Transcript: Cyber Security in the Built Environment as we Move into the Next Industrial Revolution

Most of the time, sharing data and sharing platforms, there just comes an awful lot of risk with respect to that. And the top two rated causes of a breach are negligent employee or contractor mistakes causing sources of those breaches. Most owner-operators are very familiar with their core business. You want to talk to them about construction and building information systems and project management and how to actually run the construction jobs. That's all things that they are experts at and that's in their wheelhouse.

Yeah, they can talk all day long, but ask an owner-operator, well, how do you prevent your web-based project management application from an SQL injection attack? You're probably going to get a bunch of blank stares. It's impossible for you to know all of those risks and where they lie. You want to talk about their cybersecurity and go through what's a data mapping exercise. You go through a data mapping exercise of first, understanding what data you have.

Second, you want to understand where that data lives on network, what systems it flows through, where does it reside when it's at rest or in transit. And then you can start to begin to classify that. How much money do you spend on cyber? What tools do you invest in? What policies and procedures and systems do you need in place at the organization in order to prevent that?

That's still one of the significant areas that is really impacting the industry. Hello and welcome to The Constructor Podcast, the best way to build it, episode number 81. I'm your host, Brittany Campbell-Turner, and this podcast is dedicated to helping property owners have certainty in their decisions about their construction projects. We talk about fostering trusting relationships, help you to understand how to lower risk, be under budget and on schedule, and most importantly, exceed your end user's desires. Last episode, it was a celebratory episode of three pretty amazing things.

It was the 80th episode of The Constructor Podcast, second year anniversary from the launch of the podcast, and it also just so happened to be my birthday. It was really awesome because I got to celebrate a little bit with you guys. You guys gave me gifts, which is a simple response to my birthday survey. I was able to give you guys a couple of gifts by sharing my personal and podcast related lessons learned just to share with you guys a little bit more about the survey.

If those of you who are listening haven't had the opportunity to respond to it, go ahead and check it out at constructor.com. It's just a couple questions about what else you guys could really get some value out of, whether it's learning more about lean methodologies, a PDF roadmap on blockchain, even just a hackathon. Any ideas that you guys have, you have an opportunity to respond to in that survey, even ideas about what you want to hear more on the podcast. So if you haven't listened to that episode yet, or if you haven't responded to the survey, please do so at constructor.com.

In today's episode, we'll be speaking with Harvey Johnson with P.B. Mayer's Cyber and Control Risk Service Leader or Partner in Charge. He and I spoke about how technology is becoming more integrated with our personal and work lives, and we're now more able to talk with our buildings and our database systems. So that emergence of predictive analytics, mobile technology, and wearables to different systems, using Internet of Things, this is the cause for data security, and it's becoming more and more important. So Harvey and I discuss how major companies put themselves unknowingly at security risk and they can actually get compromised through construction tools and software.

We talk about how to put the right protocols in place. We talk about how to answer that interoperability question alongside security concerns and how to really get an improved intelligence protocol, risk reduction, and of course, how blockchain could potentially play into all of the security concerns. So with that, let's get into the interview. So today we are speaking with Harvey Johnson with P.B. Mayer's.

He is the partner there. Today we're going to be talking about security concerns specifically in the construction industry from the perspective of owners. So with that, Harvey, welcome to the Constructor Podcast. Thank you. First of all, I would love to just dig into who you are, how do you even get to this space, what got you interested in the area of securing from the ICT side?

P.B. Mayer's is a CPA firm. In addition to being a certified information systems auditor, I am also a CPA and that's like many CPAs, that's how I started my career in public accounting. And while I still work for a CPA firm, that's no longer my role. I am the head of our cyber and control risk services group.

And the firm has always had a consulting arm and done a lot of outsourced internal audit work. And one of the sectors that we had a focus in was financial institutions. And as I'm sure you know, that is a highly automated and very technology driven industry. So we were doing a lot of work in that space. And that's really where I both developed my expertise and my passion for doing IT.

So probably 10 years or so ago, I just kind of saw the ship coming, if you will, the more and more technology was becoming part of our everyday life and the more systems were being automated. I knew long term, 15, 20 years from now, if I wanted to make sure I had a career that IT was going to be a space where there was always going to be a lot of opportunity. And so I was very fortunate enough that the firm supported that vision and have become fully dedicated in the IT and cybersecurity space as a result.

