flexiblefullpage -
billboard - default
interstitial1 - interstitial
catfish1 - bottom
Currently Reading

What AEC firms should look for in a cybersecurity partner

Security and Life Safety

What AEC firms should look for in a cybersecurity partner

When looking for expert partners in cybersecurity, AEC firms will find quite a lot of companies claiming to be at the forefront of modern threats. Here are five key points to look for when choosing a cybersecurity firm.

By Michael Smith, Director of IT Operations, HKS Inc. | July 5, 2022
What AEC firms should look for in a cybersecurity partner Photo Shutterstock
Photo: Shutterstock

The architecture, engineering and construction (AEC) industry is increasingly reliant on technology and the use of online networks to share project/client data and connect to third-party supplier networks, often doing so remotely from job sites. As we become more digital – the incorporation of several digital tools, technologies, and methods such as robotics, data analytics, additive manufacturing (AM), artificial intelligence (AI), internet of things (IoT), machine learning (ML), and drones – also means we are increasingly susceptible to cyber attacks. 

Past reported incidents include unauthorized access of a major retailer’s network through the mechanical contractor doing retrofit work on the HVAC system which lead to the exposure of about 40 million debit and credit card accounts, a data breach of personal sensitive information of employees of two well-known United States based construction companies, and compromised trade secrets of a construction elevator and escalator manufacturing firm.

Construction and related firms are not highly regulated, and since they haven’t historically been an “obvious target” for bad actors, the industry is often managing increasing cyber risk against unrealistic expectations. With multiple partners working together on a project, and the average cost of a data breach of $5.2 million, we cannot afford to simply put up the basic security walls any longer. More effective, customized security programs must be put in place. 

When looking for expert partners in cybersecurity, you’ll find quite a lot of companies claiming to be at the forefront of modern threats. I believe there are five key points to look for when choosing a cybersecurity partner to protect your livelihood and help security professionals sleep  at night. 

  1. Get a Partner, Not a Vendor: During the “interview” process, make sure you are getting a team behind you that will not just provide a service, but will be incorporated into your team for the long-run. A cybersecurity partner needs to feel they have skin in the game and you need to do a gut check against this metric. How invested do you feel they are in your success? We have had multiple occasions where we’ve asked our provider to investigate a threat that did not present itself by typical indicators of compromise. In every instance they went above and beyond what I would have considered a reasonable response. If they don’t consider an attack on you an attack on them, then you might want to reconsider those relationships. I want to be able to take a vacation and know that I have my own sheepdog guarding the chicken coup from the proverbial wolves!
  2. Customization and Flexibility: There is great need for customization of a cybersecurity program in the AEC space. Our industry is highly fragmented and any one project could include a dozen or two dozen different firms each doing a different piece of the construction puzzle. Files are transferred back and forth among all firms and that transfer must be quick and easy – and secure. Additionally, today’s contracts are demanding stricter cybersecurity principles including 24 hour breach notification, endpoint protection, multi-factor authentication, and more. A cybersecurity partner needs to be able to take each new project in stride, building a customized program protecting all endpoints, while being able to understand the speed and ease the AEC industry needs in transferring large files.
  3. Speed of Detection and Response: An effective cybersecurity approach needs to ingest endpoint, network, log, cloud, asset and vulnerability data that enables complete attack surface visibility 24 hours a day, seven days a week. We recently had a partner firm on a project infected with ransomware. Within the same day, our cybersecurity partner, eSentire, had a full report in hand. With a team of experts actively hunting for threats across the entire AEC environment, our mean time to containment (MTTC) is normally a mere 15 minutes, allowing work to stay on schedule. 
  4. Bringing Strong Relationships to the Table: Having pre-arranged relationships with top notch other security vendors is a critical component to a strong cybersecurity partner. With relationships in place, our cybersecurity firm (in our case eSentire) vouches for me and connects us with best in breed partners such as CrowdStrike, Microsoft and Sumo Logic without our team needing to do all the heavy lifting to fill in all the blanks of an Managed Detection and Response program.
  5. A Culture of Innovation: Take a hard look at a potential security partner’s culture of innovation. Do they win awards for innovation and do it with a spirit of humility? Are they always pushing forward? Are they constantly re-evaluating their own offerings and processes? What are they doing behind the scenes to bring forward innovative and timely threat intelligence and are they sharing it with the industry-at-large to improve outcomes for all? Threats are changing all the time and a partner should have a culture of change to keep up. 

