Construction Industry Begins to Prepare for Cyberassault

Brief 

|Digital automation associated with construction materials makes contractors vulnerable to hacking that could threaten the strength and integrity of structures. The construction industry’s reputation for lax cybersecurity practices makes it an inviting target, but some companies are making the investments needed to protect themselves.

Insight

Cybersecurity experts caution against something far more foundational than ransomware attacks or private data thefts when it comes to threats in the construction sector: Their eyes are on the security of building materials.

“Take for instance the construction of a bridge, you have to have that strength integrity,” said Jason Vigh, principal consultant for 1898 & Co., a Kansas City, Missouri-based business, technology and cybersecurity consulting firm. “What if [hackers] change the systems that are actually being used to automate [the project] and it collapses… all because the supply chain is compromised in the first place.”

Construction companies use automation during the mixture and measurement of materials or chemicals going into a manufacturing process. For example, a concrete contractor uses control systems to mix the cement and lay the concrete.

During the post-manufacturing process, construction pros use automation to test the structural integrity, such as surface hardness inspections, load testing and surface absorption checks.

The processes that go into the mixture and measurement of construction materials are vulnerable to cyberattacks because they use internet- and cloud-based technologies that have minimal defense parameters. If compromised, a cyberattack on these technologies could cause havoc that goes much further than companies’ wallets.

These automated systems leave tempting holes for cyberattackers to compromise, cybersecurity experts say. That means material failure is a real possibility if the systems become an attacker’s target.

Threat level rising

The attention on materials security comes as the Biden administration recently warned companies to harden their cyber defenses, as evolving intelligence shows Russia could launch a retaliatory attack against the U.S. and its allies. While the White House did not share specific targets, its steady stream of cybersecurity warnings are meant to harden critical infrastructure security.