Ransomware and the contractor: a defense plan for companies without a SOC

Construction companies tend to assume they are uninteresting to attackers — no credit card data, no state secrets. The attackers disagree. A contractor moves large payments to many suppliers on predictable cycles, runs distributed sites with loosely managed devices, depends utterly on a small set of systems (ERP, email, document control) to certify progress and get paid, and rarely employs a dedicated security team. That combination is precisely what ransomware and payment-fraud crews look for.

The good news is that the defenses with the highest return are not expensive platforms. They are a set of disciplines a lean IT team can implement and hold. Here is the plan I run.

First, kill the two entry doors

The overwhelming majority of incidents I have seen or reviewed began in one of two places: a phished credential, or an exposed remote-access service.

• Multi-factor authentication everywhere that matters — email, VPN, ERP, admin accounts, the backup console. Not “planned,” not “for IT staff first” — enforced, for everyone, with legacy authentication protocols disabled so MFA cannot be bypassed.
• No remote desktop exposed to the internet. Remote access goes through a VPN or gateway with MFA, and the firewall rule base is reviewed quarterly for the “temporary” openings that projects leave behind.

Backups that survive the attacker

Modern ransomware crews hunt the backups before they encrypt anything, because a company that can restore does not pay. Your backup design must assume the attacker holds domain admin:

1. One copy offline or immutable — object-lock storage, or media genuinely disconnected from the domain. If the backup server is domain-joined and reachable with the same admin credentials as everything else, you do not have a backup; you have a second copy for the attacker to delete.
2. Restore tests on a schedule — a full restore of the ERP database and a file server, timed, twice a year. The test's output is a number: how many hours to be operational. Leadership should know that number.
3. Know your tolerances — agree with the business how much data loss (RPO) and downtime (RTO) each core system can absorb. These two numbers drive the entire design and budget conversation honestly.

Flatten the blast radius

Assume a laptop will eventually be compromised; the design question is what that laptop can reach. Segment site networks from head office, keep servers in their own zones, and separate day-to-day accounts from administrative ones — no domain admin reads email or browses the web with that account. On sites, treat contractor and vendor devices as guests on an isolated network, always.

Train for the fraud, not just the malware

In construction, the losses that hurt most are often not encryption but payment redirection: a compromised or spoofed supplier mailbox sends new bank details before a large certified payment. The control is procedural, and it costs nothing: any change to supplier bank details is verified by phone, on a number from the contract file — never from the email — and the finance team drills this the way sites drill safety.

Have the bad day scripted

An incident response plan for a lean team fits on a few pages: who declares the incident, the isolation steps (which network segments to cut, in what order), who calls the insurer and the authorities, where the offline contact list lives, and who speaks to staff. Print it — the day you need it, the file server may be encrypted. Then rehearse it once a year as a tabletop exercise with management in the room; in the Saudi context, align the plan with NCA Essential Cybersecurity Controls, which map cleanly onto everything above.

What it costs — and what it doesn't

The objection to all of this is usually budget, so it is worth being concrete. MFA is included in the business-tier licensing most companies already pay for; enforcing it costs configuration time, not money. Network segmentation is largely a design exercise on firewalls and switches you already own. The out-of-band verification rule for bank details costs one phone call per change. The genuinely new spend is typically immutable or offline backup capacity and, where budgets allow, endpoint detection on servers and laptops — together a small fraction of one ransom demand, let alone the two to four weeks of company-wide downtime that accompany a serious incident.

Frame it for the board the way the industry already understands risk: this is safety engineering for the company's cash flow. No contractor would run a site without barriers, permits and drills because incidents are rare; the same logic funds the barriers around the ERP and the payment process.

None of this requires a security operations center. It requires deciding that the ERP, the email system and the payment process are the crown jewels — and defending them with the same seriousness the company brings to site safety.