And it was the best career decision I ever made. You saw the writing on the wall and you wanted to follow through with what you really saw, what the industries, I mean, overall, I can't say that there's any industry who's not going in this direction. Everyone's using more technology. And like you mentioned, the financial institutions, I have a couple clients that are financial institutions. That is a huge concern, especially when it comes to money.

They need to make sure that they're keeping everything as secure and permissioned to the right people as possible. So it's a great discussion that we're going to have today. There are lots of concerns, like I said, since I've worked with financial institutions and still am today. I'm curious as to particular concerns and problems that owner and operators should be looking at as they embark on construction projects. Construction is another area that is a focus of the firm and we have a significant practice in and there's a couple of significant issues affecting the industry right now.

And I think still one of the major challenges with cyber in particular is really the unknown. You know, we're fortunate enough now that people have come to accept cyber as a risk to their organization. You know, three to five years ago, small businesses and small and medium sized businesses really didn't have their pulse on this. They kind of looked at this and said, that's for the big boys. That's your Fortune 500, your Fortune 1000, the big banks, your government entities.

Those are the folks that are really being, quote unquote, attacked by hackers. Certainly over the last couple of years with the evolution of ransomware and other malware and just the increase of automated bots and phishing attacks that are happening online, it's really gone well beyond those bigger entities. And now all of the businesses are really feeling the threat and the risk of cyber. So that's one of the good things that now it's becoming recognized at the C-suite and at the owner operator level that, okay, cyber is a risk.

Still the challenge there is the unknown. You don't know what you don't know. And while most obviously owner operators are very familiar with their core business, you want to talk to them about construction and building information management systems and project management and how to actually run the construction jobs. You know, that's all things that they are experts at and that's in their wheelhouse. But cyber is just out of their wheelhouse.

You know, it's just something that they're not comfortable with. You talk to them about those things and yeah, they can talk all day long. But ask an owner operator, well, how do you prevent your web-based project management application from an SQL injection attack? You're probably going to get a bunch of blank stares. Yes.

It's the unknown there. They don't know how to protect the organization. How much money do you spend on cyber? What tools do you invest in? What policies and procedures and systems do you need in place at the organization in order to prevent that?

That's still one of the significant areas that is really impacting the industry. One of the other areas that I know is a big problem for contractors is really third party risk. As construction companies, they utilize a lot of subcontractors and vendors and are most of the time sharing data and sharing platforms. So those project management systems can be updated for current statuses. And there just comes an awful lot of risk with respect to that.

I was looking at some stats from small business trends just this week. And the top two rated causes of a breach are negligent employee or contractor or a third party mistakes causing sources of those breaches. With that flexibility and interoperability of systems, you want your subcontractors to have access to. Well, that also creates a lot of risk in doing so. So you mentioned cybersecurity risk and then the third party interoperability.

Your suppliers, your subcontractors having to actually transfer information to the system that you're using. Do you have any specific examples that we can use to help you reference in order to see this as something that's tangible? Like what happens? Right. What happens when there's a breach?

How can that really affect an organization? Well, that's a really great question. Let's say there is a breach, right? You're a owner operator. You're on a construction site and you have a breach.

Obviously, your customer that you're working on here is going to look to blame someone. Who's at fault there? And even if you're the owner operator and it's one of your subs who is really the source of the breach, the owner is, if you will, is going to fall back to the owner operator. They're going to be the ones who are liable. From the organization perspective, what are we doing to protect ourselves and how do we protect ourselves?

What is your contract say with respect to who's at fault if there is a breach, both from the customer owner perspective as well as the owner contractor perspective? Many of these contractors have had these relationships with subs for many, many years. You may have a kind of a standard sub party agree with subcontractor agreement that's outdated, that doesn't address cyber risk and who's at fault there. The other thing that you want to look at and consider is pushing down those requirements to subcontractor level. We're seeing this a lot in the government contracting space with the DFARs regulation.

