Contruction Today - July/August 2017 - 13

A Triple Threat
Cyber security vulnerabilities in the
construction industry are compounded
by growing industry adoption of cloud
computing and the IoT. Smart buildings
technology, such as sensor-enabled heating
and cooling systems, can be physically
compromised or provide an entry point to
the larger corporate network. With increased
connectivity, the security (or lack thereof)
of each individual device impacts the whole
system's integrity. And because IoT devices
fall outside the traditional scope of IT, they
are often overlooked.
The top threats specific to physical infrastructure are distributed denial of service
(DDoS) and the emerging threat of permanent denial of service (PDoS) attacks. DDoS
and PDoS attacks aim to temporarily disable
or permanently destroy technology - such
as power grids, heating and cooling systems
and Internet providers - by overwhelming
the targeted system with traffic, thereby
disrupting service distribution and delivery.
And then there is ransomware, another
type of denial of service (DoS) attack that
uses encryption malware, generally downloaded via phishing emails, to block user
access to computer files, potentially permanently if the victim is unable or unwilling
to pay the ransom for the encryption key.
Ransomware attacks quadrupled in 2016
with an average of 4,000 per day, according
to data from the U.S. Justice Department.
The problem from a critical infrastructure
perspective? Ransomware could infect
operational technology, disrupting essential
processes or taking entire systems offline.
Although DoS-style threats emerged nearly two decades ago, hackers have leveraged
IoT to carry out much more sophisticated

attacks in recent years. For example, the October 2016 attack against
Domain Name System (DNS) provider Dyn, used IoT and a Mirai
botnet to increase the attack's scope and impact. Mirai botnets are
a strain of malware that infects internet-connected devices and
corrals them into an IoT "army" to overwhelm a target's servers
with malicious traffic, shutting down highly trafficked websites for
several hours. While the Dyn attack caused arguably little more than
inconvenience, it spurred speculation about the chaos and physical
harm a DDoS - or worse PDoS - attack of that scale, or bigger, on the
nation's infrastructure could potentially cause.
Cyber attacks to date on critical infrastructure have largely targeted power grids and the electrical sector. In 2016, ransomware and
DDoS attacks of that nature stole headlines worldwide. In Finland,
a DDoS attack targeted computerized heating distribution centers,
disabling heat to apartment buildings. In December, a cyber attack
on the Ukrainian capitol's power grid caused a power outage in
various areas of the city. The attack has roots in malware - employees at Ukrainian power companies received infected emails, which
allowed the hackers to seize control over their computers and carry
out the attack. Beyond the technical semantics of the attack, it
appears the act might have been one of cyber warfare. CBS News reported that Russia was likely tied to the DDoS attack, motivated by
the war in Eastern Ukraine. With this incident in mind, securing the
United States' critical infrastructure against cyber attacks becomes a
matter of national security.

Eric Chuang
is a managing director
in BDO's
forensic technology
services practice. He has
held several senior positions in law enforcement,
including most recently
as chief of the computer
operations group in the
Operational Technology
Division of the FBI,
where he received the
FBI Director's Award for
Outstanding Science &
Technology Achievement.
He may be reached at
echuang@bdo.com.

Ian Shapiro
is a partner
and co-leader of BDO's
real estate and construc-

The Contractor's Role
From a business perspective, construction companies would be wise
to shore up their cyber security. Construction firms looking to win
federal or state government contracts under the much-anticipated
infrastructure spend will be held to stringent cyber security standards. The U.S. government produces, collects, consumes and disseminates huge volumes of data and entrusts sensitive information
to federal contractors. At the federal level, the Federal Acquisition
Regulation requires basic safeguarding of contractor information
systems that process, store or transmit federal contract information,
and contractors can face fines or contract termination if there are
levels of cyber negligence. Construction companies contracting with
the government must also consider their subcontractor's cyber security standards: Any weak cyber link can create a vulnerability.
While the construction industry looks forward to the promise
of financial boon from new infrastructure projects, cyber security
should remain top-of-mind. Too often, contractors may have basic
cyber defenses in place but don't prepare any real coordinated
response plan until after an incident occurs. With the rapidly
emerging swath of risks, contractors need to set their sights on the
future and invest in monitoring, responding to and mitigating the
next big threat.

tion practice. He can be
reached at ishapiro@
bdo.com. 

