Many Construction and Real Estate Businesses Need to Step It Up on Cybersecurity Measures

By now, most construction and real estate businesses are well aware of the threat of cyberattacks. However, at least one recent survey indicates that many companies in these sectors still aren’t adequately protecting themselves.

In mid-October, insurance giant Travelers released the results of its 11th annual Travelers Risk Index. On the one hand, the survey found that 80% of responding contractors and real estate companies “believe having proper cybersecurity controls in place is critical.” On the other, more than half (56%) don’t have an incident response plan, and almost half (45%) don’t use multifactor authentication.

Construction and Real Estate as Targets

The construction and real estate industries have historically been slow to adapt to new technologies. So, it’s not entirely surprising that many companies in these sectors lag in cybersecurity measures. But make no mistake: The danger is real.

Contractors and real estate businesses are attractive targets for cybercriminals — not only because of the mobile nature of your operations, but also because of the many ways cyberattacks can do damage. Examples include:

• Disrupting or delaying projects with a ransomware or malware attack,
• Disclosing confidential bid information or real estate transaction details,
• Stealing business or personal data of project owners, tenants, or other participants, and
• Copying proprietary designs, blueprints, or specifications. Cybercriminals can also cause property damage or bodily injury by deleting data, altering building plans, interfering with security or safety systems, and virtually tampering with internet-connected vehicles or equipment.

Bear in mind that critical third parties in your supply chain, such as material suppliers and real estate vendors, can be victimized, too. Cyberattacks on suppliers and vendors can interfere with your ability to obtain materials or finalize deals, negatively affecting project timelines or sales.

Internal Controls for Cybersecurity

To better protect your construction or real estate business, regularly conduct cybersecurity risk assessments. These involve taking inventory of your hardware and software, as well as mapping your network, data flows, and access points. Also, identify all your users. They may include not only employees but also vendors and project partners such as architects, engineers, and subcontractors.

Ultimately, you want to spot every potential vulnerability. Armed with this information, you can then implement internal controls and external protections to reduce the risk of a breach. Just as important, thorough assessments should enable you to develop and continuously improve an incident response plan to mitigate the damage if a cyberattack occurs.

Many internal controls related to cybersecurity are probably familiar to you by now, but they’re worth reviewing. Standard measures include:

• Requiring strong, regularly changed passwords,
• Using multifactor authentication to further prevent unauthorized access, and
• Implementing endpoint detection and response tools to monitor for and prevent intrusions. In addition, keep mobile devices and computers current with the latest updates and security patches. Educate employees to help them identify and avoid phishing attacks and other threats. Staff training is essential because most cybersecurity breaches originate from human error rather than technological failures.

Another critical strategy is to follow rigorous backup protocols to ensure that you can resume operations quickly if a cybercriminal destroys or blocks access to your data. Backups should be encrypted, stored off-site, and segregated from everyday systems to ensure they’re accessible in the event your main network is compromised.

A Strong Cybersecurity Defense for Construction and Real Estate

Another interesting stat raised by the Travelers survey is that 50% of responding construction and real estate businesses lack cyber insurance. Indeed, the right policy can help mitigate the financial impact of many types of cyberattacks. But it’s important to shop carefully and work with an insurer familiar with your company and the industry. Contact our firm for help identifying and managing all the costs of establishing and maintaining strong cybersecurity measures. Learn more about our cybersecurity and technology services. 

© 2024