[ad_1]
\n<\/p>\n
In 1990, I read an exciting book titled The Cuckoo\u2019s Egg<\/a>: Tracking a Spy Through the Maze of Computer Espionag<\/em>e. The author, astronomer Clifford Stoll<\/a>, managed computers at\u00a0Lawrence Berkeley National Laboratory (LBNL)\u00a0in California. He was tasked with resolving an accounting error of 75 cents in the computer usage accounts.<\/p>\n The tedious process eventually led him to disclose a German hacker who had gained access to U.S. military secrets through LBNL\u2019s computers. He had been selling information to the KGB for years.<\/p>\n The LBNL incident was one of the first\u2014if not the<\/em> first\u2014documented cases of a computer break-in. Fast-forward to today and\u00a0cyber-attacks are an everyday phenomenon that occurs more often in construction.<\/p>\n A 2023 survey<\/a> by Dodge Construction Network, in collaboration with content security and management company Egnyte, found that 59% of AEC firms had faced a cybersecurity threat within two years.<\/p>\n General contractors were the most affected, with 70% experiencing a threat and 30% dealing with a ransomware attack during that period.<\/p>\n Some examples of construction-related cybersecurity incidents include:<\/p>\n I can think of several reasons construction can be an attractive and lucrative target for malicious actors:<\/p>\n One security expert told me that for some organizations, even seemingly harmless information can become valuable over time when connected with other data.<\/p>\n Studies have shown that the construction sector is behind other industries in cybersecurity. However, in the Dodge survey, 72% of architects, engineers, and contractors claimed to have a moderate or higher degree of preparation for an attack that would cause them to lose access to documents.<\/p>\n The problem is that in a heavily networked industry, a cyberattack on one company on a project can impact several others, including the client. As general contractors are mainly responsible to the client, they should do due diligence on their partners\u2019 cybersecurity. I don\u2019t know how commonly CGs include related provisions in the contracts<\/a>.<\/p>\n Anyway, we need to ramp up cybersecurity in this sector. Craig Yeack<\/strong> from Bulk Construction Materials Initiative suggests<\/a> that construction businesses consider cybersecurity a funnel of three Ps<\/em>: prevention, protection, and preparation. Prevention is the largest piece at the top.<\/p>\n PS.<\/strong> While I wrote this piece, I remembered a trip to Washington, D.C., in the early 1990s. I mentioned Cuckoo\u2019s Egg while visiting an architect who lived there. To my great surprise, he knew the author personally. Not six<\/a>, but one degree of separation this time!<\/p>\n<\/div>\nToday\u2019s threat landscape in construction<\/h3>\n
Recent cyber incidents<\/h3>\n
\n
Why construction is an attractive target<\/h3>\n
\n
Prevent, protect, and prepare<\/h3>\n