Cyber-attacks have threatened every industry vertical worldwide, with infrastructure and development companies hit more than most. Construction firms are vulnerable to attack because of the various legacy systems along their supply chains. Older hardware and software exist everywhere in the industry.

Construction may not suggest a likely target with thousands of asset-filled healthcare and financial service businesses available. Construction is hit hard because of its limited employee awareness across various antiquated supply chains.

Ransomware has become highly effective in the industry, with attacks rising considerably in recent years. Assaults are more sophisticated and targeted to every market niche in the sector.

Cyber attackers have focused their attention on construction due to lax security from virtually every firm in the industry. Most firms ask, Why Us? We have limited to nothing worth plundering. As it turns out, the industry has plenty to offer attackers. Statistics associated with the attacks are bearing this out.

1 in 6 construction companies reported a ransomware attack at some time in the last year
Cyber-attacks have a success rate of 74% as compared to 42.5% for all other industries
Ransomware payments made by individual companies averaged $220,300 per incident
In a typical data breach, construction firms lost 15 operational days per employee

Construction as a Target

Every vertical is under assault by sophisticated hackers. Why is construction singled out? Companies throughout the supply chain are cash-rich and regularly under the gun to meet building deadlines.

Building and design firms are vulnerable due to their predictable schedules. Ransomware, phishing, and service denials have an easy time calculating when to attack mobile devices and data systems.

Lots of employee information, bank accounts, and SS numbers are available on old computer networks
Proprietary and expensive home and commercial construction designs
Bid data on all types of projects
Profit/loss information on each hacked company plus the supply chain is openly available
Banking records of each company, employee, and vendor are readily available

Rapid growth in the overall economy has made cyber attackers look hard at the building industry. Another point made earlier; attacks into one system have a path to countless other networks.

Fast-growing companies have the most to offer or surrender. With growing organizations, cyber security is frequently left in the dust, and firms end up paying for their oversight.

The construction industry as a whole has regularly played catch-up on cyber security. The disparate structure of the industry, with only a few firms having the skill sets or funds to invest in security against cyber attackers.

The largest construction companies should show the same intensity of safeguarding against ransomware attacks as they do minimal employee safety measures. Lax attention to either one is a recipe for disaster.

Some of the best news coming out of the industry; company leaders from the most prominent building firms are leading cybersecurity discussions. Industry associations are taking point and facilitating the conversation for better defense.

MCAA
NECA

Construction firms must start from the ground up with a cyber security plan of action. These elements should develop into a solid infrastructure for the entire industry. As more and more companies recognize the importance of cyber issues, the finest third-party vendors will concentrate their resources on the defense of malware, ransomware, and phishing code.

Easy Deception

Scams start as compromise frauds, with a legitimate email addressed to any number of unsuspecting employees. Or an email blast is disguised as an invoice or some other everyday money transfer communication. Without suspecting deceit, employees deliver the cash into a cyber attacker’s account.

2019, roughly $1.8 billion was blindly given to cyber attackers’, according to the FBI’s internet crime report.

How Does Ransomware Work on a Construction Firms’ System?

Ransomware gains entry through unsuspecting emails, and code spreads throughout the network, encrypting files as the code spreads through the network and then demanding a ransom to free up the information.

Malicious emails containing links to a website or a download link addressed to several employees. If the employee falls for the scam and opens the email, the ransomware is downloaded and executed on the user’s computer system.
Another means for ransomware to get into a computer system is by Remote Desktop Protocol or RDP. The attacker has employee credentials by stealing or guessing at the login. Once the system has been breached, the attacker downloads the malware and executes the code.
After the malware has gained access, the code starts to encrypt files. Most systems have built-in encryption, so any company files are encrypted with the attacker’s control key. The ransomware picks and singles out the most profitable or sensitive files to encrypt while ensuring the system remains stable.
Once the encryption process is finished, the ransomware is prepared to make demands. Different variants have dissimilar methods for ransom demands. Typically, attackers demand cryptocurrency deposited in offshore accounts in a specific time frame. If paid, the attackers release the system. If the ransom is not paid, attackers destroy the files or bring down the entire system.

Stolen Credentials

Contractors generally have lax standards when dealing with their clients or other contractors. Many times they hold open communication portals for bill pay or construction management projects. These lackadaisical standards constitute a clear channel for aggressive attackers. Easy access to a contractor’s system allows attackers to ransack any sensitive document they choose.

Small to mid-size contractors are frequently oblivious to the hazards they face or how to stop the invasions. Phishing scams, distributed denial of service, and ransomware are experiencing a meteoric rise in every industry operation.

Easy Targets?

In the initial days of the pandemic, development firms migrated their employees to remote protocols almost at once. These distributed operations left many company’s IT professionals unaware of the cyber gaps they left behind.

