Cyber security challenges and vulnerability assessment in the construction industry

Abstract

The construction industry is making a shift towards digitization and automation (known as Construction 4.0) due to the rapid growth of information and communication technologies as well as 3D printing, mechatronics, machine learning, big data, and the Internet of Things (IoT). These technologies will transform the design, planning, construction, operation and maintenance of the civil infrastructure systems, with a positive impact on the overall project time, cost, quality, and productivity. These new technologies will also make the industry more connected, and the consideration of cybersecurity of paramount importance. Although many studies have proposed frameworks and methodologies to develop such technologies, investigation of cybersecurity implications and related challenges have received very less attention. Some work has focused on security-minded BIM, but it lacks generality or does not consider an approach to determine the vulnerability of the different project participants, construction processes, and products involved during the different phases of construction projects. To address these limitations, this study a) develops a framework to identify cybersecurity risks in the construction industry, and b) assesses the vulnerability of traditional and hybrid delivery methods based on an agent based model (ABM). That is, the vulnerability of different project participants and construction entities during the different phases of the life-cycle of construction projects as a consequence of Construction 4.0. The findings from this study help to identify potential risks and provide a basis to assess the impact of interactions in a digital environment among different project participants. Future work aims to thoroughly investigate the proposed ABM approach and extend the same to other project delivery methods and information exchange networks in construction projects. IntroductionAfter a long history of under -digitization , the construction industry is making a shift towards digitization and automation due to rapidly growing information and communication technologies such as 3D printing , blockchain , and robotics. This is referred to as Construction 4.0, which is the construction industry's surrogate of Industry 4.0. The aim is to have connected systems at every stage in the life-cycle of a construction project , starting from the bidding phase to the end of life, including operation and maintenance. One of the key benefits of Construction 4.0 is the utilization of data as a result of digitization and connected systems during different life-cycle stages. Due to the nature of construction projects, large amounts of data are generated, such as competitive bidding information , design specifications , engineered calculations , intellectual property related information , pricing , profit /loss data, banking records , employee information , quality , safety , and productivity related standards and practices . In most cases, this data contains highly confidential, sensitive, or proprietary information.

Investigating major challenges for industry 4.0 adoption among construction companies

“…Data protection and cybersecurity is a major concern for the construction companies. Mantha and de Soto (2019) implied that the Architecture-Engineering-Construction (AEC) industry has already been experiencing cyberattacks such as stealing private information, accessing unauthrozied files, and remove records. The expansion of digital platforms on…”

“…Therefore, the construction companies must work towards developing their infrastructure and organizational structure in terms of handling the cybersecurity risks.. However, there is not yet an avaiable standard to develop a procedure for identifying such risks in the construction industry (Mantha and de Soto, 2019). Hence, data protection and cybersecurity is listed as an essential challenge for the I4.0 implementation in the construction industry due to the fact that the construction companies do not still have a definite plan or procedure to follow for protecting digital assets.…”

Cybersecurity in Construction: Where Do We Stand and How Do We Get Better Prepared

“…With a few exceptions, the publications related to understanding cybersecurity aspects in the construction sector are limited. For example, Mantha and García de Soto (2019) investigated the spread of vulnerability in construction networks using an agent-based modeling approach. They considered two construction networks, one resembling a traditional delivery system in which construction participants are more segregated (e.g., Design-Bid-Build or DBB) and another with higher integration and combination among the different stakeholders (e.g., Integrated Project Delivery or IPD).…”

“…With increasing interest and implementation of digital models and automation, this will be of great concern to the AEC industry. Although (Mantha and García de Soto, 2019) enumerated and taxonomized some of these data elements for a particular delivery method and specific construction stakeholders during the construction phase in the context of cybersecurity, a comprehensive investigation of the information and communication technologies (ICT) across different life cycle phases of the project is still missing. In addition, Parn and Edwards (2019) suggested some measures to secure the stored and managed information through the CDE.…”

Implementation of the Common Vulnerability Scoring System to Assess the Cyber Vulnerability in Construction Projects

“…Due to the inherent nature of construction, almost all the entities are interrelated and hence can compromise and impact each other with very few exceptions. For example, [15] showed how the vulnerability of an individual entity impacts the whole construction network due to the existing information and communication exchange channels. An example of an exception can be when a potential vendor who is not part of the construction project yet, might not have any communication or association with the existing entities (e.g., contractor), and hence the vulnerability of such a potential entity might not have any impact.…”