13

JULY/AUGUST 2017 CONSTRUCTION-TODAY.COM

DATA SECURITY

identifiable information (PII) and non-public material information. Construction firms
also house computer-aided design (CAD)
drawings and blue prints to sensitive buildings, which hackers can exploit to inflict
physical damage.


http://www.CONSTRUCTION-TODAY.COM

Table of Contents for the Digital Edition of Contruction Today - July/August 2017

Contents
Contruction Today - July/August 2017 - Cover1
Contruction Today - July/August 2017 - Cover2
Contruction Today - July/August 2017 - 1
Contruction Today - July/August 2017 - Contents
Contruction Today - July/August 2017 - 3
Contruction Today - July/August 2017 - 4
Contruction Today - July/August 2017 - 5
Contruction Today - July/August 2017 - 6
Contruction Today - July/August 2017 - 7
Contruction Today - July/August 2017 - 8
Contruction Today - July/August 2017 - 9
Contruction Today - July/August 2017 - 10
Contruction Today - July/August 2017 - 11
Contruction Today - July/August 2017 - 12
Contruction Today - July/August 2017 - 13
Contruction Today - July/August 2017 - 14
Contruction Today - July/August 2017 - 15
Contruction Today - July/August 2017 - 16
Contruction Today - July/August 2017 - 17
Contruction Today - July/August 2017 - 18
Contruction Today - July/August 2017 - 19
Contruction Today - July/August 2017 - 20
Contruction Today - July/August 2017 - 21
Contruction Today - July/August 2017 - 22
Contruction Today - July/August 2017 - 23
Contruction Today - July/August 2017 - 24
Contruction Today - July/August 2017 - 25
Contruction Today - July/August 2017 - 26
Contruction Today - July/August 2017 - 27
Contruction Today - July/August 2017 - 28
Contruction Today - July/August 2017 - 29
Contruction Today - July/August 2017 - 30
Contruction Today - July/August 2017 - 31
Contruction Today - July/August 2017 - 32
Contruction Today - July/August 2017 - 33
Contruction Today - July/August 2017 - 34
Contruction Today - July/August 2017 - 35
Contruction Today - July/August 2017 - 36
Contruction Today - July/August 2017 - 37
Contruction Today - July/August 2017 - 38
Contruction Today - July/August 2017 - 39
Contruction Today - July/August 2017 - 40
Contruction Today - July/August 2017 - 41
Contruction Today - July/August 2017 - 42
Contruction Today - July/August 2017 - 43
Contruction Today - July/August 2017 - 44
Contruction Today - July/August 2017 - 45
Contruction Today - July/August 2017 - 46
Contruction Today - July/August 2017 - 47
Contruction Today - July/August 2017 - 48
Contruction Today - July/August 2017 - 49
Contruction Today - July/August 2017 - 50
Contruction Today - July/August 2017 - 51
Contruction Today - July/August 2017 - 52
Contruction Today - July/August 2017 - 53
Contruction Today - July/August 2017 - 54
Contruction Today - July/August 2017 - 55
Contruction Today - July/August 2017 - 56
Contruction Today - July/August 2017 - 57
Contruction Today - July/August 2017 - 58
Contruction Today - July/August 2017 - 59
Contruction Today - July/August 2017 - 60
Contruction Today - July/August 2017 - 61
Contruction Today - July/August 2017 - 62
Contruction Today - July/August 2017 - 63
Contruction Today - July/August 2017 - 64
Contruction Today - July/August 2017 - 65
Contruction Today - July/August 2017 - 66
Contruction Today - July/August 2017 - 67
Contruction Today - July/August 2017 - 68
Contruction Today - July/August 2017 - 69
Contruction Today - July/August 2017 - 70
Contruction Today - July/August 2017 - 71
Contruction Today - July/August 2017 - 72
Contruction Today - July/August 2017 - 73
Contruction Today - July/August 2017 - 74
Contruction Today - July/August 2017 - 75
Contruction Today - July/August 2017 - 76
Contruction Today - July/August 2017 - 77
Contruction Today - July/August 2017 - 78
Contruction Today - July/August 2017 - 79
Contruction Today - July/August 2017 - 80
Contruction Today - July/August 2017 - 81
Contruction Today - July/August 2017 - 82
Contruction Today - July/August 2017 - 83
Contruction Today - July/August 2017 - 84
Contruction Today - July/August 2017 - 85
Contruction Today - July/August 2017 - 86
Contruction Today - July/August 2017 - 87
Contruction Today - July/August 2017 - 88
Contruction Today - July/August 2017 - 89
Contruction Today - July/August 2017 - 90
Contruction Today - July/August 2017 - 91
Contruction Today - July/August 2017 - 92
Contruction Today - July/August 2017 - 93
Contruction Today - July/August 2017 - 94
Contruction Today - July/August 2017 - 95
Contruction Today - July/August 2017 - 96
Contruction Today - July/August 2017 - 97
Contruction Today - July/August 2017 - 98
Contruction Today - July/August 2017 - 99
Contruction Today - July/August 2017 - 100
Contruction Today - July/August 2017 - 101
Contruction Today - July/August 2017 - 102
Contruction Today - July/August 2017 - 103
Contruction Today - July/August 2017 - 104
Contruction Today - July/August 2017 - 105
Contruction Today - July/August 2017 - 106
Contruction Today - July/August 2017 - 107
Contruction Today - July/August 2017 - 108
Contruction Today - July/August 2017 - 109
Contruction Today - July/August 2017 - 110
Contruction Today - July/August 2017 - 111
Contruction Today - July/August 2017 - 112
Contruction Today - July/August 2017 - Cover3
Contruction Today - July/August 2017 - Cover4
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol17issue4a
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol17issue3
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol17issue3a
