Constructing Cyber Resilience: A Focus on Cybersecurity Measures in the South African Construction Sector ^†

Abstract

In addressing the challenges of cyber threats in the South African construction sector, the study employed a quantitative methodology involving a questionnaire retrieved from 86 of the study’s respondents. It employed tools like mean item score (MIS), standard deviation (SD), and the pattern matrix of exploratory factor analysis (EFA). The findings revealed critical cybersecurity measures, including adherence to international information security standards such as the General Data Protection Regulation (GDPR), ISO 27001, or the Cybersecurity Framework by NIST, two-factor authentication, and strategic planning. The implications of these findings underscore the importance of robust cybersecurity frameworks and heightened awareness. This research contributes insights for enhancing cyber resilience in the construction industry, urging stakeholders to prioritize protective measures against cyber risks.

1. Introduction

The construction sector is increasingly dependent on technology for project management, financial operations, and communication, rendering it an appealing target for cyber threats [1]. Cybersecurity breaches within the construction industry can result in significant consequences, such as financial losses, reputational harm, and the erosion of clients’ trust. Additionally, these cyberattacks can disrupt project timelines, causing delays and escalating costs. This insight is reinforced by [2], 2019, who advocate for the integration of cybersecurity into the corporate governance strategy of the construction and infrastructure industry. They argue that this approach fosters trust among stakeholders and investors.

The South African construction industry is increasingly becoming a target of cyberattacks owing to its lack of proper cybersecurity measures [3,4,5]. It was stated that the industry is vulnerable to cyberattacks because of the sensitive and confidential information it handles, such as project designs, financial information, and the personal data of employees and clients. A cyberattack on the construction industry can result in significant data loss, project completion delays, and financial losses for companies and clients [6]. This study investigated and proposed effective cybersecurity measures for enhancing cyber resilience within the South African construction sector, mitigating the risks associated with cyber threats and safeguarding critical infrastructure projects.

2. Literature Review

2.1. Security Tools Used to Counter Cyberattacks

These security tools can be utilized to combat cyberattacks in various industries, including construction. As outlined in the study conducted by Eunice et al., [7], these tools include the following.

2.1.1. Firewalls

Firewalls are network security systems designed to oversee and regulate traffic proficiently, encompassing both inbound and outbound data, by adhering to predefined security protocols and regulations [7]. They are positioned at the border of two networks and monitor traffic between them. Modern firewalls are robust and feature-rich, capable of matching incoming traffic against complex rules to protect networks from threats and malicious actors [8]. It is important to ensure no traffic bypasses the firewall and to ensure comprehensive inspection of the communication process [7,8].

2.1.2. Intrusion Detection System (IDS)

An intrusion detection system (IDS) can be either a hardware device or a software application employed to scrutinize networks or systems for signs of malevolent actions [7]. Upon detecting any such malicious activity, it initiates a notification or alert. In information security, a network-based IDS (NIDS) is crucial to identifying security violations such as unauthorized access or the alteration, duplication, or destruction of information systems [9]. The NIDS works alongside other security tools, such as firewalls and antivirus software.

2.1.3. Digital Certificates

Digital certificates are attachments to electronic messages used to verify the sender’s identity [10]. They employ public-key cryptography, utilizing widely disseminated and privately held private keys. Public-key infrastructure (PKI) is a system that facilitates the creation, storage, and distribution of digital certificates to verify the association of a specific public key with a particular entity [11].

2.1.4. One-Time Password (OTP)

A one-time password is a password that remains valid for a single login session or transaction [12]. Time-based one-time password (TOTP) algorithms generate unique passwords using a shared key and the current time. A TOTP is commonly used in two-factor authentication processes, where users provide their username, password, and a generated TOTP to complete the login process [10].

2.1.5. Two-Factor Authentication

Two-factor authentication adds an extra layer of security by verifying users’ identities through their mobile devices [13]. It is a form of digital multifactor authentication widely used in various online services, including payments, communications, and access rights management. Users typically need to enter a special code, received through SMS or obtained in advance, in addition to their username and password [14].

2.1.6. Biometrics

Biometrics involves measuring and analyzing the physical and behavioral characteristics of respondents for authentication and authorization purposes [15]. It provides an additional layer of security by protecting password hashes from rainbow table attacks [16].

2.1.7. Digital Signature

A digital signature is an electronic endorsement that secures documents by employing distinctive digital codes that are challenging to replicate [7]. Digital signatures are crucial in terms of countering cyberattacks on IoT systems, ensuring the integrity of messages, verifying the sender’s identity, and preventing message disownment [12].