If you do work in this space, there is a requirement in the DFARs regulation that the company has to have an information security program. Well, what is a DFARs regulation? DFARs governs is the regulation that governs construction contracts. So when you're dealing with the government, they've got a set of rules and procurement and regulations that an organization must follow. You must meet certain standards if you're going to work with the government because you have access, obviously, potentially to government sites, government data and things.

And so they want to make sure their information is protected. So this DFARs regulations pushes that requirement to the contractor that says, if you're going to work in this space, we expect you to have IT and security controls. And as a result of that, if you're using subs, not only are you the contractor required to have those controls in place, you're required to push that down to your sub and make sure they also have an appropriate IT and security environment. It's that type of relationship or pressure, if you will, that the owners and the contractors have to start applying to their subs to get them in line here.

It's a if we're going to share systems and we're going to share access to data, we need you to have the same level of controls and security at your organization as a sub as you do at the contractor level. You know what I found really interesting, Harvey, and I think it was when we last spoke and let me know if this is something that we can share. But when I was speaking with you, you mentioned that the breach that took place with Target, everyone was notified that their financial information may be under use now by some random guy across wherever.

That happened because of a breach of security due to someone working on a construction site. Could you tell us a little bit more about that? Target is actually a perfect example of what we're talking about with this third party risk. I mean, and just the different attack vectors and ways an organization can be breached. So Target obviously is a public company.

They spend a lot of resources on securing their data. But there's two real valuable lessons from this target breach that owner operators can really take away here. One, this was caused by one of their HVAC vendors. The more automated systems are becoming, an HVAC vendor will come to the client, basically plug right into the network and run scans on the HVAC system to test its health and maintenance and so forth. And in the Target situation, what happened was the HVAC vendor was already compromised.

The HVAC vendor had been compromised by a hacker who was on their systems and their network and essentially just shadowing company to see what it does. When the vendor shows up at Target and plugs right into the network, the hacker had direct access to piggyback right off of them and is now plugged directly into Target's network. So that's a perfect example of how a vendor here is a source and a cause of a breach, posing a significant risk to the organization. The other very valuable lesson with respect to Target is a very simple process, what's called a network segmentation.

So what you want to do as an organization is begin to understand what data you have that's important and start to protect it. The major problem that Target breach would have never happened had the point of sales system, the critical system that Target has been appropriately segmented away from the HVAC system. Those things should have never been on the same network. When the hacker comes in or the vendor comes in and plugs in, if that network isn't segmented, you're dialed right in. You have wide open access to the entire organization and its systems.

And that's what's happened in that example, where if the network would have been just a little extra step to properly segment that network would have prevented that entire breaching happen. I felt that one because I had just purchased a couple items at Target and I said, you know what, I can only imagine how Target is trying to manage from a public relations family. Absolutely. But in addition to that, you know, going down the path and really figuring out how to fix your infrastructure now in order for that to not take place again.

I thought that understanding the steps in order to do so, and I'm sure there are a couple routes you can go, but I think it's hugely valuable that you mentioned that, yes, you do have to separate your major line of business from your HVAC system, right? Where, I mean, yes, you want to be able to hook in and be able to monitor right through your building automation system and things like that, which certainly helps you run your facility. But man, that's a huge challenge. You have to really think through those steps before you embark on doing certain things.

That's where I go back to that first item that we were talking about of just the unknown. You know, that's one of those things where if you would have done a hundred other things right, but you didn't think about that third party vendor plugging right into your network, boy, all that good work that you've done, all that effort that you've made just went right out the window. There are so many different ways to attack an organization. We have so many devices that are connected to the network.

Even if that weren't the source, you know, we've got all of these mobile devices and if their mobile devices were connected to the wireless network in the organization and that device was compromised, that's another avenue and attack vector that could have been exploited by an attacker. So there's just there's so many vulnerabilities. There's so many new things happening every day from an owner operator perspective. It's impossible for you to know all of those risks and where they lie. That's why it's important for organizations to consult with third parties to talk about their cybersecurity and go through what's a data mapping exercise.

We call it a risk assessment. You go through a data mapping exercise of first understanding what data you have. Second, you want to understand where that data lives on network, what systems it flows through, where does it reside when it's at rest or in transit? And then you can start to begin to classify that the point of sales system, your customer information data. Well, that's critical.

