Umer Kamran
Cybersecurity | OT | Critical Infrastructures
Client Overview
A leading office sector portfolio operator managing 120 commercial office assets spanning 88 million sq. ft. across Canada and the US faced growing cybersecurity risks due to aging IT/OT infrastructure, fragmented security standards, and inconsistent governance across multiple regions. With sensitive tenant data, building management systems (BMS), and operational continuity at stake, the company required a comprehensive remediation strategy that addressed both immediate vulnerabilities and long-term resilience.
The Challenge
The client’s cyber risk landscape revealed multiple layers of concern:
High-risk exposures (Priority 1):
Unauthorized access
Business interruption
Malware and ransomware propagation
Reputational damage from breaches
Moderate-risk exposures (Priority 2):
Outdated software and lack of disaster recovery capabilities
Inconsistent central policies and identity management
Increased risk of stolen credentials
Lower-risk exposures (Priority 3):
Aging building management systems (BMS)
Standards misalignment across offices
Reactive rather than proactive maintenance
Our Approach
The remediation strategy was structured into three priority phases:
Priority 1 – Mitigation Phase (Highest Risk Items)
Focused on immediate containment and prevention of critical threats through:
Deployment of managed firewalls
Implementation of secure remote access protocols
Network segmentation to limit malware spread
Strengthened endpoint protection with antivirus and system firewalls
Priority 2 – Enhance Capabilities (Moderate Risk)
Addressed systemic weaknesses and improved resilience through:
OT Active Directory integration for centralized authentication
Enforcement of BMS user access policies
Robust patch management
Comprehensive backup and recovery systems
Privileged Access Management (PAM) for identity governance
Priority 3 – Optimize Platforms (Lower Risk)
Created a long-term sustainability roadmap by:
Aligning with industry standards
Supporting the long-term BMS strategy
Investing in BMS system monitoring
Rolling out optimization and upgrades for legacy platforms
Governance, Risk Management & Compliance (GRC)
The program was underpinned by a structured GRC framework spanning:
Financial and security oversight
Vendor and contractual risk management
Forward-looking IT/OT planning
Operational readiness for 24/7 environments
Continuous improvement via ongoing review cycles
Results & Impact
By implementing the phased remediation strategy, the client:
Reduced immediate exposure to ransomware and unauthorized access threats
Enhanced resilience with structured backup, patching, and PAM solutions
Strengthened operational continuity for 120 assets across 88 million sq. ft.
Positioned the portfolio for long-term cyber maturity with standards alignment and optimization