Insight

Why contractors and builders need cyber insurance

Published

Written by

Read time

Written by Jack Durrant - Associate Director, BA (Hons) FCII.

Building and contracting businesses typically have many suppliers and people involved with their processes. Of course, having qualified and experienced people is essential, as well as the sheer breadth of suppliers necessary to provide materials to work on construction projects – whether they’re larger or small. 

The thing with these large and complex contracting systems and projects is that they take a lot of management control to ensure that they’ll operate as intended: There are specialist payroll businesses ensuring everyone gets paid and pays the right tax; there are people in control of procurement, as well as accounts specialists that make sure funds are available and budgets controlled. Not only this, but many larger-sized contractors will insist upon certain levels of insurance, which in this technological age, includes evidence of specific cyber cover.

Construction businesses are often completely reliant on their networks to ensure their operation runs smoothly, so any digital disruption may grind a project to a halt. Yes, in times gone by, tradespeople worked with the materials to hand, but nowadays, access to drawings, delivery schedules and logistics, suppliers, payroll, and many other elements depends upon a solid online network.

So, what are the digital dangers for contractors, and how can these be minimised?

1. DDoS or malware

 A DDoS (distributed denial of service) attack could impact anyone, even with the best security systems. The improper use of botnets is an example of what can happen when a threat actor attacks your business without credentials or leverage to access and infiltrate the network. Malware on the other hand, can be used to gain data such as credentials, subsequently and detrimentally impacting business from the inside.

For contracting firms this is a massive exposure to risk because of online connectivity with other parties. Many businesses come together to deliver a project, all with some level of access to your network. When a DDoS attack occurs in a contracting business, this will usually impact JIT deliveries, access to payroll systems, and even prevent access to site and architect plans.

2. Social engineering

Social engineering is probably the most common cyberthreat, and it’s very broad in terms of scale. I think of social engineering as any attempt to manipulate someone into believing you’re someone you’re not. It could be anything from imitating someone’s identity to gain access to a building, through to pretending to be a customer or supplier off the back of a phishing email. Social engineering is most often used online for financial gain, but also to illegally get hold of data or credentials. And there are many examples of people playing this off in person – for example, gaining access to Wembley Stadium for the final of the Euro’s by wearing a hi-vis jacket and carrying a large toolbox and ladder. So convincing was this ruse that stadium stewards held mag-lock doors open for these pretend workers.

In contracting businesses, social engineering is made easier due to the sheer number of people engaged with on a weekly basis. There’s also the ease of access to many site offices leading situations such as the Wembley Stadium scam, where those looking the part may walk straight into restricted areas – and even waved through by unassuming and unaware staff. Add to this the fast pace necessary to deliver to deadline on contracting projects, and it’s simple to see how these breaches occur.

The project managers in charge of these operations are often head-down in their specific tasks and mainly concerned with the maintenance and checks on their own team’s credentials, so the wider infiltrations and implications of social engineering cybercrime may be missed. This oversight could result in false or manipulated credentials being used across systems, leaving them vulnerable to attack. And this, combined with the nature of the work being remotely accessible, creates the perfect cyber storm.

3. Invoice manipulation

Invoice manipulation is a bit of an extension to social engineering but, as it’s such a common cybercrime, it's well worth considering in its own right. It’s important because of the volume of digital transactions to various suppliers, the number of people on payroll (and the changes between pay periods), and the regularity of the payments, meaning that criminal opportunities are ripe for threat actors.

The additional point on this is that third parties may also be targeted by threat actors in reverse; so, if a main contractor is breached, a third party could receive invoice manipulation. This will often create a negative a public relations issue and mean future work opportunities and partnerships may be jeopardised.

4. Business interruption

Further to an earlier mention of deadlines, this is a good moment to check in on the importance of a smooth delivery of information for contractors – which is what keeps orders and deliveries running to time and on track for successful completion.

Therefore, any type of business interruption or disruption to payments is never welcomed – especially on top of an existing system issue or network outage. With a credible cyber insurance policy, you gain valuable peace of mind, as there will be crisis containment cover or a forensic recovery fund in place. This means specialists will come in quickly, diagnose, and rectify network issues. This also means that by having the business interruption element of cover, insurers have a vested interest in putting your network right as fast as possible. Funds could potentially be levied against delays to the project, and ultimately a quicker recovery achieved. As opposed to not having that cyber cover where you may be faced with weeks’ of potential outage, plus the additional expose of a specialist to put systems right, that may write off a project's profits entirely.

We recently spoke about all of this on the “Risky Business” podcast, about the variation of attacks, and the potential catastrophic fallout that can come from cyber issues, The bottom line is, it's always worth talking to your broker. In many cases, insurers can provide quotations at different levels to suit different budgets, but your business will still benefit from thousands of pounds of invested funds in preventative measures. If your business hasn’t had a quote for cyber insurance yet, why not make it a priority and avoid being at the wrong and costly end of a cybercrime or network issue.

Want to know more? Then speak to one of our specialist cyber team about this via the contact form below.

Do you have an existing policy with Howden?

Got a question or query? Give us a few details in the box below and we'll get back to you. 

Alternatively, call us on: 0372 291 2149

Our Website Terms and Conditions and Privacy Notice includes information on the scope of our service and how we will handle your data.

CAPTCHA
5 + 2 =
Solve this simple math problem and enter the result. E.g. for 1+3, enter 4.
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.

What to do if you are experiencing financial difficulties

We recognise that the current economic conditions are putting pressure on many households and businesses. At Howden, we are committed to finding ways to assist our customers who may require additional support during these times.

If you’re currently facing financial difficulty, please speak to us about your insurance policies by:-

-contacting your Howden Service Team; 
-calling Howden on 020 7623 3806;
-using the Enquiry form.