Weekly Briefing

Real Estate Cyber Risk: Are You Prepared?

Listen to this article

Security breaches are, unfortunately, a part of our reality now. For industry, they have a high monetary cost, and cause erosion of the public trust. A company's reputation in such instances relies on staying apprised of cyber security protections, readiness, and a quick response to malicious events.

Executives at all levels of real estate organizations are spending more and more time on cybersecurity issues today. As innovation is driven by big data and smart analytics, a greater scope of connectivity between systems and buildings will require comprehensive and ongoing security strategies.

Historically, there are two areas of concern:

(1) Corporate Security and Information Technology: IT

These are the organizational systems and business applications employees use every day, including email, financial applications, HR applications, the internal corporate network, internet services, and more. This category is generally managed by the corporate security team, often within the technology function of the organization.

(2) Asset Operational Technology and Security: OT

Traditionally the main building systems, these now include networked building automation systems, as well as connectivity to the outside at all levels. Also known as the Industrial Internet, the physical buildings are increasingly integrated with sensors and wireless functions. Responsibility in this area may vary depending on how properties are operated; it may fall under the purview of the owner, a third-party service provider, building engineers, or a combination of entities.

These categories are converging, and yet the risk management process requires a certain amount of separation: because of inherent vulnerabilities, building systems should be separate from the corporate networks. In most cases, people—not their systems—are quite often the biggest security risk. Consistent, ongoing security awareness and training is critical, as well as constant monitoring.

The physical infrastructure is in some ways more susceptible to attack, simply because it's not traditionally as well managed by people versed in security as the corporate side. However, motive for an attack is important. Just because something is vulnerable doesn't mean it's prime for compromise; it may not be interesting for someone to compromise a system with little return. A company should focus their security efforts on the bigger targets that would yield greater gains for an intruder, and place better controls over who accesses, implements and maintains those systems.

Digital transformation leads to additional challenges

The digital transformation that's taking place in the real estate industry and the incredible investment in digital products means that the profile of real estate is increasing as never before. Real estate is now creeping into one of the top areas for nefarious infiltration. One reason may be that it's a softer target. Many real estate organizations are not subject to regulations from the SEC and other governing bodies; as an industry, real estate is not regulated the same way as banks and financial institutions, insurance companies, airlines, and utilities. These other industries have had more focus on making sure they are keeping themselves appropriately locked down.

Another reason, of course, is information. On the corporate side, real estate companies provide services that create volumes of data, valuable information in terms of transactions and money. This includes the data from supply chain contractors, third-party services, and tenants' personal data. This data is now on a network, and therein lies the potential exposure. Many companies servicing the industry operate in an entrepreneurial fashion, as contractors to large real estate organizations. Service and speed are important, and people need to work effectively—with all the access that entails. There must be a balance between security and efficiency, so that employees can do their jobs while still staying secure. As the industry standardizes security protocols, more third-party entities will be subject to vendor security reviews.

On the asset side, the goal of a comprehensive user experience is effectively changing the game. Capturing and tracking data about the user experience in a building creates information that's never been electronically available before and is no longer under closed proprietary systems. Consequently, there's an uptick in focus by the investment community about cybersecurity. This is driving behavior within companies to examine their security policies and programs.

Unanticipated events

Today, 90% of compromises start with business email and some kind of phishing attack, and they have become quite sophisticated. These emails appear to be from someone you know, asking for information or money. They may have a signature block that looks exactly like the one you are expecting. For example, a supplier who has completed a service ‘sends’ an email enclosing an invoice and new bank account or new wire instructions for payment. People develop habits that can be exploited by attacks like these because the procedure is familiar—it’s not anything unusual.

As time goes on, violations will become more creative. The Schneier on Security blog recently posted an article about hacking construction cranes. Cranes now have the capability for remote wireless diagnostics. Can you imagine a crane in the hands of someone intent on doing harm?

Another existing possibility exploits a very common activity: parking. Imagine the location is a high-value downtown Class A office building that contains building systems everyone uses. In many buildings you enter using your toll tag. The property manager is given the toll tag number and vehicle information. As a tenant, it's very convenient because there's no need for a fob or reader. However, the toll tag authority has credit card and other personal information; if a compromise occurs in the parking system, the attacker is a step away from possibly compromising all the personal information.

Resilience is the better part of valor

A majority of large companies have a security plan in place, with a budget and the requisite security officers. One statistic that's disturbing though, is that only about a third of those companies have a good cybersecurity and incident response plan in place—and have it fully tested. As we've all heard, "Companies have to be right 100 percent of the time and the bad guys only need to be right once." Cyber hackers are very nimble, and no company can defend 100 percent of the time.

A response plan—with layers of security and defenses in place—is necessary for prevention and early detection. A response team should include:

(1) A forensics team to determine what happened

(2) Your IT 'SWAT team' ready to deal with remediation quickly

(3) Your disaster recovery business continuity plan if you've lost data

(4) A law firm that understands how to manage cyber events

(5) A data privacy person (or law firm) that can advise on disclosure procedures (state- and country-specific)

(6) Your cyber insurance provider (if you don't have this, discuss with your insurance broker)

(7) An external communications firm for public-facing correspondence (to work with your internal corporate communications group)

(8) Responsible business executive

We must do more on both the corporate and the building side to protect ourselves from cyber attacks. In the event one occurs, we must be prepared to respond quickly and appropriately. The word that comes to mind for that is 'resilience'. Organizational resilience is key for cyber survival, along with the institutional will to do those things.

Cybersecurity is an important topic and will be covered in-depth at Pre-Con: Cybersecurity Forum and in a dedicated track in the education program. Realcomm | IBcon 2019 will be held at the Nashville Music City Center on June 13 & 14 (Golf and RE Tech Tours June 11 | Pre–Con Events: June 12). Register today!

Don Goldstein, CEO, 5Q Cyber As CEO, Don Goldstein is responsible for the overall leadership, operations, cyber security strategy, and direction of 5Q’s four service lines. He is an accomplished, award winning C-Level technology executive as Global CIO and CISO, with a distinguished 37-year career of providing robust technology and cyber security solutions to enable business growth. He possesses over 22 years of commercial real estate experience across all lines of business with the largest commercial real estate services, investment management and development company in the world.

Read Next

11/22/2024
Making Visitor Management a Welcome Experience If you’re in CRE, you already know the challenges of managing and tracking visitor access at your properties.

11/7/2024
Shadow IT: The Hidden Threat to Real Estate Companies In today's rapidly evolving technological landscape, the emergence of Shadow IT poses significant challenges for organizations, particularly in the commercial real estate sector.

10/31/2024
How Bridge Investment Group Cut Manual Data Entry and Improved Onsite Productivity In CRE, efficiency isn't just a goal; it's a necessity for survival. Leveraging technology as a means to cutting through operational drag and optimizing employee productivity has become a competitive imperative for success.

10/24/2024
Updated Enterprise Architecture Overview for Corporate Real Estate and Facilities: Are We Still Treading Water or Making Progress? Realcomm has released an updated version of its Corporate Real Estate and Facilities Information Management Systems Enterprise Architecture Overview infographic.