We need to protect that our employee data, our payroll, all of that sensitive personal information that you have on your employees. We need to protect that versus some ancillary systems and data that we don't need to protect or spend and invest as much money in. Those are all decisions are very, very relevant as we talk about how to build an information security or cybersecurity program. Thank you for sharing all of the challenges and letting us know how scared we should be. But we're getting into an age where we're using a lot more technology on the job site.

We're using iPads more. We're using drones. We're using technology that uses artificial intelligence in order to either monitor progress or to identify safety risks. You already mentioned the project management software tracking, and then you also mentioned plugging up into a system and understanding where sensors are. So, I mean, that's essentially Internet.

It seems like there are more devices now and more avenues in which we should have concerns about and be more knowledgeable about what those safety risks might be. And doing that risk assessment is a great opportunity to identify those and really just talk through what the different scenarios are and where the information is located in your organization and make sure the critical things are staying safe. Let's talk about the solution. If you were to recommend the top two or the top three solutions for addressing these concerns, you already mentioned the risk assessment.

But if there were some really tangible steps to walk through that, what would those be? Starting with the risk assessment will help identify those unique risks to your organization so you can really develop a scalable program that makes sense for you. Right. You or most smaller organizations and small businesses and our operators don't need the same level of security as, you know, the government or a JPMorgan chase, one of these large financial institutions, right? Everything is relevant to your size and complexity.

And one of the other things that I have conversations with all the time is everyone thinks that it's going to just cost so much money to fix all the problems or to protect the organization. And that's not necessarily true. There's actually a lot of very inexpensive tools and many times free tools that you can utilize to help address some of those risks. As you mentioned earlier, just the number of devices that are connected to the Internet of things and so forth. So with all of those different devices creating risk and a potential entry point for a hacker, we call them an attack vector.

Here's how I can attack the organization. One of the main goals is to identify those technical vulnerabilities and address those. There is a process called network scanning or vulnerability scanning that will essentially commercial software will scan your entire network and any devices that are connected to it, looking for those vulnerabilities. And they'll give you reports on recommendations to address those. Here are things you need to go and fix.

And they're really great. They have links that will take you to the website that gives you more information so you can both understand what the vulnerability is and why it's important and also how to address that. What does the organization need to do to fix that? And that's a very inexpensive tool, very cheap. There are also free versions of that as well.

An Nmap or Zenmap tool is something that will map your network, identify those devices that are connected to it. And if you want to use something like a commercial software, the most commonly used scanning software is called Nessus. It's very inexpensive. I mean, for less than a thousand dollars, a company can buy that for themselves and scan their network at any time looking for those vulnerabilities. Another common tool which is being commonly used right now is multi-factor authentication.

So one of the most common attacks now is someone's identity gets compromised, their credentials get compromised, and an attacker uses those to log into the network as valid user. And then depending on their access within the network can go in and do a variety of things. So one of the tools to address that risk is this multi-factor authentication. Another very, very inexpensive tool that is out there now that if you're accessing the network remotely, you're outside of the office, you're outside of that safe zone, if you will.

In addition to using just your username and password, you have to authenticate via some other method, whether it's a token, use an application at our firm, it's called DoA Bush. It's very, very popular right now. And another very inexpensive tool being utilized where the app is on my device. In order to log into the network, not only do I have to have my username and password, but I've got to have my phone with me as an Apple user. That phone has its own set of security.

So someone would have to have my phone, either have my fingerprint or password to that phone. And then once you attempt to log in, the application sends you a push, a notice that says, hey, we've received this, enter this passcode, or click this button to authenticate that this is you. That one simple tool in itself can reduce, significantly reduce the risk of compromised access. I would say the scanning is critical. The multi-factor, I think when we get into a scenario whereby you're working with a lot of consultants, i.e.

construction, I think it's something that we really all should be thinking about how to request that this is implemented by the project management solutions that we're using today. The SaaS cloud-based software's. A lot of our documents are uploaded there. I mean, and a lot of things are approved through that software. RFIs, change orders, things like that.

