{"id":1004603768,"date":"2022-09-28T18:38:26","date_gmt":"2022-09-29T02:38:26","guid":{"rendered":"https:\/\/www.commercialsearch.com\/news\/?p=1004603768"},"modified":"2022-12-08T18:57:26","modified_gmt":"2022-12-09T02:57:26","slug":"the-cdo-stack-cyber-risk-in-real-estate","status":"publish","type":"post","link":"https:\/\/www.commercialsearch.com\/news\/the-cdo-stack-cyber-risk-in-real-estate\/","title":{"rendered":"The CDO Stack: Cyber Risk in Real Estate"},"content":{"rendered":"

It\u2019s a big topic that, according to a recent Deloitte survey, is on the minds of our real estate clients across the globe. We asked 450 CFOs what might have the biggest negative impact on their financial performance in 2023, and cyber risk tied with workforce dynamics and sustained high inflation as the threats or challenges that they\u2019re most worried about. The results made me wonder why cyber risk ranked so high, and I think the answer is twofold.<\/p>\n\n\n

\n
READ THE DIGEST<\/a><\/div>\n<\/div>\n\n\n
\"John<\/a>

John D’Angelo<\/p><\/div>\n

First, high-profile examples of cyber crimes have been plentiful in the news recently, so it\u2019s no surprise that threats have intensified. Second, I believe the steps required to identify, monitor, manage and mitigate cyber risks are inadequately understood in the commercial real estate industry. Put simply, the bad guys are probably far ahead of us, we seem to know that, and there\u2019s general concern that the gap will cost us in financially.<\/p>\n

Not to give you more to worry about, but in the cause of building awareness, let\u2019s look at some of the forms that cyber crimes can manifest in the real estate industry.<\/p>\n

With buildings becoming more connected and smarter, the amount of data streams within a building and the number of systems and devices has risen dramatically. All that data and all those different systems represent cyber-crime opportunity that ranges from mischief to deadly threats.<\/p>\n

One recent example involves an office building that had to be evacuated as cyber criminals accessed a building management system and raised the temperature to triple digits. While not life-threatening, it\u2019s a good example of what can happen if the building management system or individual building systems are compromised. A friend who leads asset management at a big real estate investor confided in me that one of her nightmares is getting a call that a cyber-criminal has control of an elevator car with people in it being held for ransom. A nightmare indeed.<\/p>\n

Taking action<\/h2>\n

Theft and ransomware have long been cyber threats to the industry. With criminals becoming increasingly organized and sophisticated, and the volume and dollar amount of transactions in the industry being high, it\u2019s not surprising that attacks are on the rise. Particularly for those sectors in which personally identifiable consumer information is stored, understanding data sensitivities and vulnerabilities is important. And there are internal threats to consider. Understanding what digital information is leaving an organization, with whom, and for what purpose are all topics that should be addressed if they haven\u2019t already been.<\/p>\n

Regardless of the type of threat, it\u2019s important to have at least a broad understanding of the nature and potential implications of cyber threats. Whether through a single leader or distributed team, your level of expertise, plans, and activities should match the threats specific to your organization and adapt to them.<\/p>\n

It\u2019s also important to understand that cyber risk isn\u2019t static. I\u2019ve written a great deal about the form and substance that digital transformation is taking in the industry. While digital transformation is great, it introduces change in exposure that needs to be addressed in lock step with the transformation.<\/p>\n

\"\"<\/a>

Image by BlackJack3D\/iStockphoto.com<\/p><\/div>\n

Regardless of your organization\u2019s size, complexity and level of cyber maturity, following the 4 A\u2019s\u2014assure, advise, anticipate, and accelerate\u2014will help you get on track and stay there. \u201cAssure\u201d requires \u00a0taking the steps required to validate the effectiveness of your cyber program. \u201cAdvise\u201d means key stakeholders collaborating, understanding, and prioritizing cyber risks and activities based on the unique circumstances of your organization. \u201cAnticipate\u201d refers to taking the actions required to evolve your cyber program as your company and its technologies change. And \u201caccelerate\u201d calls for raising organizational awareness of cyber threats and ensuring you\u2019re prepared to act when weaknesses or threats are discovered.<\/p>\n

If you\u2019re not sure where your organization stands, ask internal audit, IT leadership, and your information security leaders about these key issues:<\/p>\n