With the right partner in place, the growing threat of cyberattacks on AEC projects can be effectively mitigated. Generally speaking, however, our industry needs to do a better job bringing a real-world cybersecurity perspective to each project, with an eye toward why certain designs can or cannot work. It’s critical we work within modern threat landscapes, while doing our best to not alter an artist’s design and vision. This means a robust cybersecurity plan and the ability to proactively detect, disrupt and remediate cyber threats anytime and anywhere. 

As an experienced leader in Information Technology operations, Michael Smith has a demonstrated history of fostering innovation within the Architecture & Engineering industry, leading high-performing teams to support and secure all enterprise infrastructure and endpoints. Skilled in operations and business process improvement, Michael has successfully grown within the sector and is currently the Vice President & Director of Information Technology Operations for HKS, an interdisciplinary global design firm that is on a mission to become one of the most influential firms in the AEC industry. Michael’s positive, humble and people-oriented perspectives foster alignment between the technology portfolio and the firm’s overall business objectives which translate into increased revenue and tangible enterprise value. 

Prior to HKS, Michael held key leadership roles for companies like Lockheed Martin, Carter & Burgess and most recently with engineering heavyweight Jacobs. Michael has law enforcement experience as a former Security Police Officer with the United States Air Force where he graduated from the USAF Law Enforcement Academy with Honors. Michael also holds an Associate’s Degree in Global Business Management.

Related Stories

Products and Materials | Mar 31, 2024

Top building products for March 2024

BD+C Editors break down March's top 15 building products, from multifamily-focused electronic locks to recyclable plastic panels.

Security and Life Safety | Mar 26, 2024

Safeguarding our schools: Strategies to protect students and keep campuses safe

HMC Architects' PreK-12 Principal in Charge, Sherry Sajadpour, shares insights from school security experts and advisors on PreK-12 design strategies.

75 Top Building Products | Dec 13, 2023

75 top building products for 2023

From a bladeless rooftop wind energy system, to a troffer light fixture with built-in continuous visible light disinfection, innovation is plentiful in Building Design+Construction's annual 75 Top Products report. 

Sponsored | | Nov 17, 2023

Safety in Senior Living Communities

As the U.S. Population Ages, the Need for Improved Safety and Security Grows

Sponsored | | Oct 24, 2023

Dark Deliveries in Retail Stores

Wireless Access Control Allows for Safe Deliveries During Retail Off-Hours

Products and Materials | Sep 29, 2023

Top building products for September 2023

BD+C Editors break down 15 of the top building products this month, from smart light switches to glass wall systems.

Products and Materials | Aug 31, 2023

Top building products for August 2023

BD+C Editors break down 15 of the top building products this month, from frameless windscreens to smart fixture mount sensors.

Sponsored | | Aug 15, 2023

The Data Benefits of Retail Keyless Entry

SALTO’s wireless access control system provides valuable data analytics for retail establishments

75 Top Building Products | Aug 7, 2023

Enter today! BD+C's 75 Top Building Products for 2023

BD+C editors are now accepting submissions for the annual 75 Top Building Products awards. The winners will be featured in the November/December 2023 issue of Building Design+Construction. 

boombox1 - default
boombox2 -
native1 -

More In Category

halfpage1 -

Most Popular Content

  1. 2021 Giants 400 Report
  2. Top 150 Architecture Firms for 2019
  3. 13 projects that represent the future of affordable housing
  4. Sagrada Familia completion date pushed back due to coronavirus
  5. Top 160 Architecture Firms 2021