Cyberattack security threats are inevitable in a connected world. Any businesses that access the internet or rely on cloud-based networks are potentially susceptible to cyber risk.
Cyberattacks are particularly detrimental if they breach critical infrastructures as they can cripple entire business operations, causing significant financial losses, reputation meltdown, and property damage. It is estimated that one-quarter of all reported cybersecurity incidents affect organisations associated with Australia’s critical infrastructure, such as electricity, gas, water, and ports, with serious consequences for businesses and the community.
Cyberthreats are real and evolving
Critical infrastructure faces ongoing threats. These could be in the form of cyberattacks, disruptions to supply chains, or physical infrastructure attacks. These attacks also help reveal vulnerabilities in IT and operational systems, which leads to the creation of more robust data protection programs. Enterprises use well-encrypted infrastructure project management platforms, like PlanRadar, to achieve better digital security on infrastructure projects.
But hackers also continue to develop more sophisticated methods to circumvent threat detection systems, so the only way to win the war is to scale up before the attackers do.
The target: critical infrastructure
Any assets that, if degraded, destroyed, or shut down, can significantly impact a firm’s socio-economic activity or defence, are critical infrastructure. These include essentials like food, water, communication, banking, energy, and health care and bridges, power stations, data centres, cloud-based construction management software, nuclear reactors, etc.
Damage to these systems could lead to an extended service interruption, which would result in massive revenue losses and impact the community’s general welfare. For example, if a construction company’s document management system were hacked, and its files including BIM models for govt facilities, were corrupted or inaccessible, here’s what might happen:
- All existing projects must be discontinued. Construction relies on accurate data to comply with safety and quality standards. Continuing a project without a comprehensive guide is risky.
- Prolonged downtime costs the construction company significant time and budget, mainly since most job contracts require the company to pay for every day the project is delayed.
- Subcontractors and workers will also suffer a loss of income.
The firm has two plays: wait until the system is restored or redraw the plans from memory. Both options are risky because there’s no guarantee the documents would be recovered, and it’s impossible to remember all the specific details of a large construction infrastructure plan. Meanwhile, stolen sensitive information can be used against the construction company.
From standard malware to ransomware
Cybercriminals are evolving to find vulnerabilities in new, reinforced cybersecurity systems. Instead of simply infecting an organisation’s critical infrastructure with malware to steal valuable data, they may also hold this data hostage and demand a ransom via ransomware.
Ransomware prevents or limits access to the data until a ransom is paid. It may lock the screen, change passwords, or encrypt files to gain complete control. In addition, Ransomware can also be programmed to infect an entire system or select accounts.
Building cyber resilience in critical infrastructure
Achieving robust cybersecurity requires five key steps.
Bolstering legislation
Although the private sector invests in more resilient cloud construction management software and cybersecurity, Australia recently amended the Security of Critical Infrastructure Act 2018, expanding its scope and establishing government assistance powers. Now, finance, communication, and healthcare industries are obligated to comply with stricter regulations. Policy upgrades like this lay the foundation for cyber resilience in critical infrastructure.
Separation and tiering
Network segmentation and separation can limit the damage by separating an IT network from an operation technology (OT) network or corporate intranet. This way, attacks on an OT network won’t debilitate the IT network and vice versa. In addition, separating operation technology processes into tiers further reduces the damage cyberattacks can cause.
Limiting access to essential systems
Data breaches often occur when a project management platform is too transparent. While transparency should be promoted, certain information should only be accessed by select group. Encrypting construction data and restricting access delivers strong cyber resilience.
Multifactor authentication
Multifactor authentication requires more than just a username and password. It requires another factor like a one-time code or biometric, making stolen credentials useless.
Routine security checks and audits
Conducting regular security audits will mitigate the risk cyberattacks. Improving the resilience of critical infrastructures to cyberattacks delivers several benefits. For example, it helps prevent potential damage to assets, maintain business continuity, and preserve clients’ trust.
Also, project management software like PlanRadar, which features construction data analytics and other advanced functionalities, adds value and reassurance to a company’s services.
Bart Crowther is the Regional Lead, Australia for the global SaaS Construction Tech platform PlanRadar. With more than 10 years’ experience in the construction industry, Crowther has worked in a number of high-profile and senior leadership roles for companies such as Aconex, Avoka Technologies, Fujitsu, Kronos and Data#3.
