Episode Details

Real Estate News - Construction Companies at Risk of Dangerous Cyberattacks

There's growing concern about the possibility of a dangerous cyberattack on automated systems used by construction companies. These programs are used for things like the measuring and mixing of materials used to support large construction projects. Some companies are taking steps now to protect themselves from hackers but cybersecurity experts say the threat level is rising, and the safeguards are lagging behind other industries. (1)

Hi, I'm Kathy Fettke and this is Real Estate News for Investors. If you like our podcast, please subscribe and leave us a review.

White House Warning about Cyberattacks

Just a few weeks ago, the White House issued a warning about a possible Russian cyberattack linked to the Ukraine invasion. U.S. intelligence officials got together with more than a hundred infrastructure companies and industry groups to share classified information related to this threat. (2)

Cyber security researchers from Mandiant say that so-called "threat actors" have developed a set of tools called "Incontroller." They say these tools are "exceptionally rare and dangerous" because they can be used to shut down or sabotage industrial facilities. That includes turning off safety controllers at power plants, for example. Mandiant researchers can't pinpoint the source of this threat but they suggest that the activity is similar to what they say is Russia's "historic interest in industrial control systems."

A Dallas-based contractor that contracts with top-level government agencies promises to "make the world smarter, more connected and more sustainable" but is also increasing its emphasis on cybersecurity. Jacobs has clients like the U.S. Department of Defense, the U.S. Intelligence Community, NASA, the U.S. Department of Energy along with defense agencies for other countries and private sector companies involved with aerospace, automotive, energy, and telecommunications. Jacobs CEO Bob Pragada says: "There is not an infrastructure project right now with major agencies, in the U.S., the U.K., across the world, in Australia, where we don't have a cyber component that's with it." And he says that's becoming a much bigger part of the business.

Contractor's Vulnerability

Let's scale that risk down to the level of the contractor doing the work, in this case the pouring of concrete. Construction Dive explains that a concrete contractor uses automatic control systems to mix and lay the concrete. After the concrete hardens, automatic systems are also used to inspect the integrity of the finished product. These systems rely on internet- and cloud-based software which could make them vulnerable to an attack.

One technology and cybersecurity consultant offered an example of a worst-case scenario. Jason Vigh told Construction Dive: "Take for instance the construction of a bridge, you have to have strength integrity. What if hackers change the systems that are actually being used to automate the project and (the bridge) collapses… all because the supply chain is compromised in the first place." He says there's already a lot of security in place for the financial sector, but when it comes to manufacturing, cybersecurity is lagging.

Precautions Needed for Construction Companies

So far, most cyberattacks in the construction industry have involved ransomware or access to customer data. A northern California concrete contractor, Ghilotti Bros reported a breach in December of last year. It says an unauthorized party gained temporary access to its systems and files. An energy company out of Oklahoma City also reported a data breach a few months ago, according to Construction Dive. Recently, a German company reported a cyberattack that impacted 40% of its wind turbines.

Cyberse