Keywords

9.1 Introduction

Sustainable development constitutes one of the highest priority topics on most national agendas, and energy efficiency has a critical role in achieving sustainability targets. Buildings consume a significant amount of energy (Lynn et al., 2021); therefore, reducing the energy consumption of existing buildings can help countries achieve these targets and enhance global energy efficiency. Shnapp et al. (2013, p. 19) define deep renovation as “a renovation that captures the full economic energy efficiency potential of improvement works, with a main focus on the building shell, of existing buildings that leads to a very high-energy performance”Footnote 1. While widely referenced, it is important to note that there is no consensus on the definition of deep renovation and the associated minimum energy reduction required.

Deep renovation can be considered a specialised subcategory of construction. It thus passes through similar stages (e.g., design, construction/retrofitting, operation and maintenance (O&M) and end of life) as with other construction projects, even though its scope involves retrofitting existing buildings rather than building one from the ground up. Therefore, technological advances in the construction industry and the concerns related to these advances are also applicable to deep renovation projects. The digitalisation that the construction industry is going through, often referred to as Construction 4.0 (Klinc & Turk, 2019), affects the information generated and used and the physical tasks performed during the construction and O&M phases (Garcíade Soto et al., 2020). While this transformation improves the cost and time efficiency of processes and construction quality, it also leads to substantial cybersecurity concerns, as with other digitalised industries. The convergence of information technology (IT) and operational technology (OT) (Harp & Gregory-Brown, 2015) further exacerbates the difficulty and complexity of addressing such concerns. Furthermore, safety issues arise due to the increasing use of OT to perform (e.g., autonomous excavators to handle earthworks) and monitor (e.g., autonomous site monitoring devices) site activities (Sonkor & García de Soto, 2021). As a result, the significance of providing robust cybersecurity increases during all phases of construction projects to prevent the exposure of sensitive information and any potential physical damage.

The rest of this chapter is organised as follows. Next, we discuss major types of cybercrimes that affect the construction industry and the related laws and regulations. We then outline some prominent cybersecurity standards, codes of practice and frameworks applicable to the construction industry. Following a review of relevant cybersecurity research organised by the deep renovation phase, we explain the need for a contingency approach to cybersecurity in the construction industry that takes into account the differences in projects, organisations and contexts while highlighting that there cannot be a one-size-fits-all solution for all different sizes of companies and deep renovation projects.

9.2 Cybercrimes and Cybersecurity in Construction

Increased connectivity, remote working and the increasing sophistication of malicious actors are contributing to a rise in cybercrime (FireEye, 2021). The construction sector is not insulated from this trend. As more and more buildings become reliant on remotely operated software systems and the Internet of Things, the attack surface and associated vulnerabilities and risks increase. Construction companies and their employees, specific projects and building systems have been targeted by a wide range of cyberattacks, including phishing, ransomware, denial of service, identity theft and other types of unauthorised access (Nordlocker, 2021; Korman, 2020; Turton & Mehrotra, 2021; Rashid et al., 2019). While financial gain is a common motivation for such attacks, it is not always the case. For example, in 2016, hackers launched a distributed denial of service (DDoS) attack on two residential buildings in Finland by temporarily disabling the computer systems that controlled the heating and hot water distribution systems, resulting in obvious inconvenience and distress for residents (Ashok, 2016). Unsurprisingly, governments worldwide have responded to the threat of cyberattacks. These actions include enacting new laws focusing on cybercrimes and introducing acts and regulations that define criminal offences and the related sanctions. Notwithstanding this, few are specifically focused on the construction industry and buildings per se. Table 9.1 summarises common cybercrimes, examples from the construction industry and related laws and regulations.

Table 9.1 Common types of cybercrimes, examples from the construction industry and related laws and regulations
Full size table

9.3 International Standards, Best Practices and Cybersecurity Frameworks

In recent years, national and international institutions have been active in producing standards and guidelines to support companies in assessing their current cybersecurity levels and setting targets for the future. While the overwhelming majority are aimed at the IT sector or firms in general, there are several codes of practice and guidelines aimed at the architecture, engineering, construction and operations (AECO) sector specifically. As modern buildings make widespread use of automation and control systems, for example, for heating, and such systems have been the target of cyberattacks, standards and guidelines for the security of such systems are also relevant. While some are industry-specific, others were designed in a generic way to cover a wide range of sectors. Some of the commonly used standards and procedures for cybersecurity are presented in Table 9.2.

Table 9.2 Summary of the commonly used cybersecurity standards and procedures
Full size table

In addition to standards and protocols for security and control systems, there are several codes of practice and guidelines. Some are general (for any industry), but others specifically address the construction sector. While codes of practice do not purport to replace standards, they provide guidance and support for achieving standards. Table 9.3 summarises some of the prominent codes of practice, guidelines and frameworks for cybersecurity.

Table 9.3 Summary of the commonly cite codes of practice, guidelines and frameworks for cybersecurity
Full size table

9.4 Related Cybersecurity Research by Renovation Phase

To date, scholarly research has focused primarily on the advantages and potential benefits of increased digitalisation of the construction sector. In comparison, cybersecurity aspects have received less attention. There are notable exceptions. For example, Turk et al. (2022) proposed a systematic framework to address the cybersecurity problems specific to construction projects. Their framework identified cybersecurity as “the absence of the three wrongs across the four kinds of elements” (Turk et al., 2022, p. 1). The three wrongs refer to stealing, harming and lying. The four elements that might be affected by such wrongful activities are material, information, person and system. After defining cybersecurity, they customised the framework to reflect construction-specific characteristics. These characteristics include the multi-stakeholder settings of projects, overlapping boundaries of different entities involved in different projects and having distinct stages (e.g., design, construction and O&M) with particular challenges.

