flexiblefullpage
billboard
interstitial1
catfish1
Currently Reading

What AEC firms should look for in a cybersecurity partner

Security and Life Safety

What AEC firms should look for in a cybersecurity partner

When looking for expert partners in cybersecurity, AEC firms will find quite a lot of companies claiming to be at the forefront of modern threats. Here are five key points to look for when choosing a cybersecurity firm.


By Michael Smith, Director of IT Operations, HKS Inc. | July 5, 2022
What AEC firms should look for in a cybersecurity partner Photo Shutterstock
Photo: Shutterstock

The architecture, engineering and construction (AEC) industry is increasingly reliant on technology and the use of online networks to share project/client data and connect to third-party supplier networks, often doing so remotely from job sites. As we become more digital – the incorporation of several digital tools, technologies, and methods such as robotics, data analytics, additive manufacturing (AM), artificial intelligence (AI), internet of things (IoT), machine learning (ML), and drones – also means we are increasingly susceptible to cyber attacks. 

Past reported incidents include unauthorized access of a major retailer’s network through the mechanical contractor doing retrofit work on the HVAC system which lead to the exposure of about 40 million debit and credit card accounts, a data breach of personal sensitive information of employees of two well-known United States based construction companies, and compromised trade secrets of a construction elevator and escalator manufacturing firm.

Construction and related firms are not highly regulated, and since they haven’t historically been an “obvious target” for bad actors, the industry is often managing increasing cyber risk against unrealistic expectations. With multiple partners working together on a project, and the average cost of a data breach of $5.2 million, we cannot afford to simply put up the basic security walls any longer. More effective, customized security programs must be put in place. 

When looking for expert partners in cybersecurity, you’ll find quite a lot of companies claiming to be at the forefront of modern threats. I believe there are five key points to look for when choosing a cybersecurity partner to protect your livelihood and help security professionals sleep  at night. 

  1. Get a Partner, Not a Vendor: During the “interview” process, make sure you are getting a team behind you that will not just provide a service, but will be incorporated into your team for the long-run. A cybersecurity partner needs to feel they have skin in the game and you need to do a gut check against this metric. How invested do you feel they are in your success? We have had multiple occasions where we’ve asked our provider to investigate a threat that did not present itself by typical indicators of compromise. In every instance they went above and beyond what I would have considered a reasonable response. If they don’t consider an attack on you an attack on them, then you might want to reconsider those relationships. I want to be able to take a vacation and know that I have my own sheepdog guarding the chicken coup from the proverbial wolves!
  2. Customization and Flexibility: There is great need for customization of a cybersecurity program in the AEC space. Our industry is highly fragmented and any one project could include a dozen or two dozen different firms each doing a different piece of the construction puzzle. Files are transferred back and forth among all firms and that transfer must be quick and easy – and secure. Additionally, today’s contracts are demanding stricter cybersecurity principles including 24 hour breach notification, endpoint protection, multi-factor authentication, and more. A cybersecurity partner needs to be able to take each new project in stride, building a customized program protecting all endpoints, while being able to understand the speed and ease the AEC industry needs in transferring large files.
  3. Speed of Detection and Response: An effective cybersecurity approach needs to ingest endpoint, network, log, cloud, asset and vulnerability data that enables complete attack surface visibility 24 hours a day, seven days a week. We recently had a partner firm on a project infected with ransomware. Within the same day, our cybersecurity partner, eSentire, had a full report in hand. With a team of experts actively hunting for threats across the entire AEC environment, our mean time to containment (MTTC) is normally a mere 15 minutes, allowing work to stay on schedule. 
  4. Bringing Strong Relationships to the Table: Having pre-arranged relationships with top notch other security vendors is a critical component to a strong cybersecurity partner. With relationships in place, our cybersecurity firm (in our case eSentire) vouches for me and connects us with best in breed partners such as CrowdStrike, Microsoft and Sumo Logic without our team needing to do all the heavy lifting to fill in all the blanks of an Managed Detection and Response program.
  5. A Culture of Innovation: Take a hard look at a potential security partner’s culture of innovation. Do they win awards for innovation and do it with a spirit of humility? Are they always pushing forward? Are they constantly re-evaluating their own offerings and processes? What are they doing behind the scenes to bring forward innovative and timely threat intelligence and are they sharing it with the industry-at-large to improve outcomes for all? Threats are changing all the time and a partner should have a culture of change to keep up. 

