A 2024 report from QBE North America revealed that 42 percent of construction firms now identify cybersecurity as their top risk, with 40 percent admitting it is the risk they are least prepared for. This alarming statistic underscores the urgent need for the industry to strengthen its cyber defenses.
The severity of cyber threats to the construction industry is evident in recent high-profile attacks. In 2020, French construction giant Bouygues Construction suffered a ransomware attack that affected 200 GB of data, disrupting projects and forcing system shutdowns. Canadian firm Bird Construction faced a $9 million ransom demand in 2019, while Atlanta-based E.R. Snell spent over five months recovering from a 2020 ransomware attack. Builders Mutual Insurance Company saw personal information from over 64,000 customers compromised in a 2022 hack, and earlier this year Skender, a Chicago-based general contractor, was hit by a ransomware attack affecting more than 1,000 people.
A 2023 study by Dodge Construction Network and Egnyte paints a stark picture: 59 percent of construction firms experienced a cyber threat in the previous two years, with 70 percent of general contractors facing attacks, including 30 percent falling victim to ransomware since 2021.
- Ransomware attacks — Malicious software that encrypts files and demands payment for decryption can cripple projects, leading to costly delays and potential financial ruin.
- Data breaches — Unauthorized access to sensitive data, including blueprints, financial records, and client information, can result in significant financial losses, legal liabilities, and reputational damage.
- Phishing scams — These deceptive emails or websites trick employees into revealing sensitive information, granting attackers access to systems and data.
- Third-party risks — The interconnected nature of construction projects with subcontractors and suppliers creates vulnerabilities across the network. A breach in one entity can compromise the entire project.
- Lack of awareness and training — Many employees lack understanding of cyber risks and best practices, making them susceptible to phishing and other social engineering attacks.
- Outdated software — Using unsupported software with unpatched vulnerabilities leaves systems exposed to exploitation.
- Physical security — Inadequate physical security at construction sites and remote offices can allow unauthorized access to networks and devices, compromising sensitive data.
Building a Cyber Fortress
| Your local Trimble Construction Division dealer |
|---|
| SITECH Michigan |
To mitigate cyber risks and build resilience, construction companies must adopt a comprehensive cybersecurity strategy that encompasses multiple layers of defense. This comprehensive approach not only safeguards technology and data but also ensures the long-term viability and success of the construction industry. Here’s a deeper look at key components:
Employee Education and Awareness
Regular and thorough training on cyber threats, secure password practices, and safe online behavior is essential. This training should emphasize the importance of vigilance, teaching employees to think before they click if something looks suspicious.
Employees should be encouraged to use a password manager to generate and store unique, complex passwords for each of their accounts, reducing the risk of password-related breaches. Additionally, training should cover the use of multifactor authentication on accounts, which adds an extra layer of security by requiring a second form of identification beyond just a password.
Robust Cybersecurity Policies
Develop and enforce clear policies on data protection, incident response, access controls, and password management. These policies should define the roles and responsibilities of all employees in maintaining data security. This includes establishing protocols for handling sensitive data and guidelines for secure communication.
Regular Software Updates and Patch Management
Keeping all software and systems up to date with the latest security patches is crucial for addressing vulnerabilities that cybercriminals could exploit. Enable automatic updates whenever possible to ensure that patches are applied promptly.
Network Segmentation
Network segmentation involves dividing the company’s computer network into smaller, isolated segments to improve security and reduce the attack surface. Rather than having one overarching network, smaller segments operate independently, each with its own access controls and security policies. This means that even if one segment is compromised, the breach can be contained, preventing it from spreading to other parts of the network.
Network Security
Implement a layered security approach that includes firewalls, intrusion detection systems (IDS), encryption, and strong access controls to protect networks from unauthorized access. Firewalls act as barriers between trusted and untrusted networks, while IDS monitors for suspicious activity and alerts administrators to potential threats. Encryption ensures that data is unreadable to unauthorized users, and access controls regulate who can view or use resources in the network.
Incident Response Plans
Develop and regularly rehearse a detailed incident response plan outlining the steps to contain, investigate, and recover from a cyberattack. This plan should include protocols for identifying and isolating affected systems, preserving forensic evidence, notifying stakeholders, and restoring normal operations. Regular drills and simulations help ensure the response team is prepared to act swiftly and effectively in the event of a breach.
Cyber Insurance
Investing in cyber insurance provides a safety net against financial losses resulting from data breaches, ransomware attacks, and other cyber incidents. Cyber insurance policies can cover costs such as data recovery, legal fees, notification expenses, and business interruption losses. By having this protection in place, companies can mitigate the financial impact of cyberattacks and focus on recovery.
Physical Security Measures
Securing construction sites and offices with access controls, surveillance systems, and proper storage for sensitive documents is a critical aspect of cybersecurity. Access controls can include locks, badges, and biometric systems, while surveillance systems monitor for suspicious activity. Proper storage solutions, such as locked cabinets and secure servers, ensure that sensitive documents and data are protected from theft or tampering.
Utilizing VPNs
In today’s increasingly mobile work environment, the use of a Virtual Private Network (VPN) is essential for maintaining secure connections for remote employees and at construction sites. VPNs encrypt internet connections, preventing cybercriminals from intercepting sensitive information transmitted between remote locations and the company’s network.
VPNs also provide secure access to the company’s internal network, enabling remote employees to use company resources safely and efficiently. Moreover, VPNs help protect against potential threats when using public Wi-Fi networks, such as in coffee shops or airports. By masking IP addresses and providing a layer of anonymity, VPNs reduce the risk of targeted attacks on remote employees’ devices.
- Secure operations — Immediately isolate affected systems, patch vulnerabilities, and secure physical areas related to the breach. Consult with forensic experts and law enforcement.
- Assemble a response team — Mobilize a team of experts, including legal counsel, IT professionals, and communications specialists, to manage the response and recovery process.
- Stop the bleeding — Take affected equipment offline, update credentials, remove any exposed information from the web, and interview those who discovered the breach. Don’t destroy any forensic evidence in the course of your investigation.
- Fix vulnerabilities — Assess service providers and network segmentation and implement forensic recommendations to address weaknesses.
- Develop a communications plan — Prepare clear communication for employees, customers, and other stakeholders. Anticipate questions and provide straightforward answers on your website.
When notifying appropriate parties about a data breach, start by understanding and adhering to all relevant state and federal laws. Promptly inform local law enforcement, such as the police, FBI, or Secret Service, about the breach. If account information like credit card numbers was stolen, notify the institutions that manage those accounts. In cases where Social Security numbers were compromised, inform the major credit bureaus. Swiftly notify individuals whose information was affected, providing them with clear details about the breach and guidance on how they can protect themselves.
By building a strong cyber fortress, construction companies can protect their data, reputation, and bottom line. This is not just about safeguarding technology; it's about ensuring the industry's future in an increasingly digital world.
