Guidelines for cyber assault security are divided into seven areas for construction businesses looking to safeguard themselves against cyber dangers.
- preventing malware from infecting workplace equipment.
- Safeguarding and securing portable devices.
- Password protection is a good way to keep your data safe.
- Effectively dealing with email risks such as phishing.
- cooperating with vendors and business associates
- Incident response planning and response
- To learn more about each of the seven categories addressed by this document, read on.
Backup and Recoveries
A company’s data is its lifeblood, and it must be safeguarded at all costs. Theft of equipment, floods, or fires are all potential threats in addition to cyber assaults like ransomware and other viruses.
Construction companies should begin by identifying the data that is most important to their company and then focusing on it. Backups of critical data are kept in locations other than the network where the original data resides. Storage devices like memory sticks and external hard drives, as well as cloud-based backup options, are all options.
Making backup a regular part of your workflow and ensuring that only the right individuals have access to it and are familiar with how to restore data in the event of a disaster are also critical.
Anti-Malware Programs for Office Computers
There are a variety of ways that malware may harm your system, including stealing your data, rendering your equipment inoperable, and getting the credentials you need to access your software and services. Malware can also be used as a tool to target other organisations.
It is critical that you use antivirus software, only download authorised programmes from reputable sources, and maintain your IT gear and software in order to protect yourself against malware. Keeping your operating system up-to-date with the newest security measures, for instance. Updating your security software is critical in light of the constant emergence of new cyber dangers.
It’s also a good idea to limit the usage of external storage devices like USB sticks and hard drives, which might cause problems when connected to your company’s computers. When working with third parties that have access to your systems and software, it is critical to ensure that access is given securely and monitored to avoid it from becoming an easy conduit for cyber assaults.
Insuring the safety and security of portable devices
It’s becoming more common for businesses to have their operations disrupted and their data stolen via portable devices. It is critical that devices are not left unattended while they are unlocked, have password or pin protection, and can be found or deleted remotely if they are lost or stolen.
The software on portable devices must also be kept up-to-date. Delaying a recommended software update because the device will likely need to be restarted and become useless for a short period of time is all too often.. However, these upgrades often include the most recent security enhancements and should be implemented quickly.
Finally, while connecting to public Wi-Fi, it’s critical that you know exactly what service you’re connected to. There are several ways to do this, including a simple question to the baristas at the coffee shop where you work.
Using Passwords to Safeguard Your Personal Information
Businesses often ignore the need of password security and password storage. It is recommended that all devices have some kind of password or pin protection, and that users be automatically logged out after a certain amount of inactivity. It’s also critical to avoid using passwords that are too easy to guess. You wouldn’t believe how many individuals use the word “password” as their password.
When it comes to passwords, don’t write them down or share them over email or messaging applications, either. There are a number of free password vault programmes that may be used to keep your passwords safe (the most commonly known being LastPass). Users may safely save and exchange passwords using this sort of software.
Finally, 2FA, a more sophisticated kind of password security, may be used. In order to obtain access to their programme, 2FA requires a user to complete a second step, which provides an extra degree of protection. There are a number of ways this may work, such getting a text message with a unique code to access the programme, or visiting an app on their mobile device that provides an ever-changing code.
The Right Way to Handle Phishing and Other Cyberthreats Via Email
Email, SMS, phone calls, and social media are all examples of phishing. Email scams featuring a link are the most typical form of this. The sender’s bank, for example, may seem to be a reputable source in the email’s appearance and feel.
If the link in the email is clicked, malware may be downloaded to the receiver’s device, or the recipient may be sent to a website that seems genuine but really isn’t, where personal information such as passwords, bank account information, or credit card information would be requested.
An educated consumer and company owner are the strongest defence against phishing attacks. It’s critical that everyone in the company knows what to watch out for. Phishing emails often seem real, but a closer check at the sender’s email address reveals that they’re phoney.
In order to trick the receiver into believing they need to respond immediately, these emails typically include demands with a feeling of urgency attached. Employees may even be elicited into an emotional response, for example, if they are made to believe they would be punished at work if they do not comply with the request.
Co-operating with Suppliers and Customers
An assault on your suppliers and collaborators may be as damaging as an attack on your own firm, therefore it’s crucial to emphasise this point. As a result, it is in everyone’s best interest to guarantee that cyber security is a need, not simply a choice.
Businesses in the construction industry should begin by focusing on the most important aspects of their supply chains (generally suppliers and partners who they share the most sensitive data with). To minimise the risk of a cyber attack, make sure they have the proper processes and systems in place.
Cyber Essentials certification is a government-backed industry programme that helps organisations safeguard themselves against cyber threats. This is how many construction companies encourage their suppliers to do business with them.
In the case of a cyber attack, you and your suppliers must have a clear understanding of who is liable for what and how to respond.
Getting Ready for and Dealing with Emergencies
Assaults by malware (and ransomware) are on the rise in the construction sector, making it imperative that your company be ready to deal with any such attacks and react fast.
You can safeguard your company by following the strategies we’ve previously discussed, but cyber assault will still occur. Even while it’s impossible to anticipate every possible cyber assault, there are techniques to prepare yourself.
One option is to make use of the Exercise in a Box product offered by the NCSC. Tabletop and micro-exercises on cyber assault events and assaults may be conducted using the NCSC’s Exercise in a Box.
It allows a company to test its cyber assault preparedness and resilience in a safe environment, and to practise responding to critical incidents.
They can better handle these circumstances if they know where they are at danger, where they need to improve, and what they can do to mitigate those risks.
With our participation in the NCSC’s exercise-in-a-box testing and feedback phase, Eventura was even included in the NCSC’s Annual Review 2020.
When it comes to preparing for cyber assaults, identifying the telltale indicators that you’re under attack is critical. Some of the most typical indicators that a cyber assault has occurred or is occurring include the following:
- Your machines are taking too long to respond.
- They can’t access their accounts since they’ve been blocked.
- Data and files are inaccessible.
- Messages have been sent to you requesting a ransom in order to regain access.
- Emails that you did not send have been received by recipients who believed they were coming from you.
- Searches on the internet are redirected.
- Requests for payment that you aren’t familiar with.
- Any other strange behaviour on your account.
It’s critical that you deal with a cyber assault as promptly as possible if you’ve been the victim of one. This might be a response from internal IT, or it could be a prompt interaction with third-party managed IT partners. Things must be restored as fast as possible in order to prevent more complications.
- Backups may be used to restore services and data.
- Software updates.
- Affected hard drives need to be swapped out.
- Passwords and access privileges may be changed.
- Getting rid of any contaminated equipment.
