You may think your construction business is an unlikely target for cyber-attacks. After all, hackers are more interested in organizations such as banks and retail chains that store the sensitive data of millions of customers, right?
Not necessarily. As the construction process grows more reliant on the Internet, contractors now store and share plenty of private and proprietary information that could make you a cyber target. Also, access to sensitive data is only one aspect where malicious attacks can create disruption and harm.
Data for the taking
Besides seeking personal information on customers and employees, hackers could try to leverage a company’s access to its business partners’ confidential business information, intellectual property, or plans and specifications. Contractors, subcontractors, vendors and service providers all share access to networks and data that require protection.
In addition, though technologies such as remote monitoring and building information modeling may offer competitive advantages, they also make your company more vulnerable to cyber-attacks.
Common types of cyber-attacks
Today’s cyber-attacks go beyond simple theft. For example, as businesses that often wire transfer funds to vendors, construction companies can be a target for funds-transfer fraud. Con artists monitor companies to identify their external partners and internal accounting personnel, and then impersonate a business partner and submit fraudulent invoices or payment instructions.
In some cases, attackers looking to steal commercially valuable information such as project bids or intellectual property will try “spear phishing” — that is, impersonating a key employee or known associate in an email and tricking the recipient into opening an infected attachment or visiting a malicious website. When the malware intrudes on company networks, it can allow a cyber-criminal to gather data or disrupt operations.
Another form of cyber-attack, which as more than doubled in 2019, is the use of ransomware. This is “malware” (malicious or bad software) that encrypts critical data on affected systems – effectively locking employees out of workstations and/or servers. Once encrypted, the data is held hostage until the victim pays a ransom (which frequently requested in some form of cryptocurrency such as bitcoin) to recover the decryption key. Unfortunately, many companies choose to pay the ransom rather than face the lost revenue and embarrassment of a public disruption of operations. Hidden within some ransomware attacks can be data ex-filtration where not only do they disrupt your ability to do business, they steal confidential data as well.
While paying the ransom may unlock your data, you will have to show that there has been no data lost or demonstrate that there is a low probability that it was.
What you can do
Construction business owners can protect their valuable data in various ways, but the first step is to take cybersecurity seriously and address it formally.
For help getting started, consider the National Institute of Standards and Technology’s Cybersecurity Framework. This is a tool for assessing any organization’s preparedness to prevent, detect and respond to cyberattacks, as well as to plan for security process improvements. It’s available for free at the General Services Administration website. Ultimately it is about understanding risk and putting in place policies and procedures to help mitigate that risk.
Perhaps the most important part of any IT security plan is to keep all company software up to date, that you are using software to detect and manage malicious threats, and that your employees are trained regularly on the threats and how to manage and report them. Cyber threats are an ever-evolving problem that software developers are constantly dealing with. Whatever product you use, update it regularly to ensure new security holes are patched and make sure the right procedures are in place and observed by your team
If your construction company is reaching a point where advanced technology is mission-critical, you may want to find a partner that can concentrate on identifying your main risks and developing and maintaining security protocols to progressively mitigate those risks. This includes such measures such as enforcing strong passwords and successfully guard against phishing emails and security breaches.
Position of strength
The fallout from a cyber-attack can be devastating. After recovering from the attack, you will likely have to spend many months re-establishing your reputation and rebuilding relationships with project owners, vendors and others. Take preventive steps now while you’re in a position of strength.
Contact Scott Woodward if you have questions or to learn more.