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol17issue2
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol17issue2a
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol17issue1
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol17issue1a
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol16issue6
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol16issue5
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol16issue4
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol16issue3
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol16issue2
http://digital.construction-today.com/nxtbooks/knighthouse/ct_vol16issue1
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201712
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201711
http://digital.construction-today.com/nxtbooks/knighthouse/ct_20170910
http://digital.construction-today.com/nxtbooks/knighthouse/ct_20170708
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201706
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201705
http://digital.construction-today.com/nxtbooks/knighthouse/ct_20170304
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201702
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201701
http://digital.construction-today.com/nxtbooks/knighthouse/ct_20161112
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201610vol2
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201610
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201609
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201608
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201607
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201606
http://digital.construction-today.com/nxtbooks/knighthouse/ct_201605
http://digital.construction-today.com/nxtbooks/phoenix/ct_201604
http://digital.construction-today.com/nxtbooks/phoenix/ct_20160304
http://digital.construction-today.com/nxtbooks/phoenix/ct_20160102
http://digital.construction-today.com/nxtbooks/phoenix/ct_20151112
http://digital.construction-today.com/nxtbooks/phoenix/ct_20150910
http://digital.construction-today.com/nxtbooks/phoenix/ct_20150708
http://digital.construction-today.com/nxtbooks/phoenix/ct_20150506
http://digital.construction-today.com/nxtbooks/phoenix/ct_20150304
http://digital.construction-today.com/nxtbooks/phoenix/ct_20150102
http://digital.construction-today.com/nxtbooks/phoenix/ct_20141112
http://digital.construction-today.com/nxtbooks/phoenix/ct_20140910
http://digital.construction-today.com/nxtbooks/phoenix/ct_20140708
http://digital.construction-today.com/nxtbooks/phoenix/ct_20140506
http://digital.construction-today.com/nxtbooks/phoenix/ct_20140304
http://digital.construction-today.com/nxtbooks/phoenix/ct_20140102
http://digital.construction-today.com/nxtbooks/phoenix/ct_20131112
http://digital.construction-today.com/nxtbooks/phoenix/ct_20130910
http://digital.construction-today.com/nxtbooks/phoenix/ct_20130708
http://digital.construction-today.com/nxtbooks/phoenix/ct_20130506
http://digital.construction-today.com/nxtbooks/phoenix/ct_20130304
http://digital.construction-today.com/nxtbooks/phoenix/ct_20130102
http://digital.construction-today.com/nxtbooks/phoenix/ct_20121112
http://digital.construction-today.com/nxtbooks/phoenix/ct_20120910
http://digital.construction-today.com/nxtbooks/phoenix/ct_201208
http://digital.construction-today.com/nxtbooks/phoenix/ct_201207
http://digital.construction-today.com/nxtbooks/phoenix/ct_201206
http://digital.construction-today.com/nxtbooks/phoenix/ct_201205
http://digital.construction-today.com/nxtbooks/phoenix/ct_201204
http://digital.construction-today.com/nxtbooks/phoenix/ct_201203
http://digital.construction-today.com/nxtbooks/phoenix/ct_201202
http://digital.construction-today.com/nxtbooks/phoenix/ct_201201
http://digital.construction-today.com/nxtbooks/phoenix/ct_201112
http://digital.construction-today.com/nxtbooks/phoenix/ct_20111011
http://digital.construction-today.com/nxtbooks/phoenix/ct_201109
http://digital.construction-today.com/nxtbooks/phoenix/ct_201108
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201107
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201106
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201105
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201104
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201103
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201102
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201101
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201012
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201011
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201010
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201009
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201008
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201007
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201006
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201005
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201004
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201003
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201002
http://digital.construction-today.com/nxtbooks/businessmedia/ct_201001
http://digital.construction-today.com/nxtbooks/schofield/ct_200912
http://digital.construction-today.com/nxtbooks/schofield/ct_200911
http://digital.construction-today.com/nxtbooks/schofield/ct_200910
http://www.nxtbook.com/nxtbooks/schofield/ct_200909
http://www.nxtbookMEDIA.com