WannaCry Ransomware Attack Underscores Cyber Risks to the Construction Industry
In a single day in May 2017, a powerful new ransomware program known as “WannaCry” infected hundreds of thousands of computers across at least 74 countries. Ransomware infects a target’s computer or network, encrypts the target’s files and then holds those files hostage, with the promise that the files will be unlocked if the target pays a monetary ransom. Clearly, ransomware poses threats of business disruption, financial losses due to data and system restoration, and reputational damage, but what is less obvious is the way that ransomware greatly expands the number and types of valuable targets for cybercriminals. With ransomware, a target does not need to possess sensitive financial or medical data, trade secrets or other commercially valuable information in order to be a worthwhile target for cyberattack. Because the cyber criminal’s purpose is extortion, it only matters that the data is valuable to the target. Consider yourself on notice: because you have information that you need to access to run your business, you are a target for a ransomware attack.
Construction projects require that designs, submittals, RFIs, change orders and other critical information be exchanged among contractors, subcontractors, owners and design professionals and be available when needed. The loss of access to data—or the destruction or manipulation of ransomed data—as a result of a ransomware attack could have disastrous consequences. So while executives in the construction industry may have been tempted in the past to assume that their businesses would not be targeted, “We don’t have any data worth stealing,” is not the reality of today’s threat environment.
It is understandably difficult to track ransomware attacks, which victims may not want to report, but according to a U.S. government intragency report from June 2016, ransomware attacks increased 300% between 2015 and early 2016. And this figure already appears outdated—one network security firm reported in 2017 that it had detected 3.8 million attempted ransomware attacks in 2015 and 638 million in 2016. Not only is the frequency of attacks growing at a truly alarming rate, but as WannaCry shows, the sophistication of the attacks is also increasing. Many ransomware attacks infiltrate a target’s system via “phishing” emails designed to get a recipient to download an attachment or click on a link, and WannaCry may have employed this approach initially (cybersecurity researchers disagree on the initial means of infection). Once inside a target’s computer, WannaCry took advantage of a vulnerability in Microsoft Windows servers to spread laterally within the target’s systems. Thus, following the initial infection, WannaCry spread without further action by the target to infect and encrypt other users’ linked computers or even entire networks. Meanwhile, the target and his organization may not have been aware that anything was amiss until they were shut out of their files and confronted with an on-screen ransom demand.
Prevention is the clear best defense against ransomware, and there are some key areas on which to focus.
Educate Your Personnel
A company’s employees must all know and understand the company’s security practices and be aware of potential threats, including ransomware. Cyber criminals have an array of tools to trick their targets, including phishing emails. Phishing attempts have become much more sophisticated over time, and determined cyber criminals will convincingly impersonate trusted senders like company executives or clients by doing research and deploying accurate information including names, titles, addresses and logos. Employees need to know how to recognize suspicious emails and how to report and resolve their concerns. Like any safety issue, managing data security must ultimately involve each individual employee, and in order to make good decisions about data security, employees need to be informed through outreach and training.
Secure Your Systems
As it turns out, Microsoft released a security update for the vulnerability exploited by WannaCry in March 2017—almost two full months prior to the attack. Those targets that remained vulnerable may have put off patching their systems, ignored advisories from Microsoft or used outdated or unsupported software. WannaCry dramatically highlights the importance of having a systematic, organization-wide approach to patch management, but having appropriate anti-virus and anti-malware software and spam filters are also key considerations in preparing your company against a ransomware attack. So is developing a strong data back-up and recovery plan, as a secure back-up may provide the only reliable way to recover critical data following a ransomware attack.
Create a Plan
Finally, every company should have a security incident response plan in the event of an attack. A high quality response plan will feature a designated response team with identified individuals taking on clearly defined roles addressing technology, internal communications, client relations and legal reporting obligations, among other needs. The team should assess and respond to vulnerabilities and then develop and test a comprehensive response plan before the organization is the victim of a cyberattack.
Companies in the construction industry have no choice but to take the threat of ransomware seriously. An attack could create project delays and generate enormous costs for investigation, remediation, and legal defense, in addition to the costs of repairing an affected company’s damaged reputation and standing with its clients. The good news is that being aware of the risk is the first step towards managing the risk, and the risks posed by ransomware can be managed with a focus on prevention and thoughtful advance planning.