With the right partner in place, the growing threat of cyberattacks on AEC projects can be effectively mitigated. Generally speaking, however, our industry needs to do a better job bringing a real-world cybersecurity perspective to each project, with an eye toward why certain designs can or cannot work. It’s critical we work within modern threat landscapes, while doing our best to not alter an artist’s design and vision. This means a robust cybersecurity plan and the ability to proactively detect, disrupt and remediate cyber threats anytime and anywhere. 

ABOUT THE AUTHOR
As an experienced leader in Information Technology operations, Michael Smith has a demonstrated history of fostering innovation within the Architecture & Engineering industry, leading high-performing teams to support and secure all enterprise infrastructure and endpoints. Skilled in operations and business process improvement, Michael has successfully grown within the sector and is currently the Vice President & Director of Information Technology Operations for HKS, an interdisciplinary global design firm that is on a mission to become one of the most influential firms in the AEC industry. Michael’s positive, humble and people-oriented perspectives foster alignment between the technology portfolio and the firm’s overall business objectives which translate into increased revenue and tangible enterprise value. 

Prior to HKS, Michael held key leadership roles for companies like Lockheed Martin, Carter & Burgess and most recently with engineering heavyweight Jacobs. Michael has law enforcement experience as a former Security Police Officer with the United States Air Force where he graduated from the USAF Law Enforcement Academy with Honors. Michael also holds an Associate’s Degree in Global Business Management.

Related Stories

| Aug 11, 2010

Pella introduces BIM models for windows and doors

Pella Corporation now offers three-dimensional (3D) window and door models for use in Building Information Modeling (BIM) projects by architects, designers, and others looking for aesthetically correct, easy-to-use, data-rich 3D drawings.

| Aug 11, 2010

AAMA developing product-based green certification program for fenestration

The American Architectural Manufacturers Association is working on a product-based green certification program for residential and commercial fenestration, the organization announced today. AAMA will use the results of a recent green building survey to help shape the program. Among the survey's findings: 77% of respondents reported a green certification program for fenestration would benefit the product selection process for their company.

| Aug 11, 2010

Draft NIST report on Cowboys practice facility collapse released for public comment

A fabric-covered, steel frame practice facility owned by the National Football League’s Dallas Cowboys collapsed under wind loads significantly less than those required under applicable design standards, according to a report released today for public comment by the Commerce Department's National Institute of Standards and Technology (NIST).

| Aug 11, 2010

An Innovative Energy-Absorbing Anti-Terrorism Crash Barrier for Homeland Security

Anti-terrorism physical barrier techniques and applications have become highly desired to protect critical facilities and human lives in recent years. Based on in-depth review and practices, the systemic criteria are proposed here for selection of security barriers specifically against terrorist attacks with truck-borne explosives.

| Aug 11, 2010

NoricF4 custom metal ICF frames receive fire ratings, comply with antiterrorism standards for buildings

Reward Wall Systems' NoricF4 Custom Metal ICF Frames have received fire ratings of 1.5 hours to 3 hours and they have been evaluated to be in compliance with the prescriptive requirements of the Department of Defense Minimum Antiterrorism Standards for Buildings for blast/force protection.

| Aug 11, 2010

Embassy's dual façades add security and beauty

The British government's new 46,285-sf embassy building in Warsaw, Poland's diplomatic quarter houses the ambassador's offices, the consulate, and visa services on three floors. The $20 million Modernist design by London-based Tony Fretton Architects features a double façade—an inner concrete super structure and an outer curtain wall.

| Aug 11, 2010

Robotic storage facility protects exotic automobiles, fine wines, artwork

Miller Construction Company, Fort Lauderdale, Fla., has completed construction on a high-tech robotic storage facility designed to store and protect valued possessions such as exotic automobiles, fine wines, artwork, and jewelry. Designed and built to resist Category 5 hurricanes, the RoboVault facility features automated storage retrieval, biometric recognition, private access with 24/7 securi...

| Aug 11, 2010

AIA Course: Historic Masonry — Restoration and Renovation

Historic restoration and preservation efforts are accelerating throughout the U.S., thanks in part to available tax credits, awards programs, and green building trends. While these projects entail many different building components and systems, façade restoration—as the public face of these older structures—is a key focus. Earn 1.0 AIA learning unit by taking this free course from Building Design+Construction.

boombox1
boombox2
native1

More In Category




halfpage1

Most Popular Content

  1. 2021 Giants 400 Report
  2. Top 150 Architecture Firms for 2019
  3. 13 projects that represent the future of affordable housing
  4. Sagrada Familia completion date pushed back due to coronavirus
  5. Top 160 Architecture Firms 2021

Â