Plymouth knows what happens when the foundation and the
future don't quite line up.
New homes, commercial projects, and growing businesses keep
arriving while much of the infrastructure underneath them was built for a very
different Plymouth. Downtown is charming precisely because nobody laid it out
with twenty-first-century traffic, utilities, delivery trucks, and construction
equipment in mind. Roads get opened, patched, redirected, and eventually opened
again because sometimes the only way to fix what's underneath is to tear into
what has already been built on top of it.
Construction companies understand this better than most: the
things you get wrong at the foundation have a habit of becoming much more
expensive later.
Cybersecurity works the same way.
A construction company can buy better security software,
move applications to the cloud, require MFA, protect laptops, and back up its
data. Underneath all that technology, though, are the people using it every
day: project managers opening drawings, estimators exchanging files, accounting
teams paying subcontractors, superintendents working from jobsites, and owners
answering email wherever the day takes them.
If those employees don't know how to recognize something
unusual, protect their accounts, handle company information safely, or raise
their hand when something goes wrong, there is a crack in the foundation.
That's the lesson behind Cyber Smart September.
Recognize What Doesn't Belong
Construction professionals already develop an eye for things
that aren't right. A dimension doesn't match. The delivered material isn't what
was specified. Something on the site doesn't line up with the drawing.
That same instinct matters online.
A project manager receives a shared-document notification
they weren't expecting. Accounting gets an email from a subcontractor with new
banking instructions. A superintendent opens a project link and suddenly has to
sign into Microsoft 365 again.
None of those situations automatically means an attack is
underway. They're simply unusual enough to deserve a pause.
That pause matters because cybercriminals often borrow a believable
business process rather than inventing some wild scenario. Construction
teams genuinely exchange drawings, specifications, submittals, RFIs, invoices,
proposals, schedules, and contracts all day long.
The attacker doesn't need to invent a reason for you to open
a document. Your job already supplies plenty of them.
Treat Changes to Money Like Change Orders
Suppose a subcontractor sends accounting a short email:
We've changed banks. Please use the attached ACH
instructions for this month's payment.
Correct company name. Familiar signature. Maybe it even
appears inside an existing email thread.
That should still trigger verification.
Construction companies understand the value of formal
changes. You wouldn't approve a major change order because somebody sent a
casual message saying the price and scope were different now. Changing where
tens or hundreds of thousands of dollars will be deposited deserves at least as
much discipline.
Business Email Compromise attacks regularly exploit exactly
this kind of normal financial process. The FBI recommends independently
verifying changes to banking and payment information using a known person or
trusted phone number rather than relying on the message requesting the change.
Don't verify a suspicious email by replying to the
suspicious email. If the criminal controls the account, they will almost
certainly confirm that, yes, those are absolutely the new banking instructions.
The principle is simple: when the money moves somewhere
new, verify outside the message.
Protect the Keys
A project manager's Microsoft 365 account might contain
vendor relationships, project schedules, drawings, customer communications,
invoices, and years of project history.
That makes the identity valuable.
A criminal who gets into that account doesn't merely gain a
mailbox. They potentially gain the ability to communicate as somebody
coworkers, clients, subcontractors, and vendors already trust.
Unique passwords, password managers, MFA, and good
authentication habits therefore belong in the same category as protecting
company keys.
You wouldn't hand a stranger the keys to a company truck
because he confidently said he worked there. Treat an unexpected authentication
request with the same amount of skepticism.
If an MFA request appears and you aren't trying to log in,
don't approve it. Deny it and report it. One unexpected notification may be the
first visible sign that somebody is attempting to use your identity.
Good cybersecurity doesn't require an employee to understand
everything happening behind that prompt. It requires them to recognize that the
request isn't normal and give IT an opportunity to investigate.
The Jobsite Is Part of the Technology Environment
Construction doesn't happen from identical desks inside one
controlled office.
Employees work from jobsites, trailers, customer locations,
homes, phones, tablets, and laptops. A Plymouth project manager might start the
morning at the office, spend the afternoon on a site in Kingston or Carver,
review plans from a tablet, and finish paperwork from home.
The information doesn't become less valuable when the
scenery changes.
Project files should remain in approved systems. Work
devices need appropriate security. Employees should understand what they can
share externally and what they can submit to AI tools. Drawings, contracts,
bids, estimates, customer information, and financial records shouldn't migrate
into personal email accounts or whatever new application happened to make
today's task easier.
