Construction Cybersecurity: Protecting Projects and People

From the streamlined workflows of project management software to the futuristic promises of robotics, tech is introducing opportunities that were previously unimaginable in the construction industry. But all that potential comes with new risks. 

The need for comprehensive cybersecurity in construction is more pressing than ever, as the industry increasingly adopts and relies on digital tools. Too often, cybersecurity is treated like an afterthought, something that is done in response to an incident. In reality, realizing the potential of new tools is dependent on having cybersecurity measures that protect their data, the projects on which they’re used and, most importantly, the people impacted by their use.

This article explores cybersecurity in construction, including the need for specialization, common threats and best practices.

The Importance of Cybersecurity in Construction

Part of the challenge of cybersecurity is the continuously evolving nature of cyber threats. Attackers and criminals are constantly searching for new ways to challenge or threaten systems. 

Several factors make the construction industry particularly vulnerable to cyber threats:

• Increased Digitalization

  The industry is moving online — and quickly. Not only does this create more potential targets, it means many people are in the early stages of tech adoption and haven’t thoroughly considered how to protect themselves or their assets and tools.

• Numerous Stakeholders

  The industry is made up of many stakeholders, including contractors, subcontractors, owners and government partners. Each stakeholder in a project can introduce a potential security weakness. The exchange and sharing of information between parties only increases those risks. 

• The Presence of Outdated Systems

  Legacy systems and tools are still commonly used alongside new technologies. These older tools often aren’t equipped to handle modern threats or to securely work with newer systems.

• High-value Projects and Data

  Construction projects usually require significant financial transactions and the exchange of sensitive and valuable data. This makes companies and contractors potentially alluring targets.

• Critical Infrastructure Projects

  Construction companies often work on essential systems, such as water treatment plants or power plants. Cybercriminals sometimes target infrastructure because of its potential for large-scale disruption

Common Threats and Vulnerabilities

Construction companies should be aware of the most common cyber threats. 

Common Misunderstandings

Misconceptions about cybersecurity are common in every industry, and they can lead to extreme vulnerabilities. Here are a few common ones, compared with their respective reality:

Best Practices for Cybersecurity in Construction

Threats are ever-evolving and security can look slightly different based on a company's needs and specialization. However, there are a few best practices that almost always increase the effectiveness of cybersecurity.

Invest in expertise.

Engaging with external consultants or investing in specialized security packages helps to make sure the latest information and resources inform security measures. For some larger companies, this might involve creating a specialized cybersecurity team. 

Some construction companies treat IT as a sort of auxiliary function, often entrusting important security tasks to team members without specialized training. Working with professionals who live and breathe technology and security is the most effective way to identify weaknesses and find up-to-date solutions.

Implement multi-factor authentication.

Multi-factor authentication is a quick and highly-effective way to add an extra layer of security to all systems. This also helps reduce the risk posed by individuals who might not be as careful or have as much understanding of risk.

Create a culture of security.

The effectiveness of cybersecurity often depends on a shared prioritization that permeates a whole organization. This isn’t to say that all team members need to become security specialists. People simply need to understand the risks, the purpose of new measures and how they contribute to or detract from overall security. Creating this culture often requires training employees on security awareness so they understand common threats, especially phishing scams to which they might be exposed.

Conduct regular security audits.

Much like project teams conduct routine safety inspections on a job site, cybersecurity audits should be done regularly to identify potential vulnerabilities and measure the effectiveness of security measures. External consultants can often do audits more effectively than internal team members, because they are able to see systems more objectively and with an outsider’s perspective.

Stay updated on what’s happening in construction.

Subscribe to Blueprint, Procore’s free construction newsletter, to get content from industry experts delivered straight to your inbox.

Subscribe

Security Incident Response Plans

Security incidents happen, but you never want to find yourself saying, “What do I do now?” Incident response plans should be established as part of tech adoption, and should include procedures and systems for responding to, containing, recovering and communicating about security incidents. Key components of a plan include: 

• Preparation and Training

  Team members should be familiar with the plan and know how to access it in the case of an incident. Training might include scenario rehearsals, one-pagers or feedback sessions.

• Involving Experts

  Specialists should be consulted to develop and refine an incident response strategy, including how to contain an attack and how to communicate with clients about an incident.

• Coordination with Legal and Insurance

  Collaboration with legal advisors and insurance agents helps a company withstand and recover from an attack by ensuring plans comply with rules and regulations and have all the necessary protections for the company and employees. 

Communicating About Cybersecurity

One of the great challenges of implementing cybersecurity measures is effectively communicating about them. Too often, people implementing the measures get lost in technical jargon. For an industry that has often been hesitant to adopt new technology, cybersecurity needs to be accessible and understandable. 

While many construction professionals aren’t experts in digital threats, they are highly specialized in their area of expertise. That’s a good thing. Effective cybersecurity doesn’t require them to retool, but it does require an understanding of the basics of cybersecurity and how each person contributes or detracts to organizational security. Conveying those things in terms that are easy to understand and translate is the responsibility of the people pushing and implementing change. Plain language, open communication and creating trust is a key part of all change management — and it's especially important for establishing comprehensive cybersecurity.

Written by