2.1.8. Vulnerability Scanning Tools

Vulnerability scanning tools aid in identifying system vulnerabilities [12]. Vulnerability assessment and penetration testing (VAPT) assesses the effectiveness of security measures in web applications to safeguard against emerging cyber threats. These tools contribute to developing a versatile mechanism for identifying vulnerabilities in Internet applications [17].

3. Research Methodology

To evaluate the study, we employed a quantitative methodology and questionnaires were disseminated to professionals in the construction field and cybersecurity experts specifically within the Gauteng region of South Africa. This target audience encompassed professionals in architecture, quantity surveying, construction management, building, various engineering disciplines (including civil, mechanical, and electrical), and cybersecurity experts. In total, 150 questionnaires were randomly distributed among these professionals, retrieving 86 completed responses. The questionnaire was designed with two (2) sections. Section A was a demographic questionnaire to gather respondents’ general and background information. Section B is concerned with assessing the best practices for improving cybersecurity in the construction industry. A five-point scale was used in the ranking, where 5 = strongly agree, 4 = agree, 3 = neutral, 2 = disagree and 1 = strongly disagree. The methodology employed descriptive analysis and exploratory factor analysis (EFA) to articulate the findings derived from the administered questionnaires comprehensibly and to analyze the research objective. Analytical data like mean item score (MIS) and standard deviation (SD) were employed by using a statistical package for social sciences (SPSS) as affirmed for such data by [18]. These statistical tools played a pivotal role in presenting a clear and succinct representation of the inferences drawn from the data, providing valuable insights into the study’s outcomes. The core of factor analysis lies in revealing correlation patterns inherent within the dataset and employing these patterns to categorize variables into distinct factor groups, a methodology elucidated by [19].

4. Results (Discussions)

4.1. Practices for Improving Cybersecurity

Table 1. Practices for improving cybersecurity.

Practices for Improving Cybersecurity	Mean	SD	Rank
Two-factor authentication	4.55	0.597	1
One-time password	4.51	0.737	2
Firewalls	4.48	0.598	3
Biometrics	4.47	0.661	4
Utilize threat intelligence	4.47	0.680	5
Digital signature	4.43	0.594	6
Strategic approach	4.43	0.733	7
Digital certificate	4.40	0.654	8
Be prepared for when, not if	4.40	0.799	9
Cyber liability insurance	4.40	0.712	10
Security tokens	4.39	0.610	11
Vulnerability scanning tool	4.39	0.691	12
Focus on compliance	4.39	0.652	13
Collaborate and report	4.39	0.746	14
Intrusion detection system	4.38	0.586	15
Personal data protection (PDP)	4.38	0.726	16
Private sector-initiated cybersecurity implementation frameworks	4.36	0.724	17
Evaluating risks so it is properly allocated through contract	4.36	0.724	18
Capacity building and awareness	4.36	0.647	19
Adopt a defense-in-depth approach	4.35	0.703	20
Promote a security-focused cyberculture	4.35	0.644	21
International information security standards	4.34	0.736	22
Developing national cybersecurity strategies/agendas	4.32	0.768	23
Picking the plan that is right for you	4.31	0.674	24
The role of the private sector in cybersecurity	4.31	0.693	25
Country-initiated cybersecurity implementation frameworks	4.30	0.745	26
National cybersecurity framework	4.30	0.689	27
Strengthening regional and international cooperation	4.29	0.776	28
Building a team of trusted advisors	4.23	0.759	29
Frameworks for implementing national cybersecurity initiatives	4.17	0.768	30

outlines best practices for enhancing cybersecurity in the South African construction industry, covering policy development, organizational strategies, frameworks, approaches, and security tools. Notably, “Two-factor authentication” emerges as the top-rated practice with a mean of 4.55, indicating widespread consensus on its effectiveness. “One-time password”, “Firewalls”, “Biometrics”, and “Utilize threat intelligence” closely follow, all with high mean ratings, suggesting their perceived efficacy. Additionally, practices like “Digital signature”, “Strategic approach”, and “Security tokens” hold considerable importance. Despite variations in opinions reflected in standard deviations, practices like “International information security standards” and “Developing national cybersecurity strategies/agendas” are generally considered effective. The data underscore the diversity in perceptions, guiding organizations to tailor cybersecurity strategies based on respondents’ perceptions of effectiveness and consensus.