Mobile teams also need technology that works securely across
offices and jobsites. Engineering and design firms face similar challenges
when employees need secure access to project
data from offices and the field.
The employee takeaway is straightforward:
The rules travel with the device.
A jobsite may be miles from headquarters, but in a
cloud-based construction company it is still part of the technology
environment.
Good Crews Speak Up
Construction already understands why small problems should
be reported before they spread.
If somebody sees damaged equipment, unsafe scaffolding, an
incorrect installation, or something on the job that simply isn't right,
keeping quiet and hoping for the best isn't much of a safety strategy.
Cybersecurity deserves the same attitude.
A suspicious email should be reported. So should a lost
tablet, an unexpected MFA prompt, credentials entered into the wrong page,
strange mailbox behavior, or a questionable request to change vendor payment
information.
The employee who makes a mistake is not necessarily the
biggest problem. The employee who makes the mistake and is afraid to tell
anyone can be.
That's why employee awareness needs to connect to an actual incident
response process. Somebody has to know what happens after the alarm is
raised.
If an employee clicks the wrong link and reports it five
minutes later, IT may be able to reset credentials, revoke sessions, inspect
the device, warn other employees, and contain the issue. If nobody hears about
it for two days, the same problem may have had forty-eight hours to become much
more interesting.
In cybersecurity, embarrassment is expensive. Reporting is
useful.
What Do We Mean by a "Human Firewall"?
People sometimes describe trained employees as a company's human
firewall.
We like the idea, with one caveat: people aren't actually
firewalls.
In some ways, they can be better.
A firewall can recognize technical patterns. An accounting
employee can recognize that Bob from the electrical subcontractor has never
changed his banking information by email before. A security product can
identify unusual authentication behavior. A superintendent knows they weren't
expecting a new drawing package. An email filter can inspect a message, while a
project manager knows the owner doesn't normally text requests for wire
transfers.
People understand context.
Training gives them a framework for using that context:
Recognize something unusual. Protect your access. Keep
company information where it belongs. Speak up quickly when something goes
wrong.
That's the human firewall we actually want to build.
Not perfect employees who never click the wrong thing, but
cyber-smart employees who recognize when normal work suddenly doesn't feel
normal.
Build It Into the Foundation
Anyone who has watched another stretch of road in Plymouth
get opened up understands the lesson: fixing something underneath an existing
structure is usually harder, slower, and more expensive than getting it right
when you build it.
Cybersecurity is no different.
For construction firms in Plymouth and throughout the South
Shore, the human side of the security foundation is relatively straightforward.
Employees need to recognize unusual requests, protect their identities, handle
project and business information carefully, and report problems quickly.
But people are only one part of the structure.
What about your backups? Microsoft 365 configuration?
Endpoint protection? Patching? Vendor access? Incident response? Recovery
planning?
Those systems matter too, and small gaps have a way of
getting more expensive once a business has been built on top of them.
That's where Cyber Smart September connects back to the
larger question:
How solid is the rest of your cybersecurity foundation?
If your employees are getting smarter about cybersecurity,
it's a good time to make sure the rest of the company isn't still a sitting duck.
In Short
Plymouth construction companies can reduce cybersecurity
risk by training employees to recognize suspicious requests, protect passwords
and MFA, keep project information in approved systems, and report possible
incidents quickly. Construction firms are especially dependent on secure human
behavior because large payments, vendor relationships, project documents, cloud
systems, and mobile employees cross organizational boundaries every day.
Frequently Asked Questions
Why are construction companies targeted by
cybercriminals?
Construction companies routinely manage large payments,
subcontractor and vendor relationships, project documents, customer
information, cloud platforms, and employees working across multiple locations.
Those normal workflows can create opportunities for phishing, credential theft,
Business Email Compromise, payment fraud, and other cyberattacks.
What cybersecurity training should construction employees
receive?
Construction employees should know how to recognize phishing
and unusual requests, protect passwords and MFA, use approved systems for
company information, secure work devices, and report suspicious activity or
mistakes quickly. Training is most useful when it reflects the situations
employees actually encounter in the office and on jobsites.
How can construction companies prevent Business Email
Compromise?
Construction companies can reduce Business Email Compromise
risk by using MFA, securing business email accounts, training employees to
recognize impersonation and unusual financial requests, and independently
verifying changes to banking or payment information. Changes involving money
should be confirmed through previously trusted contact information rather than
through the message requesting the change.
