Scroll
Construction
The construction industry is responsible for building, repairing, refurbishing, and maintaining the nation’s infrastructures. Accordingly, the sector retains a huge amount of sensitive data surrounding client and employee information, financial records, proprietary construction plans, building designs, and facility security information. Importantly, construction businesses are increasingly utilising technology to enhance their operations, which means that this information is digitised. As such, the industry houses a mass of sensitive data on its online servers, and therefore stands as an attractive target for cybercriminals.
Challenges for the Construction Industry
The two main cybersecurity challenges facing you as construction businesses are protecting your data estates, and keeping your services operational.
Book your FREE demo
Ready to take action? Fill out our form to start the process of protecting your business.
Data Protection
The first key challenge is protecting the wide range of sensitive data you store. This challenge manifests itself in various ways:
Personal Data
Construction businesses hold a significant amount of client and employee data. This includes individuals’ names, addresses, contact details, and financial records. It is important for you to ensure that this data remains secure and inaccessible to cyber criminals, because you are under a duty to these individuals to protect their private information; there are various privacy regulations and data protection laws that must be adhered to when storing client and employee data. In particular, the Data Protection Act 2018 dictates that you must abide by the General Data Protection Regulations (GDPR). The detailed and sensitive nature of this data means that the consequences of a data breach would be significant for both your customers and your company.
Intellectual Property
Construction companies also store a huge volume of data regarding their projects and designs. This includes your building models and proprietary construction plans. It is crucial for you to protect this information; a data breach could result in serious economic consequences manifested through stolen intellectual property. This would leave your company’s research and design efforts redundant, therefore constituting a waste of your time, money, and resources.
Remaining Operational
The second key challenge is ensuring that your services remain operational. Cyber attacks interrupt regular business operations by slowing down or locking your systems. In many instances, it can take months for your services to be fully reinstated. If you work in construction, it is important for your organisation to remain operational at all times, because the industry depends heavily on being able to deliver projects within a set deadline; you will be penalised for late delivery, and your clients will face difficulties if their projects are completed late. Therefore, business interruption could affect your organisation’s ability to fulfil its contractual duties, and result in a loss of customer trust.
Book your FREE demo
Ready to take action? Fill out our form to start the process of protecting your business.
Common Attack Vectors
Phishing attacks are prevalent within the construction industry. These attacks most commonly manifest through malicious emails which are designed to deceive your employees into conducting certain acts. This could involve transferring data and capital to parties they shouldn’t, divulging their login credentials, or downloading malware onto their devices. These acts allow cybercriminals to compromise the wider organisation’s sensitive data and assets.
In 2021, the FBI warned that cyber attackers were relying heavily on phishing to conduct their business email compromise attacks within the construction industry. The scammers were collecting information about various construction companies, and using this to target their customers and intercept payments.
Ransomware attacks are prevalent within the construction industry, and the pathway to infection typically involves deceptive phishing emails or compromised websites. Following the successful download of malicious software onto a company device, hackers will encrypt your company’s data, lock you out of your operating systems, and hold your files hostage until you pay a ransom. In most cases, this will result in your operations being reduced or entirely inhibited for weeks.
The demand for ransom is often heightened by a threat to publish your data on the dark web for failure to comply. The threat of data publication is significant for you as construction companies, because of the confidential and valuable nature of the data you store. Accordingly, many businesses elect to pay the ransom, which creates an environment that encourages ransomware attacks.
In December 2019, Canadian company Bird Construction suffered a ransomware attack. The company had 60GB of sensitive data stolen by the attackers, who demanded a ransom of 9 million CAD paid in cryptocurrency to prevent them from releasing it.
Particular Vulnerabilities
Geographically Dispersed SitesDoes your organisation have different sites spread across the country? Perhaps you even use temporary base camps to accommodate ad hoc business opportunities?
