Parent Page Home
Parent Page Cyber Customer Centre
Parent Page Cyber threats for industry Verticals
Construction

Construction

Illustration depicting a padlock and key

Full Spectrum Cyber: Construction Risks

The Key Exposures Facing Construction Firms

Access to Larger Prizes within the Same Supply Chain

Smaller firms are often targeted because of their supply chain relationships with larger companies.

Valuable Information Held in New Technology and Software

More technology adoption, such as “Building Information Modelling (BIM),” telematics and project management software means more rich data, sensitive information is accessible online for theft, ransom and financial gain.

Protected Intellectual Property Stored and Shared Online

Valuable proprietary assets, architectural drawings, blueprints, formulas and equipment specifications are often stored and shared online. If the proper protections are not in place, cyber criminals can access this data for theft, ransom and financial gain.

High Value Tools and Equipment at Risk

Cybercriminals can hack into security systems and CCTV on-site causing property damage and theft.

Reducing Risk - Cybersecurity Information for Construction Firms

Incident Response Planning: Create a plan that is stress tested regularly. Improve upon the issues raised during testing to improve response times to a cyber incident. Testing the plan will help minimize damage by creating the appropriate downtime procedures for the business.
Vendor risk management: Vet suppliers thoroughly, require Cyber Insurance for all service providers, and use standard contracts, questionnaires and forms for uniformity
Staff Cybersecurity Training: Conduct regular phishing test to reduce human error. Many cyber incidents happen because someone clicked on something which they shouldn’t have.
Backups: Develop and test backup and recovery plans; keep copies of sensitive or proprietary data in a separate and secure location. Test back-ups regularly to ensure both the technology, and the people, can function during a crisis.
Email Security: Properly configuring spam filters, investing in antivirus protection, and adding multi-factor authentication can help employees avoid business email compromises, fraudulent instruction losses, and other cyber claims.
Penetration Testing: Engage a security firm to evaluate your attack surface and assess vulnerabilities. Report results to the executive team and recommend future protective actions. Penetration testing can drive down the costs of an incident significantly.