It’s increasingly in the headlines, nightly news and on media sites; cyber security breaches are on the uptick. Some of the largest breaches this year have involved Colonial Pipeline, Facebook, Bonobos, Kroger, Parler and T-Mobile. While construction companies weren’t at the top of the list of biggest breaches of 2021 so far, the number of construction-related cyber breaches experienced a 545% increase from 2019 to 2020, according to the 2021 Data Breach Outlook Study by Kroll, a risk consulting firm. In construction specifically, that increase was 800% from 2019 to 2020.
According to the study, “a large North American construction company had to notify hundreds of thousands of customers due to an incident involving a stolen laptop that resulted in unauthorized email access.” While construction companies excel at working at remote jobsites, moving office work to work-from-home settings during the pandemic created challenges for the industry, the study says. There are other risks in the industry, as well. Devices connected to the Internet, from smartphones to wireless sensors, can work as portals granting access to company information. And when contractors pay subcontractors, those wireless transfers can potentially be at risk.
The construction industry was, at one time, fairly immune to security breaches. But in recent years, there’s been an influx of new technologies and new connections on jobsites that can make companies vulnerable to cyberattacks. At least 43% of those surveyed for the study said they felt ill-prepared for a breach. So what can construction companies do to prepare for a potential breach? We talked with Brian Lapidus, global practice leader for Kroll’s Identity Theft and Breach Notification practice, a division of Kroll’s cyber risk division, about trends he’s seeing and what contractors can do to keep their businesses safe.
Lapidus points out that businesses are better prepared now for cyber threats than they were 15 years ago.
“Fifteen years ago, I think a lot of the conversation was ‘Cyber who? Cyber what?’ And now they're willing to take an active approach to manage their risk,” he says.
Sometimes companies think they’re protected when they’re not, he says. For example, just because a business is in compliance, or in other words, has established protocols to address cyber threats, does not mean that business is protected from cyber threats, he says.
“I think often the board and the C-suite think about compliance as the cyber strategy, and it's not, it's not an effective cyber strategy,” Lapidus says. “Compliance is a checkbox. It doesn't actually reduce the risk. Now it may increase awareness, which is a positive, but it's never going to thwart the intruder. And so, that increase in accountability and that focus on doing more than compliance still needs to occur.”
1. Retain Cyber, Legal Experts
Before a threat is identified, one of the wisest decisions a construction business can make is to have a cyber expert and an attorney on file. Meet and have a brief discussion with these professionals, so you know who to call when a problem does arise, he says.
“Starting to search for a solution when you're in trouble, it's like figuring out who to call when your house is on fire,” Lapidus says. “There's a lot of damage that gets done before you can even get to the fire department, if you don't know where the fire department is. So having those things in place is really, really important.”
2. Practice Response to Breaches, Like a Fire Drill
The next best move is for a business to practice its response to a cyber threat the way schoolchildren and some businesses practice fire drills. Performing training exercises, such as how to react to suspicious emails, can greatly reduce a company’s exposure to cyber threats, Lapidus says.
“A larger organization may do this monthly or quarterly; a smaller organization may not be able to do it with that frequency,” he says. “The goal, in my mind, is for there to be some organizational muscle memory when this event does happen, so that you can react and react quickly, because speed is sometimes the name of the game.”
3. Keep employees trained
It’s also important to renew that training periodically. Doing so improves employee response to potential threats, Lapidus says.
“Your employees can be an amazing defense mechanism if you use them, and I don't think organizations are using them as effectively as they could today,” he says. “You have your technical solutions and then you have your human capital solutions and both of those together are far more impactful than one alone.”
Kroll
4. Know Where Your Data Lives
Before a cyber breach occurs, find out where your company’s data – employee data, customer data, security data, proprietary data – is kept.
“Whatever it is, know where your data is, because if it's accessed, then you know what you need to fix,” Lapidus says. “I've unfortunately seen many clients who don't know where their data is, which, when they have a network exposure, triggers all sorts of notification requirements, that if they knew where the data was within their system, they may have been able to work with counsel to reduce the scope of that notification.”
5. Stay Current on Tech
Have someone on the team who stays up-to-date on cyber security threats and technology, Lapidus says.
“It’s really hard to stay on top of new technology and new potential technology exposure but making sure that people on your team are aware of those things, staying up on it, and then sharing that information and filtering it back into the organization,” he says. “It reduces your risk, and all of these things are about reducing that risk. So when this happens your impact is small, and your response is fast and stable.”
6. Use More Than Encryption
Encrypting data is a best practice within the cybersecurity industry, but it’s not enough to protect a company, Lapidus says.
“Encryption cannot be the only method of defense,” he says. “When it's used alone, it can give businesses a false sense of security.”
He suggests using a virtual private network (VPN) as an additional layer of security.
7. Network monitoring
As a preventative tool, companies can monitor their networks to ensure all entry points are protected. Monitoring also helps inform a company about whether the network has been infiltrated by a cyber intruder.
8. Ensure Wire Transfers are Secure
When contractors pay subcontractors and vendors, large sums of money exchange hands. Construction companies need to make sure those wire transfers are secure and safe from cyber threats.
“Those wire transfers and e-payments are opportunities for someone to insert themselves between a vendor and a contractor and the corporate side,” Lapidus says. “So, making sure that those are super tight is important. I think it reduces the financial risks there. You can do that by providing wire instructions and then forcing a phone call for a password or specific digits, but doing things to tighten up those gaps, I think, is something that would help the construction industry.”
9. Appoint Someone to Make Decisions About Cyber Security
In various industries, such as healthcare, there is typically one or two people appointed to have access to cyber security information and decisions. Appointing someone at your construction company to be in charge of cyber security information and decisions is wise, Lapidus says.
“A lot of times in hospitals, at least certain people have access to certain information; it's a regulated industry,” he says. “They're required to lock certain things down. That rigor isn't required in the construction industry from my experience. Making sure that it's really clear who owns what, and who makes what decisions, and who should have access to what information is important.”
10. Secure the Construction Ecosystem
In an office building, all the people, equipment and data are in one place. That’s rarely the case in construction.
“If everyone was in one building, it would be a whole lot easier, right? You would be protected by four walls and a network configuration and all of those things that can happen physically within one place,” Lapidus says. “Use of a VPN, use of best practices, controls around who has access to what information; it all reduces that risk of an exposure happening. That's something that I think is probably more unique to construction than anywhere else.”
11. Protect Employees From Breaches
If a company were to experience a cybersecurity breach, it’s important to communicate with and protect employees from any potential risk.
“These organizations need to be cognizant of the impact that a breach of their data would have on their employees or those who work for them,” Lapidus says. “It's going to make it really hard for them to resolve those issues because they're on a jobsite during the day. They could be 50 feet up in the air, welding. And management is saying, ‘Listen, we lost your data, but we need you to resolve it yourself. And you may want to, you may want to call your bank.’ That's, that's putting your employees in a tough spot.”
To learn more about the study and cybersecurity vulnerabilities, read the study here.
