Products + Services Data Centers Industries Learn About
As is the case with most industries, companies in the architecture, engineering, and construction (AEC) industries have benefitted greatly from technological advances ranging from the Internet of Things (IoT) to artificial intelligence (AI). Also, like in most industries, AEC companies — particularly engineering firms — have seen an increase in cyberattacks due to the expanding attack vector courtesy of those technological advances.
That’s not surprising, given that implementing new technologies and interconnected networks opens up the possibilities of more IT vulnerabilities and more points of entry for an attack — as well as more challenges for IT security teams. But just how pervasive are these attacks — and are the effects really that bad? Consider these highlights of cyberattacks in 2023.
It’s not just engineering companies outside the US getting hit. Three of the eight engineering firms reported as victims of cyberattacks on May 31 in Konbriefing’s list of ransomware and cyberattacks in 2023 were in the US. All three were victims of an exploited vulnerability in the file transfer software MOVEit. That vulnerability is now known to be behind more than 600 other cyberattacks around the world, including one that struck San Francisco, CA-based Gensler, the international AEC giant.
The use of new technologies isn’t the only driver behind increasing the risks and incidences of cyberattacks in engineering companies and related sectors such as architecture and construction. These companies face many of the same challenges other companies do in terms of combatting cyber threats. Among them:
Given that cybercrime continues to evolve and grow — and new threats always appear, it seems inevitable that almost every company in the AEC world can expect to experience some cyber threat eventually. Not being prepared for the inevitable won’t be good. They’ve been noted many times before, but the repercussions of cyberattacks can include:
Combatting cybercriminals isn’t easy, regardless of industry. However, the steps that follow can help strengthen a company’s overall security posture — lessening the risks and repercussions of cyberattacks.
1. Assess cybersecurity resources and risks.
This will be a multi-part exercise. It will require an audit of all IT infrastructure, systems, software, etc (You can’t protect what you don’t know you have). Shadow IT will need to be considered as well.
Look at your current IT security and cybersecurity-specific processes, protocols, technologies, and training programs. You’ll also need to determine all possible scenarios for risks. This will all help identify the following:
2. Take the next steps.
Once the assessment is done, follow up with a report containing recommendations for addressing the findings. Work with outside IT security companies and/or your cloud service provider (CSP) to offer solutions and associated budget numbers. Include information regarding the risks of not making the necessary changes. Making a strong business case for improving your company’s overall IT security is essential.
3. Review of, or development of, an incident response plan (IRP).
IT security incidents happen. It’s imperative to have a plan in place to deal with them when they do. If you have an IRP, review it frequently, test it, and update it accordingly. If you don’t have one, make creating one a priority. Contact third-party companies, such as a cloud service provider like US Signal, to help if you lack the time, resources, or expertise internally.
4. Understand and meet your compliance requirements.
Most regulatory requirements and other compliance obligations entail a certain IT security level. First, ensure you understand which of them you must meet. Then, make sure you meet them by achieving and maintaining compliance. If your organization achieves compliance, it will be better positioned to manage IT security risks.
Each of these following regulations notes requirements with which engineering companies must comply.
5. Extend your IT security and cybersecurity measures to all vendors, suppliers, and partners.
As a normal part of business, engineering companies, as well as those in architecture and construction, must work with a lot of different companies and suppliers. In many cases, they must share data and work with the same IT systems and technologies. Without the right security mechanisms and processes in place, it’s easier for cybercriminals to find and exploit vulnerabilities.
Among the things you can do:
There are many more actions you can take to up your IT security and cybersecurity. And it’s important to remember you can never have too much security. However, what really matters is having the right security in place – when and where it’s needed. In addition to the security built into US Signal’s products and services, we offer a wide range of security services and security advisory services. Our solutions teams will be happy to work with you to identify and assess your security needs and offer solutions for meeting them. Contact us for more information.
It used to be that an organization’s IT disaster recovery (DR) plan entailed simple data backup (on disk or tape) or, budget-allowing, a secondary data center that it could failover to if a disaster occurred. The introduction of cloud DR has expanded the options. Choosing what’s best for your company requires [...]
Expect to see the cybersecurity landscape continue to change throughout 2024. There will likely be increased regulatory scrutiny at the federal and state levels over the coming year as government authorities seek to encourage prompt, accurate, and complete disclosure of security threats and management-level preparedness. [...]
A majority of our daily lives involve interacting with various technologies. And in the course of those interactions, most of us seldom think about the actual technologies involved — unless they aren’t working or need to work better or faster. In those instances, we expect some form of “tech support” to help. [...]