An HVAC vendor connected to a customer's network. In Harvey Johnson's account of the Target breach, the vendor's own systems had already been compromised, so that routine connection gave an attacker a path into the customer's environment.
Harvey used the example in 2018 to explain network segmentation. The point-of-sale system and the HVAC system should not have been reachable through the same network path. A connection that was ordinary for maintenance became consequential because it reached much farther than it needed to.
For construction and building operations, that story turns cyber risk into something visible: a person or company has access to one system, and that access may open a route to another.
Follow the access across company lines
Harvey Johnson described contractors, subcontractors, and vendors sharing data and project platforms. He summarized the starting problem as, “You don't know what you don't know.” Status updates, documents, approvals, change orders, and payment information could move through cloud software and jobsite networks. Each additional participant changed the access picture.
Contracts were part of that picture. Harvey said older subcontractor agreements might not address responsibility for a breach. He used government contracting requirements as a 2018 example of security obligations flowing from a prime contractor to its subcontractors when they shared systems or sensitive information. That example belongs to the source date and is not current legal guidance.
The operating question is narrower: when one company receives access, has the project also defined the controls and responsibility that come with it?
Segment the systems that do not need to touch
Harvey Johnson's Target example showed why a system map needs boundaries, not just names. A building vendor may need access to an HVAC system. That does not mean the same connection should reach financial, operational, or other critical systems.
Segmentation limits the path. It does not guarantee that a breach cannot occur, but it can reduce what a compromised account, device, or vendor connection can reach. The team first has to identify the important systems and understand how they are connected.
Build controls to fit the organization
Harvey Johnson did not prescribe the same security program for every company. He recommended starting with a risk assessment, then choosing controls that fit the organization's size and complexity. His examples included mapping data, scanning connected devices, separating networks, and adding multi-factor authentication.
In the episode, multi-factor authentication was especially relevant to jobsite access. Harvey explained that an organization could add an authentication layer even when it could not persuade a software vendor to change the vendor's product. He framed that as one control the organization could own for itself.
Trace one real route before adding another tool
Choose a workflow that crosses a company boundary, such as a subcontractor updating a project platform or a vendor connecting to a building system. Draw the route from the person's login or device to the data and systems it can reach. Beside each connection, record four things:
- Name the person or company that needs access.
- Describe what that party needs to do.
- Identify which systems should remain unreachable.
- Assign the contract term and technical control.
That review will not resolve every cyber risk. It will show whether ordinary project access has been allowed to travel farther than the work requires. In a connected building environment, that is a useful place to begin.