If we're really doing well, then payment applications, they're also being uploaded there. So lots of critical information. Is that something that's realistic to impose on, say, project management solution company to say, hey, we want to use multi-factor authentication? Well, there's good and bad news. The bad news is no, you likely, unless you are a very large customer of that vendor provider, you don't have that kind of negotiating power.

They're going to say, no, this is our system. We're going to implement the tools. And when we decide to implement multi-factor, we will. The good news is you don't have to rely on them or wait on them to do that. These multi-factor applications can be an additional layer of security in between those systems that will protect you.

You don't need their authorization, if you will, to use a duo or some other multi-factor authentication tool. You can implement that in your organization. In particular, this is really important job sites, right? Almost all construction sites now have wireless capabilities. There is a router or something that they'll take out to the job site to create that wireless access.

And then again, you have both the contractor and the subs on site accessing these cloud based project management systems to update the status, as you mentioned, deal with change orders and all of these other components of that. Well, utilizing that multi-factor would require you then that before you log in to that project management system, here's an additional step you have to go through. And that is completely independent and separate from that project management solution. So while we don't have that power, if you will, to force it on them, what we do have the power to do is empower ourselves and implement those tools that we're taking those steps.

We're not relying on someone else. OK, would that require for you to ensure that each person that's on the job site logs into the Wi-Fi network before accessing the cloud based solution? Because, I mean, with this mobile technology, right, you could be using your typical cell phone service provider for accessing the Internet. How do you manage that? Now, that's a great point and also kind of really, really ties back to what are the steps we can do.

One of the things that you want to do as an organization in an effort to control all of these devices, right, is you can process our concept known as centralized configuration management. OK, so this is where we try to standardize and centralize how we secure and how we patch devices that are connected to the network. So it's kind of a two step process. One, every laptop, every device that you have can be tailored to have specific security settings. So as an organization, you can deny that access, if you will, from a other point of entry or an unsecured access point and require that in order to access that project management system, you must be connected to either a secure network or a specific network.

You can even limit it to ABC contractors, wireless network that we know that we've set up and that we've secured on the job site versus allowing just any general access to that. So you do that as this process of what we call hardening and putting standard hardening procedures so that every laptop that gets issued, every iPad, every device that gets issued to the organization, they all have the same standards. They're all set the same way. They're all designed with the same security features. And you can do that through this configuration management.

That makes it much easier to manage. One of the obvious causes for many breaches and many particularly ransomware is people going and clicking on things, whether you click on a malicious email, a Facebook link, whatever it is, and that software gets downloaded to the device. Well, if the device has restrictions on it to where that a user can't go and install a program, then that significantly reduces the risk of having that malicious malware being downloaded. That's something that can be controlled by the organization through this process.

And then at the same time on the back end, we can then push out all updates from one place. That's why we call it the central configuration to all the devices. I'm not relying on you, the employee, to make sure I go out to the antivirus and get the most up-to-date antivirus software every other day. I can automatically push that out so that every time you log on to the network, it will A, scan your device to see if you have any malicious malware or other viruses on it.

And if it will, prohibit you from connecting. And B, it can push out any update that we're ready to push out all at once. So we really take it out of the employee's hands and we as the organization control that. That's a great tool for limiting and trying to protect those entry points. I think this is really interesting as a consultant, right?

Who doesn't typically work on my client's networks, right? The architect and the general contractor, subcontractors, the suppliers, they don't either. And so it's the question of, fortunately, what you just mentioned, that centralized configuration in order to push out those abilities, like to prevent the malware to take place. That definitely happens in my organization and contractually, we meet those requirements. But it's one of those things where you're hiring on, you're going through an RFP process now with your architecture firms and also your general contractors.

And it's something to really be cognizant of as you're hiring on partners to work with you to ensure that they're also meeting those similar requirements in their organizations at the level that is required for them to work well with your organization. It almost is scary because it's one of those things where it's like, it could prevent a lot of people from working with you if they don't have these systems in place. Well, it's a really big issue. And that's kind of why I brought that up is this third party risk is being just an issue that is facing so many contractors, right?

