
Cybersecurity: Getting a handle on the hackers
By Adam Freill
Construction Risk Management SoftwareOn-Site cybersecurity webinar provides overview of risks associated with doing business in today’s digital world.
Much like having a crisis plan for accidents on a site, it pays to have a cybersecurity plan for when hackers come calling. With so much reliance on digital technologies in today’s world of construction, companies of all sizes need to have a solid handle on their cybersecurity risks.
In October, On-Site Magazine presented a webinar featuring Craig Hurst, COO of The Net Effect Contractor Advisors Inc., and chair of the Technology Committee of the Canadian Construction Association, to help assess and mitigate risks in the construction sector. The presentation, sponsored by software company Revizto, provided an overview of strategies that companies can use before, and after, suffering an attack.
“There are really only two types of companies, those that have been hacked and those that will be,” stated Hurst. “And the characters that are out to hack are hiding in the shadows.”
He explained that cybersecurity is becoming a multi-billion-dollar issue, touching companies of all sizes in all sectors of the economy.
“Construction businesses are not exempt from it,” said the security expert. “We tend to think that the companies that are going to be vulnerable are the ones that are issuing credit cards or utilizing credit cards for payment processes, or that have a lot of user identities in their databases. The fact of the matter is every company is as vulnerable as the next. There really is no reprieve. And so construction, just like any other industry, needs to be on top of these issues before these issues get on top of them.”
Cybersecurity risks are evolving
Where once the biggest concerns was the nuisance of viruses taking systems offline, or being used to steal personal information, like credit card numbers and banking details, the world of cybercrimes is evolving.
“In today’s day and age, they are monetizing these attacks and figuring out how to extract hard-earned dollars and cents from the victims that that they’re going after,” he said. “We’re still talking today about malware and viruses, they haven’t gone away, but now there’s ransomware – companies being held hostage, being told to make a payment to retrieve their data and get back into business. That’s probably the biggest concern in the cybersecurity field right now.”
While larger companies tend to be the assumed targets, these contractors usually have digital teams and departments implementing protocols and monitoring for potential intrusions, which is why smaller companies may be more susceptible to the risk than a large enterprise.
“Every business is at risk. Small companies are being attacked as well as the big enterprise contractors,” said Hurst. “Most don’t have effective cybersecurity protections and practices in place, and so the hackers know that they are vulnerable.”
Financial and non-financial costs
Regardless of corporate headcount, in addition to the potential costs associated with paying a ransom, there are reputational concerns that being hacked brings forward, along with a potential loss of income while a company scrambles to get its systems back up and running.
“Does it mean that your projects are going to stop? Maybe not, but there’s no question that there will be a financial impact in terms of number projects going down, getting your systems set back up again, the costs associated with some of the legal impacts that are going to take place, and then there’s reputation damage.”
Navigating the hours and days after an attack is made easier when there is a plan to follow, but what should one include in a cybersecurity manual? While these are generally bespoke documents, tailored to the specific needs of the company and its risk profile, Hurst says that a cyberattack plan should address a number of key points: “Who’s going to be in charge? How does it get identified? Who do we inform? Do we inform the police? Do we inform our insurance company? Do we inform all of our ‘nears and dears’ … our suppliers, our subcontractors, anybody who has a substantial concern about us being hacked… Who are they? And what do we inform them?”
A communication plan is a must, he explained, with designated people who handle specific tasks. And the plan should also address any legal requirements.
“What are our legal responsibilities and compliance responsibilities? Who do we have to inform? What do we need to do with respect to being sued by somebody whose information you let out? What’s our legal responsibility to the owner of the building that we’re working on?”
Deploying the document
Preventing an attack, or reducing the damage from an attack, is generally easier to achieve through the formation of a plan, but simply having a cybersecurity document in place is not enough – for a plan to be effective, it needs to be understood and followed by a company’s people.
“When we look at what’s happening with cybersecurity attacks, we generally find that it’s because the organization has not taken the time to adequately understand what cybersecurity issues are out there, what their vulnerabilities and risks are, but more importantly, not taking that kind of information to the next step, which is training staff,” said Hurst.
He also suggested expanding the focus to anyone who may have access to or be impacted by the company’s digital workings.
“If you’re a general contractor, that means you could have vulnerabilities that are being pointed at you because of your subcontractors or your suppliers. It really comes down to understanding who’s involved in your in your digital ecosystem, the kind of vulnerabilities they have as individuals, and how we can batten down the hatches so that those vulnerabilities are less likely to cause us a problem,” he advised.
“The number 1 defense against anything with respect to cybersecurity is multi-factor authentication,” he said, adding that despite how familiar we are with it through online banking and even food delivery services, many companies have yet to fully embrace this relatively simple defensive step.
“We understand it; we accept it; but within our own businesses, we are not demanding it yet,” he said.
Ensuring that the proper defenses are in place, and that everyone in the stakeholder chain is taking the issue seriously, takes repeated focus from the company’s leadership, along with on-going training and support right through to the jobsite. Reframing the topic may help, advised Hurst.
“It’s as much a safety issue for the for a company as making sure that your people are using scaffolding properly, or you’re doing a hazard level assessment on a site location every morning,” he explained. “We don’t think of it as safety because it’s not like people are getting injured, but in a sense, it is about the protection of the company… Everybody’s got a level responsibility with respect to protecting that safety factor, so reinforce the steps in toolbox talks and put together corporate policies that are included in your onboarding sessions for new employees.”
Building the backups
These policies should include regular backing up of data, said Hurst. “Corporately, you want to be doing a backup of everything that’s created, at minimum, once a day. If you think you’re vulnerable, you may want to be doing it more regularly than that.”
This backup can be stored locally, if a company has appropriate systems in place, but more and more companies are moving their data to the cloud – a solution that he views as a good option for smaller companies in the construction sector.
“If you are a small company without a cybersecurity plan, without an IT department, you are probably more vulnerable than using what’s known as an in-the-cloud or an SaaS application, because the companies that are hosting those applications have extraordinary security in place,” he said. “They have to, or they’d be out of business.”
In the event that an attack does take down a company’s systems, Hurst said it is best to avoid the temptation to automatically reinstall programs and data from a backup. That step may be necessary, but protection comes first.
“You do not run to your backup and plug it in right away,” he said. “You want to make sure that your IT department or your IT consultants are brought in… to make sure that everything is either a new setup of your existing tech stack, or that it is isolated and ensured to be clean before you input your latest backup of your data, otherwise you could be backing your data up into something that is still vulnerable and still exposed to the ransom demanders.”
Hurst shared a number of best practices to follow during the one-hour presentation, but one of the best was also quite simple: “Anytime one of your software vendors sends you a notification that says, ‘Here is the latest update,’ do it… Most of the time they are doing something to improve their system security in those updates and patches,” he stated. “If you are not doing those patches when you find out about them from the software vendors, you are leaving your system vulnerable.”
Print this page