Cybersecurity for Construction Companies in Singapore

Strengthen Your Construction Business Against Ransomware

Learn how Cybersecurity Risk Assessment, vendor security and ISO 27001 to protect project data and critical systems.

A Singapore construction group was hit by ransomware through a telephony server its vendor was supposed to keep patched, but the responsibility wasn’t clearly defined. TreeLabs Consulting helps construction companies lock down vendor responsibilities, patching and access, and build an ISO 27001-aligned defence against ransomware.

Real Incident

Ransomware through a vendor-managed server

December 2023 – KB Group entities (including Koh Brothers Building & Civil Engineering Contractor). Ransomware entered through a vulnerability in a Mitel IP telephony server managed by a third-party vendor. Responsibility for patching was not clearly defined between the group and its vendor. Files holding the personal data of 11,718 people, mainly current and former employees, were encrypted and deleted, and 5,748 people’s data was confirmed leaked on the dark web. The data included NRIC/FIN numbers, bank account details and salary information. PDPC accepted a voluntary undertaking from the group. Source: September 2024; PDPC

Business Pain

Ransomware, data exposure and disruption for construction companies in Singapore

Ransomware turns a single missed patch into a company-wide problem:

  • RANSOMWARE RISK. Ransomware can encrypt or delete critical files, disrupting construction operations.
  • DATA EXPOSURE AND PDPA RISK. Personal data including NRIC/FIN, bank and salary data can be exposed in a Construction Data Breach PDPA incident.
  • OPERATIONAL DISRUPTION. Lost or inaccessible files can cause downtime, payroll delays and project disruption.
  • COMPLIANCE RISK. Personal Data Breach PDPA incident can trigger regulatory action and significant penalties
  • IT VENDOR SECURITY RISK. Outsourcing IT does not outsource accountability. Clear IT vendor security responsibilities and Patch and Vulnerability Management for Contractors are essential.

What your company should do

Ransomware Protection checklist

  • CONDUCT CYBERSECURITY RISK ASSESSMENT. Identify critical systems, vulnerabilities and cyber risks.
  • DEFINE IT VENDOR SECURITY RESPONSIBILITIES. Clearly assign patching, response times and security responsibilities.
  • STRENGTHEN PATCH AND VULNERABILITY MANAGEMENT. Track systems, vulnerabilities, patches and remediation deadlines.
  • REVIEW ACCESS CONTROLS. Limit access to project data and systems based on business needs.
  • MAINTAIN AN INCIDENT RESPONSE PLAN FOR CONSTRUCTION COMPANIES. Prepare your team to respond quickly when systems or data are compromised.
  • PROVIDE CYBERSECURITY AWARENESS TRAINING. Train employees to recognise, prevent and report cyber threats.

How TreeLabs Consulting helps

Cybersecurity Risk Assessment, Patch and Vulnerability Management and ISO 27001

TreeLabs Consulting helps you turn these steps into a working, auditable system

  • CYBERSECURITY RISK ASSESSMENT. Identify your critical systems, vendors and weak points with Cybersecurity Risk Assessment Singapore.
  • ISO 27001 FOR CONSTRUCTION COMPANIES IN SINGAPORE. Compare current practice with ISO 27001 for construction companies and identify gaps.
  • ISMS DEVELOPMENT AND POLICY SUPPORT. Develop practical policies and procedures covering supplier security, patch management, access control and incident response.
  • ISO 27001 CYBERSECURITY AWARENESS TRAINING. Strengthen security awareness with ISO 27001 Awareness Training.
  • INFORMATION SECURITY AUDIT. Conduct internal checks and prepare for your organisation for an external Information Security Audit