4.2. Exploratory Factor Analysis of the Best Practices for Improving Cybersecurity

Table 2. Pattern matrix of the study’s clusters.

Pattern Matrix a
Cybersecurity Measures	Component
	1	2	3	4	5
International information security standards	0.857
Digital certificate	0.742
Cyber liability insurance	0.711
Developing national cybersecurity strategies/agendas	0.657
Frameworks for implementing national cybersecurity initiatives	0.653
Private sector-initiated cybersecurity implementation frameworks	0.649
Country-initiated cybersecurity implementation frameworks	0.641
Picking the plan that is right for you	0.532
One-time password	0.496
Two-factor authentication		0.850
Vulnerability scanning tool		0.749
Security tokens		0.727
Digital signature		0.681
Focus on compliance		0.518
Biometrics		0.508
Intrusion detection system		0.495
The role of the private sector in cybersecurity		0.409
Strategic approach			0.817
Personal data protection (PDP)			0.789
National cybersecurity framework			0.657
Capacity building and awareness			0.628
Strengthening regional and international cooperation			0.618
Firewalls			0.617
Building a team of trusted advisors			0.380
Collaborate and report				0.620
Be prepared for when, not if				0.524
Evaluating risks so it is properly allocated through contract				0.441
Adopt a defense-in-depth approach					0.584
Utilize threat intelligence					0.399
Promote a security-focused cyberculture					0.371

Extraction Method: principal component analysis. Rotation Method: Oblimin with Kaiser Normalization. ^a Rotation converged through 31 iterations.

presents the pattern matrix resulting from Principal Component Analysis (PCA) with Oblimin rotation and Kaiser normalization and identifies five distinct clusters related to cybersecurity measures.

CLUSTER 1, characterized as cybersecurity frameworks and standards, with variables such as “International information security standards” (85.70%), “Digital certificate” (74.20%), “Cyber liability insurance” (71.10%), “Developing national cybersecurity strategies/agendas” (65.70%), “Frameworks for implementing national cybersecurity initiatives” (65.30%), “Private sector-initiated cybersecurity implementation frameworks” (64.90%), “Country-initiated cybersecurity implementation frameworks” (64.10%), “Picking the plan that is right for you” (53.20%), and “One-time password” (49.60%), suggests a focus on global and national policy frameworks and standards. This cluster is associated with a broad concept of cybersecurity frameworks and standards regarding best practices for enhancing cybersecurity in the South African construction industry, with a total variance of 46.282%. Implementing cybersecurity frameworks and standards is pivotal in advancing the best practices for enhancing cybersecurity within the South African construction industry [20]. These frameworks and standards, such as International Standard Organisation 27001 or the National Institute of Standards and Technology (NIST) Cybersecurity Framework, provide a well-defined structure and guidelines that organizations can adopt to fortify their security posture [21]. They serve as a reference point for companies in the construction sector, offering a comprehensive blueprint to identify, assess, and mitigate cybersecurity risks effectively.

CLUSTER 2, characterized as security and authentication factor, with high positive loadings, includes variables like “Two-factor authentication” (85.00%), “Vulnerability scanning tool” (74.90%), “Security tokens” (72.70%), “Digital signature” (68.10%), “Focus on compliance” (51.80%), “Biometrics” (50.80%), “Intrusion detection system” (49.50%), and “The role of the private sector in cybersecurity” (40.90%), highlighting technical measures for user authentication and data protection. All these factors are related to security and authentication factors, which are seen as best practices for enhancing cybersecurity in the South African construction industry, with a total variance of 52.074%. This is in correlation to the study by Olofinbiyi [15], which stated that integrating strong security and authentication factors is a cornerstone in advancing the best practices for bolstering cybersecurity within the South African construction industry. Robust security measures, including multifactor authentication (MFA) and biometric verification, bolster the defense against unauthorized access and data breaches, thus safeguarding sensitive information and critical systems. In addition, Grobler and Bryk [22] encouraged users to authenticate their identity through multiple means, such as passwords, biometrics, or smart cards, construction firms can significantly reduce the risk of credential-based attacks by implementing these practices.

