote staff.
- Why: Encrypted tunnel + MFA stops credential-based attacks.
7. Encrypted storage and backups — both local AND encrypted cloud backup.
- Why: Compliance requires data encryption at rest. Off-site backup protects against ransomware.
8. Audit logging and SIEM (Security Information and Event Management).
- Why: Required by financial regulators. Detects suspicious patterns.
9. Regular security testing — penetration tests + phishing simulations.
- Why: Continuous validation. Human error is the biggest risk.
Estimated cost: £2,000–£4,000/month for connectivity + security tools. Compliance-driven; not a cost-optimisation.
Conclusion: Financial services prioritise security and continuity over cost. The hybrid wired-first + VPN + comprehensive security stack matches regulatory expectations.