Enter privacy risks — and related regulatory compliance issues and potential reputational crises — galore. In fact, 40% of Canadian business leaders across sectors and industries say they’ve never been more concerned about cybersecurity as they are now. Operational silos, they say, are holding organizations back from bringing cybersecurity and privacy teams to the table early enough in the development of new services and offerings to make a difference.
We see similar numbers play out across industry again and again. In a separate survey, only 43% of organizations said senior management understood cyber risks and provided sufficient resources to defend industrial control systems (ICSs) and operational technology (OT) environments. Another study revealed that 52% of IT staff don’t understand OT operational requirements.
In commercial real estate, we see the impacts of that reality play out across the industry every day. One Forbes report showed a 1,110% rise in the number of business and employee email account compromise attacks from 2015 to 2017 alone. In the same period, they tracked a 2,200% rise in reported monetary loss across the real estate sector.
The ramifications of these incidents extend well beyond the initial event or financial hit. Lost data. Stolen intellectual property. Ransom demands. Reputational damage. The list goes on and takes on additional meaning for smaller businesses: some 60% that suffer a cyberattack are out of business within six months.
Without a plan in place to weave cybersecurity strategically into your broader business operations, you may now be vulnerable to all kinds of trouble. On the flipside, addressing cybersecurity more rigorously can support the business — and your stakeholders — all while setting your organization apart as a real estate provider of choice.
How can real estate organizations bolster operations against cyber threats?
No matter where your organization stands in terms of cybersecurity maturity, there are always ways to strengthen defences and move to the next level. The key is to build a roadmap that acknowledges where you stand today, identifies gaps or risks and lays out clear action plans to ultimately reach a more cybersecure future state.
Asking these key questions now can help kickstart planning and accelerate cybersecurity efforts in meaningful ways:
- Do we know our mission-critical assets? Identifying business-critical assets is absolutely essential for any commercial real estate organization. Get clear on what equipment and systems are needed to keep employees safe and the business functioning.
- Are we doing well at the basics? Lights. Elevators. Doors. Knowing where you stand on the core exposure areas that automation creates is important. Assess whether roles and responsibilities are clearly defined. Be sure to document and manage any changes to equipment. Start configuring equipment so it’s backed up and stored in a safe location. Get clear on who controls system access. And foster a culture that ensures cybersecurity leading practices are discussed and employee training is always available.
- Do we understand business risks? Aligning the cyber risk to the business mission means establishing your risk appetite and tolerance levels at the organizational level. That requires an overall view of risk that can be easily understood and communicated, both internally and with regulators. Rigorously analyze operational and reputational risks. Outline any areas where additional investments and improvements should be made.
- Are we ready to respond to and recover from a natural disaster or cyber attack? Response and recovery time are everything. Commercial real estate organizations need proactive plans that ensure teams can respond quickly to a crisis. Test those plans regularly for business continuity to make sure operations can survive a major upheaval.
- Could third parties up the ante on risk? Whether your properties are managed externally or supported by a complex supply chain, chances are you have more third-party risk than you realize. Get a clear overview of just where those gaps may lie and proactively build in processes and frameworks for addressing risk across these areas now. Be sure to include proptech in that analysis, with a special focus on software deployment and vendor risk management.
- Is cybersecurity baked into innovation and design? Smart devices. Connected access. An increasing shift towards 5G. Internet of Things considerations for the 5 billion new devices that will come online over time. All of these factors represent emerging priorities — and new potential risks. Dismantle organizational silos to link the teams implementing these tools and technologies at the enterprise level with the cybersecurity team to drive better outcomes.
What’s the bottom line?
It’s time for commercial real estate companies to change the dynamic around cybersecurity. Bringing cyber and privacy into the fold earlier on can lead to innovation that is effective and secure — all while helping the business differentiate itself with clients seeking the best properties on offer.