Is your business inadvertently opening its doors to cyber criminals?

Despite rapid technological advancement, the construction industry remains one of the least digitized sectors around the world. This leaves it vulnerable to cyber risks.

Contrary to common belief, cyber loss is not always caused by cyber criminals poking holes in security. Often, it is our own staff who inadvertently them in. Statistics reveal that 88 percent of cybersecurity breaches stem from human error.

An example comes to mind. A former office administrator of mine stumbled upon a quarantined email, seemingly from me. Assuming that the message was safe, she released it into her inbox and promptly approached me. She enquired about the $26,000 payment to a new supplier whom she had not previously encountered.

Of course, the email was a phishing attempt. My employee’s oversight could have led to a substantial loss. However, even though she had access to the banking feeds, we have an additional safeguard in place. Payments require double approval from our finance manager before our office administrator is able to send the money. In this case, our safeguards prevented a breach. However, this example demonstrates the ease with which people can be duped and highlights the potential consequences of this occurring.

Such human risks have escalated since the onset of COVID.  There are three reasons for this.

First, the shift towards remote or hybrid work has introduced new challenges. Employees working from home often contend with greater distractions, whether it’s managing household responsibilities or navigating interruptions. Potentially, this can divert attention from ensuring that email content is safe before taking any action.

Second, heightened fatigue among staff has become prevalent. With businesses grappling to fill vacancies, existing employees are shouldering heavier workloads and longer hours. This can lead to lapses in judgment and can render individuals more susceptible to falling victim to cyber criminals.

Finally, the sophistication of business email compromise (BEC) attacks has reached alarming levels. Malicious emails now closely mimic legitimate correspondence, making them indistinguishable to the untrained eye. Recently, a residential builder recounted an unsettling encounter where clients received fake invoices bearing his company’s likeness – albeit with altered bank details redirecting payments to cyber criminals. Fortunately, his clients were vigilant and called to check. However, the prevalence of such incidents underscores the pervasive threat faced by businesses today.

What can you do? Numerous options are available. However, three measures stand out.

1. Phishing Simulations: What better way to train your staff on how to identify fraudulent and malicious emails than by sending pretend ones to them? These simulations offer a plethora of templates, each designed to exhibit telltale signs of suspicious activity. Comprehensive tracking and reporting mechanisms monitor various metrics. These include read rates, click-throughs, and instances of credential disclosure. This data enables management to provide targeted training and support to individuals. Such training may improve their ability to recognize when any real phishing attempts occur and to respond appropriately. These types of exercises are most commonly overseen by IT or cybersecurity professionals. For this reason, it is advisable to seek professional help when undertaking these exercises.

2. Cyber Awareness Training: In preventing cyber-crime, the importance of worker understanding about IT security cannot be overstated. Online training is one of the most effective means through which this can occur. These courses cover a wide array of topics, from securing home internet connections to creating strong passwords. Some courses are managed by specialized businesses who offer certification upon completion. Nowadays, there are automated courses available too. These start with a test to identify areas needing improvement. The automation then tailors the training accordingly, focusing on the weakest areas first. To enable them to oversee staff schedules and ensure everyone stays on track with their training, management receives reports on completed certifications.

3. Dark Web Monitoring: Every day, we hear about major corporations falling victim to cyberattacks, resulting in millions of stolen personal records. Much of this stolen data ends up for sale on the dark web. Dark Web Monitoring services scan the dark web’s vast databases for stolen credentials like usernames, passwords, and credit card numbers. If your information is detected, these providers alert you immediately. Armed with this knowledge, you can take action to safeguard yourself against identity theft. While this doesn’t directly reduce human error, it empowers us to respond effectively when our data is compromised. This then further reinforces the importance of robust password protection and multi-factor authentication.

Recently, our Dark Web Scan uncovered that a director from a business we support had their details stolen from Canva, which was recently hacked. We promptly advised them to change their password and update it on any other sites where it was used. While IT or Cyber Security professionals typically offer this service, there are also free alternatives like Have I been Pwned, although they may not be as comprehensive.

Your IT Department, outsourced IT managed service provider, or cyber security professional can provide access to these services. I highly recommend utilising uSecure, our preferred platform, which streamlines all three processes at a very cost-effective rate.

By leveraging these tools, you can reduce the likelihood of staff errors and resulting cyber loss. Studies have demonstrated that regular training slashes risks from 60% to 10% within the first year alone. Considering the potentially exorbitant costs associated with breaches, investing in these programs typically yields a remarkable 37-fold return on investment.

The benefit is clear. If you adopt the strategies which are discussed above, your chances of preventing losses from cyber threats will be greatly improved.

Enjoying Sourceable articles? Subscribe for Free and receive daily updates of all articles which are published on our site

Want to grow your sales, reach more new clients and expand your client base across Australia’s design and construction sector?

Advertise on Sourceable and have your business seen by the thousands of architects, engineers, builders/construction contractors, subcontractors/trade contractors, property developers and building industry suppliers who read our stories across the civil, commercial and residential construction sector