{"id":86999,"date":"2021-01-06T15:22:26","date_gmt":"2021-01-06T15:22:26","guid":{"rendered":"https:\/\/www.pbctoday.co.uk\/news\/?p=86999"},"modified":"2024-06-28T10:49:51","modified_gmt":"2024-06-28T09:49:51","slug":"information-security-construction","status":"publish","type":"post","link":"https:\/\/www.pbctoday.co.uk\/news\/digital-construction-news\/bim-news\/information-security-construction\/86999\/","title":{"rendered":"Information security in the construction industry"},"content":{"rendered":"

Cybersecurity isn\u2019t something traditionally associated with the construction industry. But, as the industry moves forward, it\u2019s no longer just a case of making sure offices and building sites are secure from thieves<\/h2>\n

Construction software specialist, Viewpoint<\/a> takes a look at everything you need to know about information security in the construction industry.<\/p>\n

Whether you are in the construction industry or not you are likely to be aware that cybersecurity threats<\/a> are on the increase, with the worst cases featuring in the media with alarming regularity.<\/p>\n

Lower profile issues impacting smaller companies rarely make headlines which could lure you into the misconception that data breaches only affects the big corporations. However,\u00a0Verizon Data Breach Investigations Report<\/a>\u00a0(DBIR), noted that 43% of cyber-attacks in 2019 were targeted at small businesses.<\/p>\n

As the construction industry moves forward, rapidly embracing new technology almost every day, the risks are becoming more pervasive. It\u2019s no longer just a case of making sure offices and building sites are secure from thieves.<\/p>\n

The digitisation of the construction industry now means vast amounts of highly-sensitive data including building models, documents, drawings and personal data are being processed, stored and shared. Industry processes are increasingly built on software systems<\/a> and rely on the availability of those systems to ensure swift communication and auditable records. Outages and data breaches can have severe consequences. Among them: business interruptions and loss of revenue; time and productivity; operational stability; and brand equity.<\/p>\n

The increase in highly sensitive data has required more attention and action. The construction industry, after lagging behind for many years saw an increase in spending on cybersecurity of 188% in 2018-19, according to government data analysed by\u00a0Specops Software<\/a>.\u00a0Increase in spending is positive news but ultimately having a well thought out risk mitigation strategy is key to minimising exposure.<\/p>\n

Cybersecurity strategy<\/h3>\n

Cybersecurity is no different from any approach in business; there isn\u2019t a gold standard way of doing things that will work across all companies and industries. Your strategy needs to be appropriate to the size of your business and the potential risks you may encounter. This being said, we will look at the action you should consider taking as a starting point.<\/p>\n

Certification by independent authorities is a good way to increase your own confidence and minimise risks. For example, the UK government\u2019s National Cyber Security Centre (NCSC) provides the\u00a0Cyber Essentials scheme<\/a>, which provides a solid framework to assess your cybersecurity defences and gain a certification which will help protect your business against threats. Importantly it will also give you, your staff, suppliers and customers a level of confidence in your commitment to cybersecurity. The basic certification can be achieved with as little as \u00a3300 investment (at the time of writing<\/em>).<\/p>\n

A more comprehensive certification is also available called \u2018Cyber Essentials Plus\u2019. This is a more in-depth assessment that involves auditors visiting your site and testing your internal assets. Initial attempts to meet the standard should not be seen as failures but rather as a methodology to uncover weaknesses and improve. Knowing where your weak points are is part of the path to improvement. It’s important to keep going.<\/p>\n

Certifications under Cyber Essentials last a year and you will need to be re-certified to help ensure your cyber defences are kept up to date \u2013 further demonstrating your on-going commitment. The five technical controls within the basic scheme when implemented helps protect your organisation from a majority of common cyber-attacks<\/a> and tighten security. These five basic controls are firewalls, secure configurations, control user access, anti-malware and phishing.<\/p>\n

If you already have these certifications, it may also make sense to attain internationally recognized certifications but note that these require significant investment and on-going commitment. Two examples are:<\/p>\n