CLUSTER 3, characterized as strategic planning and collaboration, includes “Strategic approach” (81.70%), “Personal data protection (PDP)” (78.90%), “National cybersecurity framework” (65.70%), “Capacity building and awareness” (62.80%), “Strengthening regional and international cooperation” (61.80%), “Firewalls” (61.70%), and “Building a team of trusted advisors” (38.00%), emphasizing strategic planning and collaboration at the national and international levels. All these are related to strategic and awareness aspects of cybersecurity with a total variance of 57.485%. The strategic and awareness aspects of cybersecurity are paramount in propelling the best practices for bolstering cybersecurity within the South African construction industry. Developing a strategic cybersecurity plan that aligns with the specific needs and risks of the construction sector is imperative. This involves conducting regular risk assessments, setting clear security objectives, and establishing incident response plans as postulated by De Lanerolle [23]. Equally important is fostering a culture of cybersecurity awareness among employees, from the construction site to the boardroom, as education and training programs help workers recognize potential threats and understand their role in safeguarding the organization’s digital assets [24].

CLUSTER 4, characterized as operational compliance includes “Collaborate and report” (62.00%), “Be prepared for when, not if” (52.40%), and “Evaluating risks so it is properly allocated through contract” (44.10%), indicating a focus on operational measures, risk assessment, and reporting. All these are related to compliance and international collaboration in the cybersecurity domain, with a total variance of 61.959%. Compliance and international collaboration in cybersecurity hold immense potential to propel the best practices for enhancing cybersecurity within the South African construction industry. Adhering to international standards and compliance requirements, such as GDPR, ISO 27001, or the Cybersecurity Framework by NIST, ensures that construction firms meet critical security benchmarks and bolsters their overall resilience against cyber threats, as stated by [1,21]. These standards provide a well-established framework for mitigating risks and safeguarding sensitive data, aligning the industry’s practices with globally recognized cybersecurity protocols.

CLUSTER 5, characterized as proactive measures, includes “Adopt a defence-in-depth approach” (58.40%), “Utilize threat intelligence” (39.90%), and “Promote a security-focused cyberculture” (37.10%), emphasizing a layered defense approach, threat intelligence utilization, and fostering a cybersecurity culture. The successful convergence of the rotation through 31 iterations indicates a stable and meaningful grouping of variables within these five components, offering insights into the diverse aspects of cybersecurity measures. All these are related to proactive measures as best practices for enhancing cybersecurity in the South African construction industry, with a total variance of 65.948%. Proactive measures are instrumental in propelling the best practices for elevating cybersecurity within the South African construction industry. Instead of a reactive approach that responds to incidents after they occur, a proactive stance involves preemptively identifying and mitigating potential threats. This strategy includes conducting regular security assessments and vulnerability scans, staying current with emerging cyber threats, and deploying advanced intrusion detection and prevention systems [24]. García de Soto et al., [25] added that by being proactive, construction companies can identify vulnerabilities and weaknesses in their cybersecurity defenses before malicious actors can exploit them, thus reducing the likelihood of successful cyberattacks.

5. Conclusions and Recommendations

The study delves into enhancing cybersecurity within the South African construction industry, emphasizing a comprehensive approach beyond technical solutions. It highlights the need for strategic planning, risk assessments, and employee training to address organizational and human factors alongside technical measures. Embracing global cybersecurity standards and fostering international collaboration is crucial for compliance and staying informed about emerging threats. Urging a shift from reactive to proactive measures, the study advocates for regular security assessments and a proactive mindset to mitigate vulnerabilities before exploitation. The recommendations are vital in terms of fortifying digital defenses, emphasizing tailored approaches and regular risk assessments, and adaptability to evolving cyber threats within the construction sector.

In constructing cyber resilience within the South African construction sector, stakeholders should focus on implementing a multifaceted approach, incorporating training programs to enhance their personnel’s understanding of cybersecurity threats, awareness campaigns to foster a culture of vigilance, and best practices for deploying specific measures such as two-factor authentication, firewalls, and intrusion detection systems. Additionally, the adoption of digital certificates and utilization of threat intelligence can bolster defenses against evolving cyber threats. Collaboration among stakeholders, along with reporting mechanisms, is crucial for timely response and mitigation efforts. Moreover, emphasizing compliance with international information security standards and national cybersecurity frameworks is paramount. By embracing a defense-in-depth strategy and promoting security-focused cyberculture, the sector can better navigate the complex landscape of cyber threats and ensure the resilience of critical infrastructure projects. The study’s potential limitations include the need for further exploration into the challenges and vulnerabilities unique to the South African construction sector and the necessity for ongoing adaptation of cybersecurity measures to address evolving threats in the digital landscape.