Case Studies

Structural telemetry sat siloed across a portfolio of commercial properties. Each building reported into its own system, in its own format, on its own schedule, and none of them reported into anything shared. A fault was therefore noticed locally and escalated late, and by the time it reached the people who could act on it, the information that arrived with it was partial.

The same operation was short of the roles that mission critical facilities depend on being covered continuously. That combination is worse than either problem alone: incomplete information is survivable when experienced people are watching, and thin cover is survivable when the data is good. Neither condition held here, so routine faults were consuming attention that should have gone to the ones that mattered.

TSD consolidated the telemetry into a single cloud database on AWS, with the collection and normalisation layer written in Python so that each building fed one schema rather than one of several. Getting every property onto a shared record was the precondition for everything after it; until a fault could be compared against the same fault elsewhere, no pattern was visible.

On top of that record TSD built custom facility maintenance tracking, so an incident was raised, routed, worked and closed against the asset it concerned rather than against a mailbox. That closed the loop the previous arrangement never had: the history of an asset became readable, and a fault recurring on a three month cycle stopped looking like three unrelated events.

Alongside the platform work, TSD deployed data centre technicians and BIM engineers into the operations team. The BIM engineers connected the physical model to the telemetry, so a reading was located in the building rather than merely reported. The technicians provided the continuous cover the operation had been missing.

Incident management delays fell by 50 percent, measured from the point a fault was raised to the point it was resolved. The reduction came from removing the wait for information rather than from working faster: the fault arrived already located, already attributed to an asset, and already carrying its own history.

Core data storage ran through the engagement with no unscheduled downtime. The maintenance record built during the work remains the single history for the estate, which is what allows a fault seen once to be recognised the second time.

Transaction volume through a financial portal had grown steadily, and the mobile entry points carrying a rising share of it had been built to an older set of assumptions. They worked, which was the difficulty: nothing was failing, so nothing prompted a review, while the value passing through them climbed.

Legacy entry points age in a particular way. The code does not change but the environment around it does, and controls that were adequate when written are quietly overtaken by techniques that did not exist then. The operation had no current picture of what was reachable from outside, which meant any judgement about its exposure was an assumption rather than a finding.

TSD ran vulnerability assessment and penetration testing sweeps across the portal and its mobile entry points, cataloguing what could be reached and what each finding permitted an attacker to do next. The catalogue was ordered by consequence rather than by severity label, so the sequence of fixes followed the damage each one prevented.

Identity was rebuilt rather than patched. Multi factor authentication was introduced across the entry points, and access was reorganised so that permissions followed a defined role instead of accumulating with tenure. Accounts that had gathered rights over years were the practical exposure, and re-issuing access against roles removed it in one pass instead of account by account.

Continuous server monitoring was then put in place, because a hardened system drifts. The monitoring exists so that the next change of this kind is noticed while it is a finding rather than after it has become an incident.

Every web application exploit discovered during the sweeps was neutralised, which is the 100 percent the engagement is measured by. The figure describes what the sweeps found; the monitoring is what covers what comes after, and the two are deliberately separate claims.

The portal now runs under an access model that can be reasoned about, where a question about who can reach a given function has a definite answer.