Several studies in recent years have discussed various aspects of construction cybersecurity and suggested solutions across the construction and deep renovation life cycle. Zheng et al. (2019) stressed the lack of studies concerning the information security aspects of BIM during the design and planning phase. In order to improve confidentiality and reduce the risk of data breaches, a context-aware access control model named CaACBIM was proposed. Mantha et al. (2021) pointed out that the sensor data collected during the commissioning phase can be altered by malicious actors (e.g., an owner with a malicious intention or a competitor). In order to address this threat, they proposed utilising an autonomous robotic system for randomised check-pointing and illustrated its feasibility with an example.

Modern construction and retrofitting make increasing use of (semi)autonomous and remote-controlled equipment (Sonkor & García de Soto, 2021). This includes the use of complex cyber-physical systems, such as industrial machinery and vehicles (e.g., cranes), exoskeletons, unmanned aerial vehicles (UAV),Footnote 2 on-site and off-site automated fabrication and additive manufacturing,Footnote 3 to name a few. Notwithstanding the pervasiveness of such equipment, a recent survey of cybersecurity research on such construction equipment by Sonkor and García de Soto (2021) revealed a paucity of studies.

Many of the construction cyberattacks identified in Table 9.1 occur in the O&M phase of construction projects, particularly in smart buildings. Pärn and Edwards (2019) presented the potential cybersecurity issues for CIs during the O&M phase and suggested using blockchain technology for data exchange and storage as a mitigation action. Several studies focused on the cybersecurity aspects of smart buildings. Wendzel et al. (2014) discussed botnets’ abilities to control and monitor building automation systems (BASs) and their potential damage to the built environment. On a related topic, Mundt and Wickboldt (2016) undertook a study to identify the cyber risks, possible attackers and attack vectors related to BASs. They presented the security gaps found in two case studies to prove that additional attention is required to ensure robust BAS security. Mirsky et al. (2017) showed how air-gapped building management networks could be attacked using a compromised heating, ventilation and air conditioning (HVAC) system. Lastly, Wendzel et al. (2017) investigated the potential attacks against smart buildings and proposed solutions to protect them.

Interestingly, few studies explore the end-of-life phase of buildings and construction projects from a cybersecurity point of view. As building systems may retain sensitive data that can be exposed due to vulnerabilities, care needs to be taken to ensure suitable cybersecurity safeguards are in place.

While it is useful from a research perspective to use a phased approach to identify gaps in the literature, many actors and systems in the construction and renovation process are present across the entire life cycle, particularly as a consequence of digitisation. As such, full life-cycle approaches to cybersecurity assessment and associated research are needed. For example, Mantha and García de Soto (2019) investigated the vulnerability of different project participants and construction entities during the different phases of the life cycle of construction projects as a consequence of Construction 4.0. Their study considered potential risks and provided a basis for assessing the impact of interactions in a digital environment among different project participants. Considering the increasing use of IoT, edge computing and artificial intelligence (AI) and the likelihood that every stage of construction and deep renovation projects is expected to rely on these technologies in the near future, their cybersecurity vulnerabilities and risks require more attention (Ansari et al., 2020).

9.5 The Need for a Contingency Approach

The primary purpose of all the previously mentioned cybersecurity standards, frameworks, guidelines and academic studies is to improve the cybersecurity level of projects and organisations. However, considering the variety in functions, roles and scale differences in construction and deep renovation firms and projects, a one-size-fits-all cybersecurity approach may not be desirable or feasible. For example, public companies will have to meet specific accounting standards to ensure adequate controls are in place, and multinational firms may have to deal with a wide range of cybersecurity and data protection requirements. Similarly, specialist craft renovations are likely to have different cybersecurity requirements and demands than more generic and large-scale construction/renovation projects. Each stakeholder constitutes a different cyber risk, and each one has various cybersecurity concerns. Therefore, care needs to be taken to ensure that an appropriate cybersecurity assessment and associated controls are put in place that can accommodate the range of projects and firms that characterise the sector.

9.6 Conclusion

The integration of construction and digital technologies such as IoT, machine learning and cloud computing disrupts how construction projects are planned, constructed and operated, making the construction industry and buildings easy targets. At the same time, the sophistication and volume of cyberattacks are increasing. As an inevitable consequence, maintaining robust cybersecurity becomes an everyday challenge. Deep renovation projects face the same hurdles as any other construction project when it comes to protecting sensitive information and maintaining safety. This chapter provides an overview of the cybersecurity efforts in the construction industry and deep renovation and presents relevant frameworks, standards, codes of practice and research. Furthermore, it discusses the need for a contingency approach while considering the cybersecurity requirements of deep renovation projects and the firms that deliver them. There is no silver bullet in cybersecurity. Cybersecurity considerations and related actions should be an indispensable part of deep renovation projects from planning to the end of life, taking into account the needs of all stakeholders.