The proliferation of mobility within every industry niche contributed to massive oversights. In the turmoil of shifting their employees, IT departments struggled to secure servers and data centers. Unfortunately, there was not adequate security.

In its many designs, building and planning development is unique in that it utilizes various suppliers, sub-contractors, and dealers, with money pouring in from all directions. Construction is also part of government budgets and conglomerate bidding processes involving smaller unknown companies.

The details of a bidding contract are generally kept secret until the winner is announced. Significant and extensive bids include winners, losers, contractors, and specific cash amounts. This entire decades-old framework makes any construction project a profitable target.

Like other industries, construction firms and their supply chains will never completely ward off a cyber-attack: more investment and a substantial awareness of the obstacles the industry faces are needed.

Implementation

Construction firms, no matter their size, must have a Prevention-First mindset. By the time a piece of malware is discovered on your computer or network, It’s Too Late! Firms must have robust mechanisms in place to “Protect the Castle” from the interior. Instead of moats and towers, an organization must use VPNs, anti-virus, and physical disciplines.
Most construction companies should start from the ground up to create a stable framework. A Network Security Audit should be one of the initial steps any firm must select. Knowing where the weak link is in the process is vital. An audit can forewarn you of updates that need to be carried out and warn you of possible security issues.
Contractor communications are usually unstable and famously unsecure. Building firms rely heavily on sub-contractors for bill payment and sourcing; this component usually opens the gate to attack. Ransomware, phishing, and service denial attacks launched through one system are quickly passed on to numerous other organizations on the network. To secure a money moving process, the company’s team must establish stable and secure communications with other firms to have the same protection protocols.
Development firms and their working systems are generally unreliable and noted for having no cyber security plan. If you discover your business is in this position, the first action should be to bring everything on the network up to date. Regular patching and updates require adherence to security. Failing to do so can again lead to disaster.

Patching computer systems and networks is crucial. Cyber attackers often seek out the most accessible uncovered sections for assault. Building companies and supply chains must stay updated with the latest and greatest hardware and software components. Potential vulnerabilities will be diminished.

Employee education is invariably a part of every cyber security must-do list. Accidentally clicking a phishing email or ransomware attack is made a lot simpler by the uninformed employee. To combat the growing threats, every firm needs to train its employees in the correct way to manage its system.

Cyber education is explicitly needed for ransomware and malicious code circumstances. Educating employees is always a great idea. However, ensuring they are trained in how attackers get into a company’s computer is critical to success.

By now, every business should have a data backup plan. Unfortunately, that is generally not the case. In an assault, backups serve as the sole means of bringing back a system to its original working condition. Make certain you use multiple software approaches to improve results. Snapshots and replication ensure data is quickly brought back. Relying on a quality third-party vendor is an educated choice.

Ransomware

Modern ransomware attacks began in 2017 with the WannaCry code. These large-scale attacks exposed to the world the accessible routes by which attackers could enter a firm’s framework and attack. It demonstrated all too well; how profitable ransomware could become if adequately managed.

As corporations, particularly building and design, pivoted to remote work, ransomware exploded in popularity. Ransomware attacks surged by over 50%

Deadly variants:

Ryuk
Maze
REvil si one of the most well-known and destructive ransomware groups on the net. REvil has evolved to become a devastating ransomware variant.
Lockbit
DearCry

Protection

The actions above described construction systems without a cyber security policy and ransomware is a different beast entirely.

Bringing network systems up to standard is required in this modern age, and it should be only a part of an overall comprehensive plan of attack. Preparing a system for malicious code is not easy.

Proper preparation can dramatically cut down the occurrences of attack. Utilize the following tips to help reduce vulnerability to malicious code.

The use of a robust user identification process is highly effective for any business. Attackers are constantly finding easy entry to a network by stealing user credentials.
Ransomware attacks are created, so companies cannot access their data once the attack has started. Real-time data backups are an excellent solution for larger enterprises. Maintaining a regular habit of backing up company information is key to winning a malware attack.

What To Do if Your Systems are Infected

No one wants to see a note on their screen demanding cryptocurrency, or a complete shutdown of the system is next. If the menace is real and ransomware or malware is on your computer, again, it is too late to stop it.

However, here are a few tips to use if you recognize your network is infected:

Immediately quarantine the machine or network if feasible. Malware spreads to alternative systems on the network immediately. Limit the broadcast by eliminating the connection.
If your files are encrypted, check with the “No More Ransom” site to determine if any decryptors can run on your files. Run the decryptor on your machine to see if it works.
Do not turn off the computer. Encryption may make the system unstable, turning it off, and it may not turn back on.
Format the drive in question and restore the drive from a clean backup or operating system installation.

Let BACS IT Help Protect Your Data – Call Us Today

It is essential that you have the right IT services set up for your company, no matter what type of industry you operate in. For help creating a security plan for your company, turn to the experienced IT consultants of BACS IT. We are here to help keep you and your data safe.