黑洞社区

The magnitude of Russia鈥檚 cyber capacity is fairly consequential and it鈥檚 coming. One of the tools [Putin鈥檚] most likely to use is cyber attacks. They have a very sophisticated cyber capability. The point is that he has the capability. He hasn鈥檛 used it yet, but it鈥檚 part of his playbook

Joe Biden to a business roundtable quarterly meeting in Washington, March 2022

When the president of the United States tells you to look to your cyber security, you may well sit up and take notice. In the wake of Russia鈥檚 invasion of Ukraine, Joe Biden this month warned business leaders that cyber attacks were likely, a call that was echoed on this side of the Atlantic by the National Cyber Security Centre (NCSC), a UK government agency.

Security concerns were high ahead of these warnings, with insurer Hiscox鈥檚 for 2021, which surveys global businesses, charting an increase in firms coming under threat and listing construction among the top five industries targeted.

鈥淎ttacks are always evolving and we have seen definite increases in both frequency and sophistication,鈥� says James Carter, global cybersecurity risk manager at consultant Arcadis. 鈥淲e are also seeing targeted attacks, which mean that threat actors see construction companies as lucrative targets.鈥�

Construction firms may be targets in their own right, or because of their clients, he explains, saying of the latter: 鈥淔irms may be targeted as part of a supply chain attack on a client or by 鈥榟acktivists鈥� in relation to sensitive or controversial projects they are part of. It鈥檚 important to understand how projects and clients can influence your threat profile.鈥�

In spite of these threats, the government鈥檚 annual consistently identifies construction as trailing other industries when it comes to action. 鈥淐onstruction has always been aware of a cyber threat, but often only in relation to specific specialised cases, such as government and defence work,鈥� Carter says.

But he believes that attitudes are now changing, pointing out that 鈥渢he new digital environment brings a vastly increased risk from cyber threat, as the risk is now to the actual delivered digital product, such as smart buildings鈥�.

Advances in construction and maintenance, like drones for example, also present increased risk. 鈥淭he potential reputational, financial and human cost of a drone coming down in a crowded city 鈥� whether because of interference on the connection or because it has been hacked 鈥� is severe,鈥� cautions Ian Davis, head of information security at management consultant Gemserv, which advises business clients on cybersecurity and resilience. That risk will increase as bigger, more powerful drones replace lower-level cranes for supply of materials to upper levels of buildings, a prospect that Davis says is not far away. 

Businesses need to recognise the site is the primary, more vulnerable source of threat and far easier to attack than head office

Irrespective of such advances, construction sites are inherently complex working environments, because they bring together disparate players, from tier one contractors to one-person SMEs, all having their own policies, IT standards and employees using their company鈥檚 equipment, or perhaps personal devices.

鈥淭he challenges for sites are immense and it can appear too difficult to create a robust security framework across them,鈥� says Davis. 鈥淏usinesses need to recognise the site is the primary, more vulnerable source of threat and far easier to attack than head office.鈥�

A common way of addressing site challenges is for IT departments to limit staff access to the information they need. 鈥淏ut the business side of a company can see that as constraining people鈥檚 ability to work, so you can have tension between security and business productivity,鈥� he adds.

Essentially, a site鈥檚 cyber security needs to have the same focus as its physical security, Davis argues, while acknowledging: 鈥淚t is easy to understand the cost of a group of activists coming onto a site, but less easy to understand the potential cost of a contractor bringing an unprotected laptop onto site and connecting to the network.鈥�

>> Free webinar: 

>> Free webinar: 

The government is already promoting best practice as a client, by requiring site cyber security and information security plans for many public contracts. Davis believes such assessments are key to gaining a clear view of the risks that contractors and suppliers potentially bring to a project and establishing a common cyber governance framework for areas such as incident reporting.

For contractor Willmott Dixon, the greatest cyber security threat comes from phishing emails, which seek access to a user鈥檚 Microsoft Office 365 account to steal what they have access to or use the account to send emails to other people, with the ultimate aim of stealing money.

鈥淚 speak to others at major construction companies and we鈥檙e all seeing the same problem,鈥� says Steve Witty, the firm鈥檚 head of security and compliance.

The company鈥檚 priorities, therefore, are protecting its data and safeguarding users from phishing attacks, which it does with the help of a cyber security strategy based on the NCSC鈥檚 10 steps to cyber security guidance and certification to the government-backed Cyber Essentials Plus scheme and ISO 27001.

Cyber Essentials is part of the government requirement when bidding for key public contracts, although that requirement does not commonly extend to sub-contractors.

鈥淕enerally we manage and maintain the information systems, giving the supply chain access to them. That鈥檚 why we need them to be cyber savvy, because if they are compromised it will, at best, have a knock-on effect for us.鈥�

Cyber Essentials is a valuable tool for businesses ranging from SMEs to major organisations, says Witty, adding: 鈥淚f everybody did it, there would be fewer issues for us all to deal with鈥�.

ISO 27001, the international standard for information security management systems, complements Cyber Essentials, with its focus on policies and procedures. It also gives users exemption from some of the auditing requirements of part 5 of the new building information modelling (BIM) standard, ISO 19650, which covers security-minded information management.

Willmott Dixon will be piloting this with standards body BSI this summer and Witty believes security around BIM data and other advances can be assured, so long as the right safeguards are in place. 鈥淲e don鈥檛 issue anything, whether it鈥檚 a drone or a smart fridge, without a process of evaluation, so if something is inherently insecure and presents a risk, we would look at other options,鈥� he explains. 

For Witty, cyber security is everyone鈥檚 responsibility and should be as routine as putting on a high-vis jacket when going on site. 鈥淚 can never say the business is completely secure because the bad guys are constantly evolving. 鈥淚 need our people to act as the human firewall. Everyone has access to data and data has value so everybody is a target,鈥� he stresses.

