How to ensure cyber security in construction

A recent Hiscox report found that construction was fifth on the list of UK industries at risk of cyber attack, observing that the sector is not doing enough to prevent attacks.

All users are vulnerable – and it is important to be aware that people, not just technology systems, are a primary target. Even well-meaning users of technology can unknowingly be manipulated into enabling malicious activity through techniques such as social engineering.

Technology can be a risk, as well as an enabler for service improvement. But it would be wrong to suggest that technological developments are too risky to use because of security concerns. Rather, we should focus on securing information properly, and encouraging the prevention of breaches.

As well as immediate gains for the attacker – such as money from your accounts and the damage caused to your reputation – there's also a risk to assets themselves, their users or their general purpose.

For example, a construction project for a financial institution or law enforcement agency will generate vital information such as floorplans or data contained in digital building services and management systems and, potentially, information about the people responsible for the asset, making the project an attractive target.

In one case, hackers exploited a vulnerability in a construction services firm's website. By doing so, they were able to access its network and carry out a ransomware attack. This meant that organisation's files were encrypted, and a payment demanded before the hackers would restore access for users.

Another major contractor likewise suffered a ransomware attach on its computer systems. This impaired its operations, requiring a full restoration of the network.

Meanwhile, an infrastructure management company was hit by a cyber attack from a criminal group that leaked some of its data. This included contracts, financial documents, confidential partnership agreements and non-disclosure agreements.

Someone who intercepts a communication may seek to gain an advantage in a number of ways. For instance, they may:

• want to extract sensitive information directly
• want to modify the communication to masquerade as a legitimate user and send malicious messages
• look to resend previously transmitted information – such as requests for funds – for the sake of disruption. Commonly this could be in the form of seemingly legitimate communication letting an individual know that bank details have changed and funds should be routed to the 'new account', which actually belongs to threat actors
• seek to prevent data reaching its intended recipient, causing a denial of service.

Mechanisms to protect systems against such attackers work in two main ways, aiming first of all to prevent information being intercepted in the first place, then, should that fail, trying to prevent breaches of confidentiality or integrity.

Strategically planning cyber security measures can feel as though it is a monumental task. The NCSC therefore advocates using a set of technology principles, each of which should identify:

• what it is aiming to achieve and why
• the threat that it aims to mitigate
• protective measures, such as using encryption to protect the confidentiality of the data and ensuring that any messages modified in transit can be identified
• a list of sample defensive measures – practical techniques such as using standardised algorithms to encrypt content at source and decrypting only at the destination, never en-route, and then verifying message integrity.