Weekly Briefing

In Commercial Real Estate Cybersecurity Is Not Enough

Listen to this article

Those of us in the commercial real estate community know that it has a very different operating environment and culture from other industries, especially when it comes to “front of house” technology such as building systems (e.g., HVAC, elevator, lighting, parking, access control, etc.).

Cybersecurity risks originate with the contractors that install and maintain those building systems. Because these risks are almost completely associated with the contractors, we must say that cybersecurity alone is not enough to secure buildings and is better approached as vendor risk management (VRM). Gartner defines VRM as: “The process of ensuring that the use of service providers and suppliers does not create an unacceptable potential for business disruption or a negative impact on business performance.” This is a broader view than just cybersecurity.

Why is VRM so important in real estate? One word: fragmentation. To state the obvious, the HVAC contractor doesn’t manage the parking control system, the access control contractor doesn’t manage the elevator or conveyance systems, and so on. Additionally, each contractor may or may not manage those systems in multiple buildings of a portfolio. Add to that broader geography separation, joint ventures, term contracts, and technician turnover, and it’s hard to imagine how leadership can communicate and manage policy across the portfolio with consistency, much less deploy technology solutions.

The other aspect of fragmentation is that the technicians generally do not work directly for the building owner; so it’s unlike a typical industry organization where the CIO can dictate technology tools and practices throughout all personnel in the company. In a study we performed on a 100-building portfolio, we found more than 300 contractor service companies, 600 separate monitor and control systems, 2,000 network connections, and over 3,000 technicians that can or do service the systems.

Yes, it’s still important to deal with IT aspects such as the networking and Internet access that have been in our buildings since the 1980s, but even the firewall from hell won’t stop some types of ransomware. One of your technicians might click on a malicious link in an email that could affect a system that was not backed up, and you may then be faced with the choice of bitcoin payments or total rebuild of the system. In another internal study we performed on 500 million square feet of commercial real estate office space, we found ransomware attacks were up 700% during 2020, and contractor technicians were opening phishing emails at seven times the rate of the general public. These results were staggering, and a big part of the problem is building owners and managers failing to create and enforce policy for cybersecurity, system configuration, back up, and other important practices.

So how do you deal with VRM in such a fragmented industry? You need complete vendor risk management. After 18 years in the smart building advisory business and conducting over 5,000 cybersecurity site assessments, we developed our managed services monitoring approach based on three key areas:

1. Networking and Remote Access Management: Building systems are Internet-accessible and operate on local area networks. As a result, there needs to be proper server management and backup as well as “zero trust” remote access management. Zero-trust makes the systems invisible to the Internet and only allows one-to-one connections. Additionally, we determined that this solution had to be so simple that it could be “plug and play” including drop ship with a telephone call setup.
2. Building System Backup and Configuration: While defending against hacking, we need to recognize that the building systems themselves are the “Alamo” and must be properly configured and backed up. Even if there is a network breach, a system with proper password protection, updated software, and disciplined credential management along with a backup will have far less risk of downtime or damage and can quickly recover by restoring the system.
3. People Policy Management: Policy management includes communicating the policy to all technicians and staff, auditing the policy, and augmenting the audits with tailored phishing campaigns and automated training. The policy should be basic and quickly understandable, the audits should be fast and easy with a series of yes/no compliance questions, and the phishing messages should be tailored to the facility contractor industry segment.

In subsequent articles, we will break down each area while keeping them in the context of the overall approach. While we include all three aspects in a monitoring approach, they each have important characteristics worthy of examination. You can learn more at www.buildingcybersecurity.com and see a comprehensive video outlining the issues that create risk and some of the consequences, including insurance gaps, downtime, equipment replacement, network hopping, and brand damage.

Rob Murchison, Co-Founder, Intelligent Buildings Rob Murchison has over 20 years experience in strategy consulting, sales and design of technology to real estate developers and commercial businesses with expertise in networking, and software and data base applications. He is currently a Principal and Co-Founder of Intelligent Buildings, LLC, founded in 2004 to help customers manage risk, enhance occupant wellbeing, and improve performance.

Tom Shircliff, Co-Founder, Intelligent Buildings Tom Shircliff is a co-founder of Intelligent Buildings, a smart real estate service firm founded in 2004. Intelligent building provides services for technology strategy, vendor risk management and portfolio decarbonization.

Read Next

4/18/2024
Best Practices for Managing Lease Renewals When your commercial leases come up for renewal, it’s a great opportunity to assess your real estate portfolio, consider the value of current leases and possibly negotiate better terms.

4/11/2024
3 Reasons to Incorporate AI Into Your Talent Retention Strategy Introducing new technology into the workplace is often met with suspicion.

4/4/2024
Operational Technology (OT) Data Data has been a cornerstone of business since the early days of computing in the 1960s.

3/28/2024
The Tech-Forward Response to Rising CRE Cap Rates is Also People-First Cap rates on commercial real estate have been rising for five consecutive quarters, leading to an estimated 20% drop in value for many property types, according to CBRE’s latest U.S. Real Estate Market Outlook.