By Patrick Hogan, handle.com

Safety in construction extends beyond physical hazards. With the increasing reliance on digital tools and technology, safeguarding a company’s data is critical. As cyber threats and poor digital security can lead to data breaches and operational disruptions, protecting digital assets has become as essential as ensuring physical safety on the job site.

Digital tools can be vulnerable to cyber attacks and data loss if not adequately secured. Understanding and addressing these vulnerabilities is essential for protecting sensitive information and maintaining efficiency and client trust.

It’s important to note that many subcontractor companies do not have dedicated cybersecurity teams. Often, a single IT person or manager is responsible for ensuring data safety and systems security.

This article offers insights into best practices for safeguarding digital tools and securing data in an increasingly digital construction world. Let’s look at three key areas: assessing software security, implementing best practices, and educating employees.

Assessing Software Security Measures

Specific tasks in construction operations require particular security measures. While most software providers are familiar with what’s needed, verifying these features yourself is essential. Conducting regular checks and ensuring proper configuration is critical as you use various software products in your projects.

Scenario 1: Your subcontracting firm recently implemented new project management software to improve task coordination on-site. During setup, you realized it required personal information and emails for all users, raising concerns about data security.

Configuring permissions to ensure only authorized personnel like project managers and site supervisors have access to specific project data is critical.

Action: Set up strong passwords, enable two-factor authentication, and configure user permissions so only the right people can access specific data.

Verification: Review the vendor’s security documentation, perform a security audit to ensure permissions are correctly set up, and test with a few users to confirm access controls.

Scenario 2: Your firm uses cloud storage for project documents, which include sensitive information such as contracts, receipts of construction online payments, invoices, blueprints, legal documents, and financials. Improper sharing of these documents through links could expose sensitive data to unauthorized parties.

Action: Ensure the cloud provider uses data encryption and access controls. Train all staff to use secure file-sharing methods, such as password-protected links and setting expiration dates on shared files.

Verification: Verify the cloud provider’s security certifications, review access logs monthly to monitor who views files, and conduct a staff training session on secure sharing practices.

Implementing Best Practices for Software Security

Regular software updates are fundamental, but establishing a routine for updates and security audits is crucial for addressing vulnerabilities. Remember to create a checklist for software security measures and review it regularly to ensure comprehensive coverage.

Scenario 1: Some firms issue devices to employees, while others might only issue devices to specific employees who need secure communication. In hybrid setups or during work travel, employees such as site engineers and construction managers often need to access the internet outside the well-configured office network, such as public Wi-Fi.

Action: Provide employees with VPN software, train them on its use, and enforce strong password policies with two-factor authentication on all work-related accounts.

Verification: Ensure VPN software is installed and running on all devices, check the strength of passwords periodically, and verify that two-factor authentication is enabled and functioning.

Scenario 2: Your firm relies heavily on email communication for coordination and updates among project managers, site supervisors, and subcontractors. However, phishing attacks have become more common, posing significant risks.

Action: Implement spam filters and email encryption and train employees to recognize and avoid phishing attempts.

Verification: Regularly review and update spam filter settings, conduct periodic phishing simulations, and monitor email encryption status.

Educating Employees on Digital Security Awareness

Training employees on digital security is crucial for keeping your firm’s data and operations safe. Construction workers, site managers, and project coordinators often handle sensitive information, making them targets for cyber attacks. Ensuring that all employees understand potential threats and know how to respond can significantly reduce the risk of data breaches.

Here are five key areas where training is essential:

• Password Security: Teach employees to create strong, unique passwords using letters, numbers, and special characters.
• Secure File-Sharing: Train staff to use secure file-sharing methods such as password-protected links and setting expiration dates on shared files.
• Connecting to Networks: Ensure employees use VPN software to secure internet connections when accessing networks outside the office.
• Using Personal Emails for Work: To prevent data breaches, enforce a policy requiring work emails to be sent from company accounts only.
• Recognizing Phishing Attempts: Educate employees to identify phishing emails, which often contain unexpected requests for sensitive information or unfamiliar links.

By focusing on these critical areas, subcontractors can significantly enhance their digital security posture, protecting their operations and sensitive data. These straightforward steps will help ensure that digital tools and software are used safely and securely in the modern construction landscape.

However, digital security is an ongoing process that requires continuous vigilance and adaptation to evolving threats. Regularly reviewing and updating security measures, staying informed about the latest cybersecurity trends, and fostering a culture of security awareness among employees will help subcontractors stay ahead of potential risks.

By prioritizing digital safety, modern contractors can safeguard their projects, maintain client trust, and ensure the smooth operation of their businesses.

About the Author:

Patrick Hogan is the CEO of Handle.com, where they build software that helps contractors and material suppliers with lien management and payment compliance. The biggest names in construction use Handle on a daily basis to save time and money while improving efficiency.