As the global economy enters a “new normal,” the construction industry’s adoption of digital technology will only skyrocket.
Traditionally, the construction industry was among the least digitized industries in the global economy in terms of assets, usage, and labor. Innovation was further thwarted by risk aversion and narrow margins.
But amid the economic uncertainty of today, many players have realized that those who move fast and truly adopt modern technologies are poised to grab the lion’s share of new and shifting profits.
Yet, as reliance on tools like cloud storage and email platforms grows, so does the risk of data loss. According to a recent study by IBM and the Ponemon Institute, the average cost of a data breach was a staggering $3.86 million, with breaches taking an average of 280 days (about 9 months) to identify and contain. For construction projects where time is of the essence, a data breach can disrupt schedules and drain vital resources.
There’s no need to backtrack on your technology-driven methodology, but there are some security practices you can put in place to protect your business.
DATA BACKUPS
Like most construction businesses, you’re likely relying heavily on digital data for project management, including blueprints, schedules, and contracts.
By regularly backing up this data, you can mitigate the risk of data loss due to hardware failure, cyberattacks, or other unforeseen events. There are automated backup solutions available to ensure that backups are performed consistently, and that data can be successfully restored when needed. You should consider storing at least 3 different backups that are both onsite and offsite for added redundancy and disaster recovery preparedness.
ENCRYPTION
All data is an asset and should be safeguarded as such.
Whether it is the private data of your workforce — such as social insurance numbers or private HR information — or your business’s proprietary data, such as building plans or construction time frames, any exploitation or theft could have serious legal and financial consequences for your business.
Encrypting this data means that even if it’s intercepted, it remains unreadable without the decryption key.
Contracts, subcontracts and project manuals should, at the very least, strictly ban the use of unsecure or unencrypted file sharing platforms as well as unencrypted email. All external vendors with access to project data should be screened to ensure they are using industry standard data security protocols and should also carry cyber liability coverage to mitigate losses.
EMPLOYEE TRAINING
Most construction enterprises are so focused on the bottom line and the physical deliverables that many aren’t even aware of the many types of sensitive data they have living in their system. Likewise, a lot of employees and contractors don’t understand their data has value because it’s intangible, and it doesn’t have a direct impact on a company’s profitability until there is a breach and then it is too late to think about data protection or cybersecurity.
So, it’s always a good time to evaluate your personnel and organizational capabilities and reach out to third-party security professionals if your staff is struggling to understand your security needs and requirements. Ongoing training sessions, simulated phishing exercises, and reminders about the priority of data security in day-to-day operations are just some of the measures you can take to bolster employee awareness.
The data protection field is highly complex — there are many legal and compliance requirements that business leaders of all industries encounter, and construction is no exception. Working with cybersecurity professionals can make navigating this phase much more straightforward and help free up time to focus on growth.
IT ASSESSMENT
Leaders should know what risks and vulnerabilities they face with their networks and their data. By understanding their strengths and weaknesses, leaders can make informed decisions regarding the levels of protection required to demonstrate they take data protection seriously and have implemented due diligence and care. These risks can stem from many areas, including regulatory requirements, insider threats, physical and environmental factors and nation state attacks.
Assessments can also unearth opportunities to optimize IT spending, such as consolidating services, renegotiating contracts, or implementing more cost-effective solutions. Pinpointing areas of inefficiency or redundancy can also lead to significant cost savings.
MULTI-FACTOR AUTHENTICATION
Multi-factor authentication (MFA) is about adding a layer of security to the log-in process.
Think about the security system used by your bank where most users are required to sign in with a password and a system-generated code sent to their mobile phone. In simple terms, MFA requires you provide more than one credential to gain access to an application or other program. It makes it harder for criminals to access sensitive data like construction invoices, contracts, and other financial and legal documents. Given that contractors often need to access project information while on the go or at remote job sites, MFA makes sure that even if someone gets hold of a contractor’s login details, they won’t be able to easily access sensitive systems without that extra authentication step.
Multiple credentials can range from system-generated codes to PIN codes to keycard scans — it really depends on the employee’s role and the confidential information they’re dealing with.
CYBER INSURANCE POLICY
Many construction firms, especially smaller ones, don’t believe they have any real cyber risk. Plus, they are put off by the cost of a stand-alone cyber policy and opt for an insurance policy that blends cyber with professional liability insurance.
Do you recall the 2015 Target cyberattack, where attackers stole a username and password from an HVAC contractor who worked for Target? They gained access rights to monitor energy usage and temperatures at various stores, then managed to infiltrate the point-of-sale systems and start stealing credit and debit card information from millions of customers.
This story tells us that if you do work for commercial clients and have access to any of their internal systems, you could unwittingly become an entry point for hackers seeking to exploit you in a costly hacking scheme.
A little extra protection in the form of a cyber liability policy goes a long way.
Cyber liability coverage can help with first-party response, covering services like breach detection, client notifications, credit monitoring, crisis management, and business interruption costs. Also, it may cover third-party defense and legal expenses if you’re sued over a breach, including judgments, lawyer fees, and court costs. Deciding on contractor insurance policies involves balancing protection with affordability. While cyber liability might not be necessary for some, contractors facing risks like lost devices or access to client systems may find it worth their investment.
DATA PROTECTION SERVICES FOR CONSTRUCTION COMPANIES
Construction firms need to be vigilant and defense-oriented as bad actors look for any opportunity to break into their systems, which have become even more vulnerable post-pandemic as support for remote and hybrid work has grown.
The worst part may be that hackers are targeting larger, more potentially lucrative targets, through direct attacks as well as by using vendors and partner companies as vectors to gain access.
It is tempting to keep the IT budget lean and rely on employees to maintain their own machines. But doing this often means security patches and other key measures get ignored, progressively leaving more doors open for hackers to try to breach. That’s why you might want to consider hiring a knowledgeable and reliable IT partner who will be proactive about network maintenance and security.
At Yardstick, we proactively monitor your network to spot exploits and preempt attacks.
We are also able to offer managed network protection tools that detect and log abnormalities anywhere on the network, correlate and analyze the data and deliver real-time alerts and reports on potential attacks. Count on our expert team to minimize process interruptions with customizable service packages that fit with your existing structure.
Contact us today to learn more about our consistent and reliable data protection and network monitoring services.
