SGBD Apps: security built into the platform

One urgent problem across an entire application estate

Saint-Gobain Building Distribution had roughly 40 internal business applications spanning decades of technology. Some dated back to classic ASP and Visual Basic 6. Authentication ranged from separate user stores with inadequately protected credentials to a single shared password embedded in an application.

After a major, widely reported cyber incident in 2017, Saint-Gobain introduced stringent group-wide security requirements and formal application audits. Every application needed a credible route to approval or retirement, but individually repairing several generations of incompatible software would have consumed the available time without producing a maintainable estate.

I proposed and built a different route on my own initiative: a modular ASP.NET Core platform on which the required business workflows could be recreated with security, access control, auditability, and operational consistency built in.

Turning policy into executable architecture

Written standards still leave room for omissions and inconsistent interpretation. I encoded the important controls into the platform so that application developers inherited them by default.

The shared core provided central identity integration, role- and policy-based authorisation, access-request workflows, anti-forgery protection, secure response headers, anti-framing and document-download controls, structured logging, data protection, consistent error handling, and automatic auditing of business operations.

At startup, the platform inspected each application's controllers, actions, roles, and API endpoints. Mandatory failures—such as a controller without authorisation or a modifying endpoint without anti-forgery validation—prevented the application from starting. Less severe access patterns were exposed as explicit compliance warnings. This shifted security review earlier: developers could not accidentally deploy several important classes of violation and leave an auditor to discover them later.

A modular estate rather than another monolith

The platform was delivered as versioned shared packages and reusable UI components. Each replacement application supplied its own business behaviour while registering its identity, roles, navigation, endpoints, and current platform version with the central system.

The root administration application was itself built on the same foundation. It provided a catalogue of applications, user and role management, access approvals, central logs, audit search, and estate-level visibility of compliance status and framework versions. Shared service registration and token handling also gave applications a consistent way to call internal APIs without inventing another authentication scheme.

The result was deliberately practical: teams could build small, focused applications without rebuilding the security and operational foundation every time, while improvements to the shared core could benefit the wider estate.

Recovering behaviour from software without source

Not every migration began with a healthy codebase. For some applications, the original source no longer existed. I had to decompile binaries, observe behaviour, and reverse engineer the business rules before rebuilding the workflow on the new platform.

Reporting created another migration barrier. Many older applications depended on Crystal Reports, which did not support the target .NET Core architecture. Rather than keep those applications tied to the legacy runtime, I built a custom reporting interface so replacement applications could define and deliver the reports their users still needed.

This work was as much software archaeology as greenfield development: preserve the valuable operational behaviour, discard unsafe assumptions, and avoid carrying obsolete technical constraints into the replacement.

Search, audit evidence, and performance

The platform automatically recorded auditable business operations with the user, application, request, outcome, and timing needed for investigation. A central interface made those records searchable across applications rather than trapping them in separate logs.

I used Apache Solr for indexed search where relational queries and legacy application designs had produced slow user experiences. Shared Solr-backed search infrastructure supported fast retrieval, filtering, and navigation, while also making the growing central audit history practical to explore.

Security and performance were therefore not competing afterthoughts. The same migration replaced weak identity and audit models while giving users faster, more consistent applications.

Applying the same infrastructure to e-commerce

A related project supported the main sales website for Jewson, one of SGBD's largest retail brands. Its product catalogue ran on IBM WebSphere Commerce, where loading a category could take around 20 seconds.

Using the Solr infrastructure, we built a fast indexed search and navigation layer over the catalogue rather than depending on slow WebSphere queries for the customer experience. I also built a management application on the secure platform that gave staff a responsive, searchable interface for maintaining the underlying product data.

This was not a wholesale replacement of the commerce engine. It was a targeted intervention that used the new search and application foundations to improve both the public buying experience and the internal work required to manage it.

The result

The platform became the foundation for replacing more than 20 legacy applications from an estate of roughly 40 systems that needed approval or decommissioning. It turned a time-constrained security programme into a sustainable application architecture rather than a series of isolated patches.

Most importantly, it changed the default. Authentication, authorisation, audit trails, secure request handling, compliance checks, logging, navigation, and common services no longer depended on every developer remembering to implement them independently for every application.

Why I include this work

• Initiative: identifying and building a platform solution without waiting for it to be prescribed.
• Security-by-design expressed as executable defaults, validation, and deployment gates.
• Platform architecture that let many focused applications share one maintained foundation.
• Pragmatic legacy modernisation, including reverse engineering when source code was unavailable.
• Replacing unsupported reporting infrastructure without retaining the obsolete runtime.
• Central auditability and Solr-backed search across a multi-application estate.
• Applying shared search infrastructure to a high-value public commerce performance problem.
• Balancing urgent risk reduction with maintainability, usability, and performance.