Despite the fact that most Canadian real estate companies now build smart tech into their buildings to monitor, manage, and maintain many functions, such as heating, lighting, elevators, power meters and fire alarm systems, very few have invested to ensure these systems can’t be hacked, finds new research from KPMG in Canada.
A survey of 17 of Canada’s biggest publicly traded and privately owned real estate organizations, representing more than $160 billion in real estate assets, found that nearly 80 per cent of Canadian real estate companies do not proactively monitor their operational-technology (OT) network or devices for cybersecurity threats or vulnerabilities.
Half (50 per cent) do not have an inventory of their OT assets and about a quarter (22 per cent) have an inventory that’s incomplete or not updated regularly, the research found. Patches – a key control to resolve new vulnerability – are rarely done and usually in ad hoc manner.
“Smart or intelligent building technology is commonplace in the industry today and holds many benefits, but it also comes with risks that could result in significant health and safety issues,” says Tom Rothfischer, Partner and National Industry Leader for KPMG in Canada’s Building, Construction, and Real Estate practice. “It is critical that these measures are built into their systems right up front. But the reality is that most companies now find they are playing catch-up to seal the security gaps.”
The research found that most real estate companies have a cybersecurity program with the majority having very small in-house teams responsible for key cybersecurity activities. However, their roles and responsibilities aren’t clearly defined. And, while the board is regularly informed on the organization’s information-technology posture (that is, the ability to predict, prevent, and respond to cyber threats or attacks), they are not kept up to date on the OT posture. Only about 10 per cent of the companies report on their OT security posture or OT readiness.
The survey did find that the majority (83 per cent) have segregated their information- and operational-technology networks, reducing the risk of cyber attackers moving between networks.
“This is an important first step, but it can’t be the only step,” says KPMG’s John Heaton, a cybersecurity partner. “OT and IT networks typically do not have the same protection mechanisms. As well, many OT devices run on older versions of software that are no longer supported.
“The last thing you want is for attackers to infiltrate and insert malicious code into your systems to modify or take over the controls and cause a malfunction,” he says.
Source link
Related