Because you want to push that requirement down on them. You almost have to, you almost have to look at those contractor agreements and implement this similar clause that says, we expect you sub to have an information security program and this kind of minimum set of IT controls in place at your organization that they either may not currently have or may not have the resources to have. So it puts a lot of risk to the owner operator to say, hey, this sub that I've been working with for 10, 20 years, do I have to think about finding someone else when I know I trust these folks, they do good work, we have this long standing relationship with, there's a lot to consider there.

I certainly recommend that it's time to start putting that pressure in. And there's a number of different things that can be done, kind of, I guess, certify, if you will, or validate that they're doing those things, those minimal IT procedures that we're requesting of them. Certainly, I think it's important that the owner operators have a good long hard look at those contracts, have a data privacy attorney review those and look for those gaps. You certainly want to start to think about your insurance coverage. And as I mentioned before, who is at fault if there is a breach?

Who is the liability going to fall to? And are we covered? What's our liability? This is our general blanket coverage, good enough? Does it cover third party risk?

Does it cover third party cybersecurity risk? As we see that cyber insurance as a spin off is becoming much, much more prevalent today. These are really, really important issues affecting the owner operators. I think that this is making me and I hope it's making the audience really aware of some of the things that we've already been facing and maybe how open we are more than we think we are. I think it's important for us to do our homework, even in our own organization, to understand where we stand, to understand what the systems are that we have in place, especially as if you're an operator, I think that's something that your IT organization probably is all over.

It's one of those things though, if you're working as a partner, you really do have to be able to speak this language at some level. Like you said, it's not something that your own operator can typically just, you know, spot off. They will give you those blank stares. As much as I would say most of my audience knows that I talk about blockchain a lot, I do think there are interim steps before we get to that point. I want to ask Harvey what his thoughts are on blockchain and the security aspect and what that might look like 10, 15 years down the road for organizations who do want to work in this way for construction projects?

Sure. Well, blockchain is a wonderful technology. It is absolutely going to have a significant impact on both the construction industry and really all industries. I was at a conference a few weeks ago where they shared that a recent study among top executives predicted that by 2025, over 10% of the global GDP information would be stored on a blockchain format. And so this technology is really, really becoming much more commercially utilized.

I'm even fascinated and surprised by the rapid pace of which blockchain technology is being adopted. It's a concept and a technology that has been around for a number of years. It's the technology that supports Bitcoin and other cryptocurrencies, but also has much wider applications to the industry. I mean, from a security perspective, it's wonderful. Unless you ask, I'll spare the audience.

I think if they're following your podcast, it's fairly familiar with what a blockchain is and the technology underlying it, but the benefits of it are just outstanding to creating essentially real-time immediate information, reducing the need to have third-party intermediaries to deliver services and information and communication secures that data. The fact that it is a distributed ledger and you have multiple peer networks validating the information. Once the data is in the blockchain, the data is good. It is almost impossible to reverse and it really eliminates the need for any historical financial perspective.

Blockchain is going to be a huge disruptor to our industry, the CPA industry. I've got an entire service line, our audits, the financial statements that are essentially just going to go away. There'll be no need for them because it's all on the blockchain. You don't need to go back and say, well, are the numbers right and were they good? You don't need to do an audit.

The data has already been validated. It's already on the blockchain. Technology is going to be shifted to start to look at what's the data in the chain? How can we use that data to better manage our business? How can we use that to gain our competitive edge over our competition?

You'll see much more this use of AI and data analytics using the blockchain and these project management systems. We have this construction design. We know what we want to build. What's the most efficient route to build it? What are the most efficient materials to use?

That's where AI will come in and analyze that data and use that data to build those processes. It's wildly fascinating. I'm a huge proponent of the blockchain. The sooner, the better for me. I think one of the biggest risks or challenges, I won't even say it's a risk.

One of the biggest challenges right now with blockchain and the wide commercial use is the storage. You have multiple peer networks that A, have to validate the data. You're storing the same information in multiple places, but part of what makes the blockchain so important and valuable is the history. It's one set of data on top of another, on top of another. After a while, that storage and that data starts to become very voluminous.

I think the capacity, the storage right now is one of the initial challenges, but they're making such progress now with chips and servers and virtualization that won't be a problem for very long. I think the technology is moving faster. A lot of people have thought, I love that stat you said by 2025. Well, that's on a global perspective, 10%. 10% is a small number, but when you talk about globally, that's a lot of data.