That extends to the supply chain, and Witty recently used the company website鈥檚 blog to highlight new NCSC guidance for construction SMEs.

It鈥檚 vital businesses, regardless of their size, put the right protections in place to reduce the chances of falling victim to an attack

The NCSC鈥檚 dedicated guidance grew out of the fact that 鈥淪MEs make up the majority of companies in the construction sector, and so building up their resilience can help protect the wider industry from online threats,鈥� says its spokesperson. A common barrier to building resilience is cost.

鈥淲e know that construction businesses can operate on tight profit margins and that investing in cyber security can seem like a non-essential expense,鈥� says the spokesperson. 鈥淗owever, it鈥檚 vital businesses, regardless of their size, put the right protections in place to reduce the chances of falling victim to an attack, as it could grind operations to a halt and potentially result in higher costs.鈥�

Across the UK a network of regional cyber resilience centres, supported by the police and the Home Office, has been established to work on the ground with SMEs in all sectors. 鈥淓ach sector has its own threats and technical issues around that, but there are common factors,鈥� says Jared Thompson, spokesperson for the north west region鈥檚 cyber resilience centre (NWCRC).

鈥淚n construction we have noticed that people don鈥檛 want to see bad PR about being attacked 鈥� businesses can often feel there鈥檚 a stigma attached.鈥�

NWCRC, whose team includes two officers seconded from Greater Manchester Police, supports businesses with free and easily accessible guidance and 鈥� for fee-paying members 鈥� training sessions and security services. It has around 500 business members in the Greater Manchester area, plans to expand its activities to the broader region, and also wants to work with more businesses in construction.

The sector has proved harder to engage with than some others, says Thompson, but NWCRC is in discussions with a partner to create a dedicated campaign targeting construction SMEs.

As a training provider at NWCRC, Thompson teaches businesses about common everyday threats, from phishing emails to the stranger who may be looking over your shoulder while you鈥檙e working on a tablet in a caf茅. 鈥淩emote working is everyday working for a lot of people in construction as people are often moving from site to site, and working largely from a tablet or mobile,鈥� he says.

鈥淲e want to be there to help people to prepare. It can be a matter of building resilience and confidence in staff so that they know what something suspicious looks like.鈥�

NWCRC also warns of latest threats, drawing on police intelligence, which this year have already included a number of ransomware attacks. 鈥淲e don鈥檛 want to scaremonger, but we tell companies it鈥檚 a case of when, not if,鈥� says Thompson.  

Case study: from attack to opportunity

One contractor that came under threat gave a rapid response that not only kept business on track, but resulted in it upgrading its email system and upskilling its people. The company asked not to be identified, but wants to share its experience to help others. The head of IT says:

鈥淲e noticed through our external perimeter security that we were starting to see a lot of detection attempts against our email infrastructure. Initially the attacks came from China, so we geo-blocked anything coming from there, but then more and more attacks started coming from Russia, the Cayman Islands, USA and other locations. We weren鈥檛 sure whether the attack was state-backed initially.

鈥淭his happened on a working Friday last December. I suddenly started getting calls from my team asking me what was going on. It turned out the software had a security vulnerability 鈥� a zero-day threat - that Microsoft had not yet patched, so there was no action we could take against it.

鈥淲e have Cyber Essentials Plus certification, our server was fully patched and our website and internal systems are ring-fenced and were under no threat, but zero-day software threats are out there and present a big risk for companies.

鈥淲e turned off our public-facing email service and cut off access straight away; we felt it was only a matter of time until the attackers broke in. We had to have email because it is critical for the business so I enabled our Mimecast cyber security service鈥檚 continuity mode 鈥� which allowed us to continue to send and receive messages 鈥� and then brought online a new cloud-based email service, configuring it over the weekend.

鈥淲e had plans to retire the old email service and this basically accelerated them. By Monday morning we had the new service working.

鈥淭he saving grace was our use of Mimecast. We use it as a secondary gateway to filter inbound and outbound messages and as our compliance tool, so all our email data is there and was accessible to people while we were doing what we needed to do to get everything back online.

鈥淚 did live video training sessions with all our staff on the new service over the first week, and we followed that up with one-to-one sessions, as people don鈥檛 always feel comfortable airing questions in public and to ensure everyone is upskilled.

鈥淣ow, 90 days later, we鈥檝e gone to another level in collaboration and are working in a more unified manner 鈥� a key takeaway from this experience has been the importance of learning new skills to stay relevant and competitive.

The construction sector has gone through seven years of digital transformation in the space of two years because of covid

鈥淎longside the new email, we鈥檙e using Google Workspace tools, so people can collaborate on a single real-time document using Sheets 鈥� instead of swapping Excel files 鈥� and communicate via the Chat function instead of email. If we internally collaborate better, we make fewer mistakes and collaborate better externally.

鈥淐ovid saw us massively increase our use of video calls on Google Meet and people have realised this is an easier way to work than face-to-face meetings. I鈥檝e carried out research, which suggested that the construction sector has gone through seven years of digital transformation in the space of two years because of covid. That shows the speed of acceleration, but also demonstrates how far behind the sector was and the massive jump it had to make. 

鈥淲e鈥檝e been on the receiving end of attacks on other construction companies; I鈥檝e probably seen 30 of the top 100 contractors attacked, but nobody wants to talk about it.

鈥淭he squeeze on main contractors鈥� profit margins means IT budgets get constrained, so it becomes challenging to manage and maintain systems properly. When I look at main contractors鈥� public email settings, it is evident a lot don鈥檛 have a secondary email gateway so could be badly affected if they have an attack like ours.鈥