As a construction business employing modern technologies, you might feel safe in the knowledge that the bulk of your operations take place offline and therefore assume that you are less vulnerable to cyber threats than businesses in other industries.

However, here we look at just a few of the tools you might be using day-to-day, and how they could be affected by a cyber-attack:

• BIM (Building Information Modelling), 3D Printing, or CAD programmes – hackers could potentially change digital models and specifications to ultimately weaken the structure, posing real physical danger to your onsite employees and end users. They may even steal proprietary designs, impacting your competitiveness in the market.
• Drones – popularly used in surveying, access to drone footage risks exposing commercially sensitive information such as site safety measures or building layouts.
• Staff management software – unauthorised access to your staff’s shifts, employment information and personal details could result in anything from a muddled rota to identity theft.
• Secure entry systems – security card passes are at risk of being cloned and digital locks could be controlled remotely, potentially locking employees out or allowing unauthorised personnel in.
• Customer information – Bank account numbers, sort codes and email addresses are just some of the data you’ll be holding on your customers. When this is compromised, you risk real harm being inflicted upon them by malicious actors. There’s also the embarrassment of having to inform customers of what happened, impacting the organisation’s reputation
• Cloud-based software – the increased accessibility of cloud-based applications means an increased number of access points that cybercriminals could exploit.
• IoT (Internet of Things) applications – IoT devices introduce a proliferation data without the security and visibility of more conventionally connected equipment, making them prone to hijacking and exposing the wider network to threats.

There is unfortunately a long list of reasons why a cybercriminal would be interested in a small business. Mainly because small businesses house a lot of data, contracts, contacts, employee details and financial details, all of which are of interest to those with nefarious intentions.

How can I increase my construction businesses cyber resilience? We recommend taking the following steps to ensure your business and reputation are protected and customers are assured they can trust you with their data:

• Create an information security policy – you’ve already trained your employees on what to look out for, but they still pose a major risk to your business’ cyber security. Whether it’s using personal devices, connecting to personal accounts on work devices or even just saying the wrong thing to the wrong person externally, there are myriad ways your staff may expose your business to online threats. A well-written policy will define how company IT assets can be used and what constitutes inappropriate use and will ensure everyone knows what they must do or avoid doing to protect themselves and your organisation.
• Encrypt sensitive data & secure communications – do you use messaging applications to communicate with your staff? These channels are a hotbed for hackers - previous exploits include the installation of surveillance software, phishing, and account hacking. Protecting data where it is vulnerable is integral to cyber security, and internal communications are often overlooked in this regard.
• Conduct vulnerability scans – this process is recommended at least once per quarter to detect any weaknesses in the system. Proactively identifying vulnerabilities allows you to fix issues before external attackers have a chance to exploit them.
• Conduct penetration tests – commonly known as a “pen test”, this ethical hacking tool is used to analyse the strength of your organisation’s IT security by employing the same methods a cybercriminal would use to break through your defences.
• Create a business continuity plan – by planning your response to cyber incidents in advance and developing a strategy for recovery, you increase the likelihood that your business will be able to resume operations in a timely manner, thereby lessening the financial and reputational impacts of the attack. A well-managed response can also increase trust and confidence with your customers and stakeholders.
• Control access to systems, data and administrator roles – staff should only have access to information that they require to carry out their work, thus restricting sensitive data to a select group of users. This ensures accountability and traceability for information and can deter employees from leaks as data can be tracked back to the source.

Join the as a Core Member for FREE today

Since launching core membership the Cyber Resilience Centre for the West Midlands has supported over 300 businesses spanning businesses of all sizes and sectors. Become a member today to receive free guidance and support on how to prevent cyber-attacks but without the jargon. Find out more about us and the team at www.wmcrc.co.uk.

Thankfully the Cyber Resilience Centre for the West Midlands is here to make sure you’re on the right path and offers a FREE core membership that gives you access to a range of free resources, toolkits, tips and support.

Alternatively, talk to us directly and cement the foundations for your cyber security today.