If you think cybersecurity is \u201cjust an IT issue,\u201d better think again.<\/p>\n
Experts agree that cyber risk in the multifamily industry is largely underestimated, given ![\"shutterstock_429444529\"](\"https:\/\/www.yardi.com\/blog\/wp-content\/uploads\/sites\/15\/2016\/09\/shutterstock_429444529.jpg\")
the volume of personal and financial data multifamily companies collect and maintain about their prospects, residents and employees. And the fact that many real estate organizations rely on third-party service providers to collect and protect data further increases exposure to damaging cyber incidents.<\/p>\n
What are some of the common risk factors? Using disparate software solutions and multiple vendors with various interfaces and logins elevates exposure to breaches. To further complicate matters, information security programs in the multifamily industry tend to be relatively less sophisticated compared to more heavily regulated sectors such as banking and retail. Since cyber criminals will always take the path of least resistance, this poses a major threat to the industry as a whole, which maintains information about tens of millions of Americans. And after a well-publicized breach in 2014, the multifamily industry is \u2014 or should be \u2014 on high alert.<\/p>\n
To not only reduce risk but also to increase operational efficiencies, many companies have made the move to a single platform \u2014 and now consider it a best practice to consolidate core property management and accounting along with ancillary products in one database supported by a single vendor. And while no business can expect to achieve perfect security, in the current cyber threat landscape with so much at stake a comprehensive plan \u2014 and one point of contact for software and services \u2014 can mean a direct line to better peace of mind.<\/p>\n
At the NMHC 2016 spring board meeting, panelists emphasized that cybersecurity is not simply an IT problem, but rather an enterprise risk management issue. Developing a strong cybersecurity program is not a one-time effort, either \u2013 an effective program needs to be continually tested and refined. This expectation is now held by state and federal regulators. And recently, members of Congress have introduced federal legislation that would mandate board oversight for information security programs.<\/p>\n
To help their members understand and create a comprehensive data security program, NMHC released a white paper in June and hosted an educational webinar on July 21, 2016. The white paper, titled \u201cMultifamily and Cybersecurity: The Threat Landscape and Best Practices\u201d was authored by Christopher Cwalina, Esq., Kaylee Cox, Esq., and Thomas Bentz, Jr., Esq,. of Holland & Knight.<\/p>\n
Some key statistics were provided in the webinar to help attendees understand the current threat landscape. In 93 percent of cases, attackers needed only a few minutes to break into systems, while 83% of victims didn\u2019t discover the breach for weeks. It was also noted that on average, intruders are in a company\u2019s network for more than 200 days before they are discovered. Social engineering and ransomware attacks continue to succeed. And perhaps most alarmingly, \u201cinsider threats\u201d keep causing havoc for companies \u2014 and of all the incident types, insider misuse is likely to take months or even years to discover, causing extensive and costly damage.<\/p>\n
The most important takeaway: recommended best practices. All panelists agreed that a robust cybersecurity program includes incident response, management of third-party relationships, oversight and staff training.\u00a0<\/em>It might come as a surprise that many incidents are avoidable, as the result of thoughtless user error (non-compliance with password protocols, for example) so make sure training is a priority \u2014 especially for employees with access to the most sensitive information.<\/p>\n Top down leadership is key, and executive management should drive a cybersecurity program including cultural expectations within the company. An incident response plan \u2014 including an incident commander \u2014 and communication protocols should be established and documented, and consistent with other company policies and procedures, with roles and responsibilities clearly defined.<\/p>\n The experts reiterated that third-party relationships bring significant risk, and should be carefully evaluated. Make sure all your vendors have a solid data protection program in place, and conduct periodic audits \u2014 it\u2019s your revenue, brand and reputation on the line.<\/p>\n Read more<\/a> about data security and NMHC\u2019s initiatives. Learn more about Yardi Voyager<\/a> and the Yardi Multifamily Suite<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" If you think cybersecurity is \u201cjust an IT issue,\u201d better think again. Experts agree that cyber risk in the multifamily industry is largely underestimated, given the volume of personal and financial data multifamily companies collect and maintain about their prospects, residents and employees. And the fact that many real estate organizations rely on third-party service […]<\/p>\n","protected":false},"author":616,"featured_media":16125,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_s2mail":"yes","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6],"tags":[104,1640,717,29,398,134,76],"class_list":["post-16121","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-business","tag-cybersecurity","tag-it","tag-multifamily","tag-nmhc","tag-real-estate","tag-technology-2"],"acf":[],"yoast_head":"\n