As contractors embrace transformative digital technologies, robust cybersecurity systems have become crucial for Australian construction business operators.

The added responsibility can be overwhelming, but essential. This article details the key aspects of cybersecurity and compliance, as well as practices contractors can take to protect sensitive data.

Common construction cybersecurity threats

Digitisation technologies are prevalent in the construction industry and offer the benefits of increased efficiency, productivity and profitability. Cyber criminals have taken note of the amount of data collected and shared online, and these data hackers continuously seek entry points to steal sensitive information such as proprietary designs, financial data and employee records.

According to this 2023 IBM report, the average cost of a data breach in Australia had grown by an astounding 32% in the preceding five years up to AUD$4.03 million. According to the Australian Cyber Security Centre, in the 2020-21 financial year, there were 67,500 cybercrime reports in the construction industry with losses exceeding AUD$33 billion.

Phishing scams, where criminals act as a trustworthy entity to steal sensitive information – often via email – comprise more than 22% of breaches against Australian construction companies. Notably, the Australian Cyber Security Centre issued an alert to all construction companies in 2021 revealing they were being targeted by cybercriminals using business email compromise (BEC) scams, leading to lost control of bank accounts.

The second most common breach is ransomware, comprising 17% of attacks. During a ransomware attack, cybercriminals encrypt critical files and demand hefty ransoms for their release.

Employee error is the leading cause of a cyberattack. An employee untrained in security risks can leave passwords on a sticky note or open a suspicious email. Further, a malicious insider could leak or sell sensitive data. These events can have grave consequences. While all industries are subject to these and other cyberattacks, they affect the construction industry in specific and compounded ways.

The impact of cyberattacks on construction operations

The interconnected nature of construction projects amplifies the impact of security attacks. A successful cyberattack on a construction company can cause delays or permanent disruption to a project. These halts can stretch out to hundreds of days leading to mounting costs and paralyzing a business.

Companies can be fined millions for inadequate data protection, and the average recovery cost for a data breach annually rises. To decrease data breach risks, contractors are expected to follow the rigorous security standards set by their clients, investors and regulatory bodies. A breach of trust resulting from a cyberattack can tarnish the reputation of a construction company, leading to lost contracts and diminished market standing.

Mitigating risk

Contractors have viable options for protecting construction cybersecurity and building operations. Strategies for safeguarding sensitive data include these security measures:

• Create secure backups of data, both on-site and cloud-based. This allows data to be restored in the event of an attack and enables work to continue uninterrupted.
• Apply strict access controls and user permissions so only authorised personnel can access sensitive data. Use role-based access control (RBAC) for added security.
• Implement data encryption and secure network architecture including firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS).
• Review the security practices of your third-party vendors and contractors who have access to your data and ensure their cybersecurity measures meet your standards.

Build a cybersecurity culture. Cybersecurity protection in construction requires every employee at every level to be fully engaged and actively vigilant. Construction firms should prioritise employee education and training initiatives to foster a cyber-aware workforce. Create and regularly update your incident response procedures and policies. Policies should include a decision-making framework, ransom payment criteria, legal avenues, construction compliance requirements, and if possible, cyber insurance.

Train employees. Also, regular training should be mandatory for all employees and cover these topics:

• Recognising phishing scams;
• Password management;
• Safeguarding sensitive information;
• Regular updates on the latest threats;
• Regular cyberattack drills, so employees know what to do in the event of an attack.

Cybersecurity Best Practices

Educate employees about data security best practices. Employees are the first line of defence against cyber threats. Best practices include regular assessments and following data privacy protocols.

Conduct regular compliance audits and assessments. The Critical Infrastructure Protection Act 2018 was updated in 2022 via the Security Legislation Amendment Bill (SLACI) in response to spiking cyber attacks on Australian infrastructure assets. Companies focused on cybersecurity – especially companies who want to be eligible for government contracts – will ensure adherence, which requires regular review of business practices and following cyber risk protocols.

By Andrew Tucker, Trimble