Into The Data Breach: IREM’s Advice For Multifamily Property Managers On Fighting Cyberthreats

A continuous tide of residents moving in or out, leaving behind a digital paper trail of personal information. A shallow talent pool that can leave building managers dependent on inexperienced employees to perform basic functions including making certain that data is secure.

When it comes to protecting a multifamily building’s IT infrastructure, what could go wrong?

The answer is plenty.

While at one time the threat of data breaches seemed mostly a concern for other types of businesses or organizations with well-known brand names, the multifamily industry is learning that it cannot afford to be complacent against cyberthreats.

“As on-site processes become increasingly digital, multifamily housing organizations have focused more and more on cybersecurity in recent years,” the National Apartment Association reported. “Companies are taking cybersecurity more seriously at the board level as investors have pushed for more stringent data-privacy measures, and many of the practices are funneling to the site level, especially with the emergence of the Internet of Things.”

What can a building owner or management company do to protect itself in this environment? Again, the answer is plenty.

Toni Harris, an Institute of Real Estate Management board member and CEO of KAT Professional Development, said property managers have become more sophisticated about identifying digital risks in recent years and are now taking steps to protect sensitive data.

“In the property manager world, we've become more aware of the impact that any breach of data could have on the business, our residents, shareholders and the overall community,” said Harris, who in addition to being on IREM's board is a Certified Property Manager and Accredited Residential Manager. “There’s a lot more that can be done, but today there's a more conscious effort to put in controls that will mitigate the risk.”

An industry that used to be symbolized by a landlord carrying a ring of metal keys or tenants mailing in rent checks has today become very reliant on technology. Smart tools such as IoT-enabled appliances can make a building manager more productive, but they also mean sensitive information like residents’ Social Security numbers might be hacked, or building entrances could be breached without anyone knowing.

If a building management company feels it is not keeping up with cyberthreats, Harris said it can begin to get its house in order by performing a threat assessment of its systems. The good news is that there are resources available through groups such as IREM to help.

“Many of our industry partners offer opportunities to educate on-site team members, senior leadership, investors and owners,” she said. “For the on-site teams, it’s a matter of learning about protecting passwords, encrypting emails and things of that nature.”

IREM offers courses to help members defend against threats such as phishing, malware and ransomware. Harris said building managers and their teams should use such resources to stay up to date on potential threats. 

After all, as Deloitte noted in a report on cybersecurity risks in commercial real estate, “It’s what you don’t know that can hurt you.”

Building managers are no strangers to reducing risks to their properties and tenants, noted O. Randall Woodbury, a Certified Property Manager and CEO of Woodbury Corp. Until fairly recently, these often had taken the form of weather threats.

“As real estate managers, we're traditionally used to dealing with the physical asset and striving to keep the building envelope in good repair and secure, watertight or freeze protected, depending on what type of climate you're in,” Woodbury said. “That kind of stuff just comes naturally to us.”

Protecting against a cybercriminal who is operating from another city or country is a little different, however.

“We're learning that we can be at risk in a lot of areas, such as bad guys infiltrating our payment and wire transfer systems,” he said. “We're all vulnerable, but I think what's newer to us as real estate managers is also realizing how today’s building systems are at risk, including access and security systems.”

Woodbury, too, suggested beginning with a risk assessment. If that seems daunting, he recommended asking for the involvement of service providers such as mechanical, electrical and plumbing contractors to help identify vulnerabilities.

His firm conducted a cyber-audit at an investor’s request, employing a third party to look for issues and offer advice. With their help, Woodbury said his company created security protocols that specify, for example, how to safely store information, whether it is a tenant’s personal data or the company’s financial records. 

“We occasionally have had the situation where somebody's clicked on something and gets infected, but our team now is on top of isolating these instances and minimizing the damage as quickly as possible,” he said.

A recent study found that the grind of continuous hiring and training appears to be jeopardizing the operational efficiencies of building management. Establishing protocols as Woodbury’s company did can help bring new employees up to speed on cybersecurity more quickly.

“I've always believed that if you search for the right kind of person, somebody who's willing to learn and derives satisfaction from solving problems or nurturing relationships, then they can learn the job,” he said. “That’s why turnover is so costly. When somebody leaves, they take corporate knowledge with them, and then you have the challenge of bringing someone new up the learning curve.”

In a recent blog about managing the risks of flooding and fires, Don Wilkerson, an IREM past president and CEO of Gaston & Wilkerson, offered thoughts that could apply to any threat facing building managers, including cybercrime.

“It’s incumbent upon property managers to take preventive measures seriously,” Wilkerson said. “These are all part of our essential duties.”

This article was produced in collaboration between the Institute of Real Estate Management and Studio B. Bisnow news staff was not involved in the production of this content.

Studio B is Bisnow’s in-house content and design studio. To learn more about how Studio B can help your team, reach out to [email protected].