Cybersecurity 101: the misconceptions and security risks multifamily owners face – Part 1

"Maybe if we just ignore cyberattacks, the hackers will ignore our multifamily properties." Ridiculous? Sure. But for years, that seemed to be the opinion of many property operators. Today, cybersecurity for multifamily properties has never been more relevant with cyber risks lurking everywhere.

However, many apartment communities are less than ready to meet cyber threats head-on, despite the risks. In this series, we'll consult with John Schiel, Principal Information Security Engineer for Cyber Defense with Quantum Fiber—a well-known internet provider for multifamily properties. He'll navigate the current state of cyber threats and what property operators can do to protect their networks and residents.

Misconception: "We're not a big corporation—who would target us?"

The truth is, since as far back as 2016, most cyberattacks have been against companies with fewer than 100 employees. Incidents like ransomware attacks can pose a serious existential threat to businesses this size. According to the National Cybersecurity Alliance, more than half of small and midsize companies that suffer a cyberattack fold within six months.

Misconception: "What do we have that a hacker would want?"

Make no mistake. The data multifamily properties and HOAs collect from residents is a treasure trove for cybercriminals. Social security numbers, names, birthdates, credit reports, and employment histories from applications and leases are an identity thief's dream come true.

A property's business data would also be in high demand. Archived financial and transaction records stored on a multifamily community’s network or the cloud might include everything from rent payments to banking information, security deposits, and tax records. If compromised, the result could be untold financial and reputational damage and hefty legal bills.

Misconception: "IT stuff is someone else's problem."

"Most people think cybersecurity is someone else's responsibility," says Schiel. The assumption is that some "IT guy" somewhere is "keeping an eye on it." Schiel believes shifting this mentality is crucial. Cyberattacks are a potential business problem for everyone. "Internet providers, building owners, management, staff, and even residents all play a role in maintaining a good security posture."

Malicious actors virtually never attack through a multifamily company's IT department. Instead, they focus on residents or regular employees with email-based schemes like spear-phishing and ransomware attacks. Catching non-IT people off guard is why 95 percent of security breaches result from human error.

Schiel says getting buy-in and widespread participation is vital. "When everyone cares about security, consistently maintains their hardware, and applies all security patches and application updates, that's when you can build a solid defense."

Misconception: “Cyber risks come from outside our property.”

Increasing levels of technology can also mean other unexpected factors deserve a property owner's attention. Beyond outside attacks, multifamily operators face the possible risk of a cyber threat originating within their community. According to the Digital Millennium Copyright Act, if a resident commits cybercrimes like hacking, data theft, or illegally recording videos of other tenants on an apartment community network, the owner can be held liable.

In Part 2 of this series, we explore how choosing an internet provider committed to cybersecurity is vital for property owners.