The nature of construction work often demands the delivery of various projects by a workforce that is spread across different locations. The result is a wide spanning network of digital communications and operational technologies (OT). In particular, company devices, key cards, control systems, and industrial equipment all require robust security controls in order to protect against cyber attacks. However, the extensive number of devices and the widespread dispersal of their use makes this difficult for companies to control. These issues are heightened by the use of temporary basecamps, because the network security protocols implemented in the permanent locations are frequently overlooked due to the temporary nature of the sites. As such, the large working perimeter of the industry stands as a vulnerability for construction businesses.
Human ErrorDoes your organisation employ a lot of staff? Do you have a wide variety of roles that need filling for your business to operate?
Many construction companies boast a huge number of personnel that operate across their various sites. In particular, these organisations rely on a variety of different teams to operate, including lorry drivers, retail assistants, administrative assistants, and builders. Whilst retaining a large number of employees supports business efficiency, it also creates vulnerabilities. This is because it is difficult for you to ensure that all these staff who operate on different sites, in different hours, and with different responsibilities are aware of their cyber responsibilities. Accordingly, there is significant room for human error, which can be exploited to result in security breaches.
Third PartiesDoes your organisation rely on any third parties to perform various functions for you? Perhaps you engage with different vendors to provide your materials?
Whilst using third party services enhances efficiency for construction businesses, it also creates a larger surface area of entry points for cybercriminals to exploit. If any of your third party contractors were to be targeted in a cyber attack, your businesses would also be impacted. The breach could result in the compromise of your data, operational delays, reputational damage, and financial loss. As such, third party vendors stand as a vulnerability for construction companies.
High Profile ProjectsDoes your organisation engage in any high profile projects?
Construction companies are responsible for designing and building high profile structures, including government buildings, water and power infrastructures, and military bases. The data collected from these projects is particularly vulnerable to attack; cybercriminals can achieve significant financial gain by selling the information to terrorist or activist groups. Therefore, high profile projects are targeted more frequently, which presents them as a particular vulnerability for your business.
Sound familiar?
Get in touch with our experts to ensure your business is fully protected.
Consequences of a Cyber Attack
The two main consequences of a cyber attack within the construction industry are business interruption and data breaches. These consequences are serious, and create further difficulties for businesses, including:
Fines and Lawsuits
The nature of the data collected by construction companies means that you must adhere to strict regulatory requirements. These pertain to the way the data is stored, and the assurance that it will remain private; you are under a duty to protect your clients’ and employees’ data (GDPR). If you fail to adequately protect this sensitive data, you might face fines from regulatory and auditing authorities, as well as legal repercussions and lawsuits.
In October 2022, the Information Commissioner’s Office (ICO) fined Interserve Group Ltd £4.4 million, after the personal data of 113,000 employees was compromised during a cyber attack.
Damage to Reputation
Cyber attacks will impact your company’s reputation in the marketplace. If you experience a data leak, or are unable to react promptly to fulfil your contractual duties, it will damage your client confidence and brand image. These repercussions are particularly harmful within the construction industry, where business is frequently won through client recommendations.
Fraud
A data leak could result in identity theft or financial fraud, wherein your employees’ or customers’ personal information and bank details are used by a fraudster. This could have significant consequences for the affected parties, including financial loss, ruined credit histories, and refused employment opportunities.
Financial Loss
Cyber attacks result in significant economic loss. If your company’s services are inhibited for an extended period of time, this will result in reduced business operations. This would cause particular difficulties for you within your industry, given construction businesses rely heavily on being able to deliver projects within a set deadline, and will be penalised for late delivery.
Financial loss following a cyber attack also has the opportunity to manifest through financial fraud, the cost of remediation, lawsuits and fines, ransom payments, training programmes, loss of business, and stolen intellectual property.
In June 2018, Solid Bridge Construction was deceived into sending a cheque for $210,312 to a malicious actor. The business received an email which pertained to be from one of their contracting partners requesting the sum, and they sent the money over accordingly.
Got a question?
Speak to one of our experts to find out if we can help you secure your business.
Take Action
The potential consequences of a cyber attack within the construction industry are substantial. It is important for you to partner with cybersecurity specialists to implement strategies and training that protect your data, and prevent attacks from materialising. At a basic level, you should have an understanding of where your data is stored, who has access to it, and what your network entry points are.
