Cybercrime in construction is growing at an alarming pace, according to a report published by U.S. software company Bluebeam.
In fact, analysis of data of ransomware attacks from 2020 to 2022 conducted by cloud storage service provider NordLocker ranks construction as the second largest industry victim, only slightly behind manufacturing.
The list of corporate data vulnerabilities has become a familiar refrain across many sectors. Most often discussed are those related to network security gaps in firewalls and poor user behaviour by employees at all levels.
Cyber attacks specific to construction have grown alongside the proliferation of digital technologies encompassing all aspects of project design and execution. The Bluebeam report references an analysis by Grand View Research that estimates the global construction and design software market was $9.6 billion in 2021, with compound annual growth projected at 8.5 per cent from 2022 to 2030.
Combined with this growth, Bluebeam points out what most in the industry already recognize; Construction is a complicated, interconnected process. It involves numerous players and contributors, sharing information and payments across a wide assortment of platforms and software programs.
“Every project – whether it is building a skyscraper, erecting a bridge or expanding a complex highway system – requires a vast network of loosely connected stakeholders to complete. While this reality comes with many positives, there are some aspects to this structure that make the industry especially vulnerable to cyberattacks,” says Bluebeam.
What is particularly frightening is the commercialization of cyber attacks over the last couple of years. It has grown from a linear attack model to one that uses RaaS (Ransomware as a Service), software that is distributed and shared among numerous criminal gangs.
Edward Kost of UpGuard describes RaaS as “a subscription-based model that enables affiliates to use already-developed ransomware tools to execute ransomware attacks. Affiliates earn a percentage of each successful ransom payment.”
Data breaches, ransomware demands and sabotage can result in legal risks and reputational harm. They can impact and interrupt company activities and result in financial consequences across the company’s operations beyond any specific ransom payment.
Just as the list of causes, corporate vulnerabilities and consequences sounds familiar, so are the solutions.
Manny Rivelo, CEO of cybersecurity firm Forcepoint, writes in Forbes that solutions start with a zero-trust foundation.
“’Never trust, always verify’ should become the guiding principle throughout your organization. From individual contributors to managers to executives and boards, we must all look for ways to adopt zero-trust tenets and make them easier to adopt. This includes the security posture.”
Given the numerous and ever-changing business relationships during the life of a construction project and the number of remote and in-house data exchanges, this zero-trust foundation should extend beyond internal departments to all participants.
The number and intensity of cyber attacks has resulted in the growth of the cyber insurance industry.
International password security firm NordPass explains in the company’s 2022 Guide to Cyber Insurance that a partnership with an insurance company with specific cyber expertise can act as a preventative service. Both share the goal of averting incidents and mitigating the impact of a cyber-event, beforehand and while the event is happening, similar to helping homeowners protect property before and during an active hurricane.
However, insurance can’t solve all the problems. Although coverage can vary, most policies do not cover drops in future profits, reputational damage and security upgrades to prevent future attacks. In other words, it still comes down to enacting company actions that reduce the initial risk of attack.
NordPass suggests a to-do list of internal tasks that includes ongoing training of everyone with access to data, keeping software up to date, securing the network through a trusted and vetted cloud storage partner, and lots of encryption. Without such safeguards in place, construction companies represent an easily penetrated wealth of data that is a magnet for hackers and data thieves.
“No one is immune from a potential attack,” writes NordPass CEO Jonas Karklys, “which is daunting, given that the impact of a single cyber-event can be devastating, threatening insolvency.”
Global forensic investigation consultancy Accuracy is teaming up with Fresh Bruckhaus Deringer and New York University Abu Dhabi to conduct a survey assessing the construction industry’s current level of preparedness against cybercrime. Industry participants are invited to participate by clicking this link.
John Bleasby is a Coldwater, Ont.-based freelance writer. Send comments and Inside Innovation column ideas to editor@dailycommercialnews.com.
Recent Comments
comments for this post are closed