Cyber risk: Don’t lose sight of the information

Design and construction industries and those in their supply chains can be vulnerable to cyber threats, without realising it. Simon Rycroft, co-founder and director of the Cyber Risk Management Group (CRMG), runs through the simple things firms can do to protect their assets.

The construction industry is notorious for its reliance on complex supply chains. Entire chains of partners and suppliers collaborate to produce the urban landscapes of tomorrow. Unsurprisingly, of course, there’s a comprehensive legal and regulatory ecosystem that’s grown up with it, along with mature frameworks for managing traditional forms of risk.

But what about cyber risk? We know from experience that the supply chain often represents a hidden back door by which cyber threats can wriggle their way into the organisation and cause untold mayhem (trawl the internet and you’ll find horror stories of air conditioning suppliers compromising corporate networks, or of business partners deleting critical shared information due to human error). 

In industries such as design and construction, no business can afford to lose sight of its critical information assets – whether they are under your own direct control, shared with a business partner, or sitting in the ether somewhere as part of some cloud-based solution.– Simon Rycroft, Cyber Risk Management Group

We also know that even the most cyber-mature organisations can struggle keeping their supply chains secure. In essence, the problem is that while an organisation might have gone to considerable lengths to secure information under its own direct control, in many cases it might have limited capacity to do so beyond its corporate perimeter. Unless, that is, the right mix of risk management, legal, and technical safeguards are put in place. And that’s the tricky bit.

You can’t assume that because you’re using a complex cloud-based system, everything is totally secure. In its Cloud Adoption and Risk Report 2020, McAfee reveals that the number of remote attacks targeting cloud services increased by 630% between January and April this year.

Let’s go back to basics for a moment. Irrespective of the futuristic labels that festoon the cyber world and the security technologies that accompany it, don’t forget that really it’s still all about information. Since the dawn of civilisation information has accrued value for its owner. It delivers competitive advantage. It’s intelligence about our customers that enables us to sell services to them without incurring undue risk.

It’s the blueprint for the self-sufficient eco-development that earns plaudits from urban planners and design gurus alike. But information has a nasty habit of seeping all over the place. Think of information as water that trickles throughout the arterial canals and rivulets of your organisation. Well channelled and protected, it enables the business to thrive. Leave a sluice gate open inadvertently and – to mix metaphors – you’re toast.

The main point here is that in industries such as design and construction, no business can afford to lose sight of its critical information assets – whether they are under your own direct control, shared with a business partner, or sitting in the ether somewhere as part of some cloud-based solution. So irrespective of how well you think you’re on top of the cyber threat, make sure – at a minimum – that your business is acting on the following:

• Embark on an information discovery exercise. At its simplest, this might start with a map of your key business processes and information systems that support them. Don’t forget to explore instances where information is stored in the cloud and, just as important, to identify where information is shared outside the organisation.
• Once you have your basic map of what information lives where in your organisation, it’s a good idea to have a crack at valuing it in some way. What information, whether it be for example designs, operating plans or databases, is critical to your business’ success? Only once you know this does it make sense to assess the adequacy of cyber security measures needed.
• Check whether you’re sharing valuable information with suppliers or business partners. Can you be confident they’re protecting it adequately once it moves beyond your control? This is where fit-for-purpose contracts are really important, as you might need to set out minimum levels of security the third party should work to, and in more critical cases it’s usually a good idea to reserve the right to audit their cybersecurity arrangements.

Take the temperature on your basic cybersecurity hygiene by asking the following questions:

• Do you understand the nature of the cyber threat in the context of your own business and the information it holds?
• Do you have a fit-for-purpose cyber security policy?
• Do employees understand the cyber security policy, and do they behave in a cyber-secure way?
• Are all systems kept patched, and is anti-malware software kept updated?
• Are staff provided with access to systems only if they really need it?
• Is particularly sensitive information encrypted?
• Are backups taken and tested regularly?
• Do you have business continuity and disaster recover procedures (even if basic) that support business as usual in the event of an incident? (Covid-19 has rammed the importance of this one home!)
• Have you commissioned a penetration test of your systems, and applied any recommendations made?

What is listed here represents a minimum set of activities any business should be undertaking if it’s even mildly serious about cyber security (and of course many large organisations will be doing way more in terms of cyber governance and risk management). If you’re not sure your business could answer any of the above questions confidently, maybe it’s time to take a much closer look.

[email protected]

Main image: Kanawat/Dreamstime.com