So then a lot that I think that's a little bit slow in my opinion, certainly from the US perspective. We're going to be a lot further along than that by 2025. You've got Amazon as a blockchain service right now. I mean, the fact that Amazon is getting their hands into it, you know it's pretty close to being on a commercial perspective, widely getting ready for use. And I think that there are a lot of companies who will be adopting the technology without necessarily saying, we're using blockchain.

Because why would you? All you would say is, we're having more efficient processes. Your data is more secure than it ever has been. It's supported by the blockchain, but you don't really need to know all the details. You just need to know that you have a better system, you have a better user interface, you have a better user experience.

And those are all very interesting things. Thank you for your feedback. Absolutely. And I think what you'll see there, in particular as this data privacy, as information security in general becomes more and more of a big topic. We just had this situation with Facebook and the data sharing.

And I would expect to see there's already been a number of bills being drafted to this. You're going to see more and more emphasis on data security, and not just from a personal or consumer perspective, from the organizational perspective. And the blockchain is going to be the technology that allows organizations to comply with that. That is going to be one of their most significant avenues to meeting those regulatory and compliance challenges is by utilizing blockchain technology. And it allows for organizations where there are many different partners to really hurdle this interoperability challenge, if you will.

That's what I'm seeing at least. There's going to need to be some time where we figure out how to use the different solutions together. That's going to be our next step. There's going to be a lot of little programs that are built on blockchain technology, and they won't be able to talk to each other, especially if they're using different protocols like the Bitcoin protocol or Ethereum protocol or whatever it might be. Interesting thought.

Well, with that, did you want to leave the audience with anything? Do you have any other thoughts that you wanted to share? I think we've covered it. I think it's an important critical step. You don't know what you don't know.

And until an organization has done a risk assessment and identified that data, what's important and where it is, and started to look at what its weaknesses are, that's the one thing a risk assessment will do. We'll take these IT frameworks and these best practices and say, what are you as an organization doing today versus what you should be doing in order to build an information security program? And it identifies those gaps. So one of the things we do is we help companies by saying, here are your weaknesses today.

Here's your current cyber maturity state, if you will. And here's a roadmap for you to begin to embark down that journey of building a cybersecurity risk management program at your organization, because that's going to take some time. It's going to take some resources. And again, most people think it's very expensive to do so. It's not that expensive.

There are a lot of these tools that are either free or very, very affordable solutions. But doing a risk assessment is that critical first step that an organization has to take that's really, really serious about addressing its cybersecurity risk. So with that, Harvey, this has been a pleasure. Thanks for joining me and doing this interview with me. Please tell the audience where they can find more information about you.

And then in addition to that, about PBMares. Thank you, Brittany, for having me. It's been my pleasure to be with you today. We, PBMares has a great blog where you can find numerous posts on both construction and cyber and you can sign up and receive updates from our website. Please check us out at www.pbmares.com.

We are also on Facebook, Twitter and LinkedIn. I encourage you to follow us there as well. Thanks so much, Harvey. And we'll be talking with you soon. Thank you, Brittany.

If you'd like to learn more about Harvey and PBMares, check out the show notes at constructer.com. If you learned something valuable in this episode, share it with your friends and colleagues. You can also let me know you've enjoyed our discussion by connecting with me on Twitter at Brittany underscore CT or find me on LinkedIn. You can also email me at Brittany at constructor.com. That's B R I T T A N I E at construct double R dot com.

Next week, we will be recapping the lean construction Institute design forum. You will be hearing from people who attended the design forum, their thoughts about the event, and more importantly, how lean can be brought into the project process much earlier. So pre construction and design in order to deliver a more optimal result on projects. I actually had the opportunity to meet and speak with the co founder of the lean construction Institute, Glenn Ballard, and we had an amazing discussion. We were talking about building a project team where psychological safety is the standard.

I also speak with a representative from the University of Chicago about their experience using lean methodologies, and actually quite a few other awesome people. So I look forward to sharing this episode with you guys next week. If you haven't already subscribed to the podcast, you can do so at your preferred podcast player. Please leave a review to show your support and let me know you're enjoying the podcast. I look forward to talking with you guys next week.