Nord Security 彙整 - 頁17，共103

How to strengthen cybersecurity in construction and prevent attacks

Summary: Construction companies face rising cyber threats. Learn key risks, best practices, and how NordLayer helps protect projects, data, and infrastructure.

Cybersecurity risks affect every economic sector, and the construction industry is no exception.

Digital technology is embedded in how we build. From home building to delivering complex infrastructure, constructors rely on connectivity and data storage to manage material flows, coordinate projects, and communicate with clients.

Cyber-attacks can disrupt these critical functions, raising costs and, potentially, creating physical security risks.

This blog will look at cybersecurity for construction companies. We will discuss general cybersecurity risks that all companies must mitigate, alongside construction-specific risks that require targeted security solutions.

Why do construction companies face cybersecurity risks?

The construction industry consistently attracts cyber criminals for several reasons. Most importantly, construction firms have embraced digitalization. Companies store valuable financial and client information, the type of data that data thieves love to discover.

Construction companies also store infrastructure plans and project schematics. These data types appeal to threat actors linked to hostile states or terrorist collectives. Cyber-attacks on corporate archives could enable and amplify devastating strategic attacks.

Digital transformation has introduced IoT sensors, drone footage, Building Information Modeling (BIM) systems, environmental modeling, and many radical new technologies. Innovation boosts productivity but also creates new targets for cyber criminals.

Competitors are another source of cyber-attacks in the construction industry. Construction is a competitive world where businesses compete for contracts based on reputation and track record. Sabotage or data theft can ruin a firm’s chances of successful tenders.

What drives cyber-attacks on construction firms

Data security studies back up these concerns. PwC’s 2024 Cyber Threats report finds that 76% of cyber-attacks against construction companies are motivated by financial gain. But 12% are linked to espionage, and 9% are connected to sabotage.

Attacks are also becoming more frequent. The security consultancy Kroll reports that phishing attacks on construction companies doubled from 2023-24. With criminals introducing sophisticated new techniques, the threat landscape is becoming more complex and hazardous. Threat mitigation strategies are essential.

Understanding cybersecurity threats for construction companies

Every economic sector faces slightly different adversaries. Cybersecurity measures should avoid generic solutions and rely on knowledge about relevant threats. With that in mind, critical cybersecurity threats in the construction industry include:

Ransomware attacks

Ransomware is the most common attack type against construction industry targets. In these attacks, criminals deploy malware to encrypt victims’ devices. Malware then denies access to encrypted data until attackers receive ransom payments, typically in cryptocurrencies.

Ransomware attacks are more than a financial headache. They disrupt project timelines, putting completion at risk. Attackers may also extract data even if victims agree to pay.

Data breaches

Modern construction companies rely on data flows to monitor projects, maintain quality control, protect the environment, and ensure employee safety. Companies handle vast streams of financial and client data as well. All of this sensitive data can be useful for cyber attackers.

Criminals understand how to compromise construction industry targets with social engineering attacks and malware. Data breaches are inevitable without strong information security measures and employee training processes.

Supply chain attacks

Construction companies depend on complex networks of suppliers to provide material inputs, personnel, and digital services. But criminals can compromise vendors and launch cascading attacks against downstream clients.

This is why construction firms must integrate third parties into their cyber risk assessments. Partner companies represent vulnerable entry points for malicious actors, making robust access control systems essential.

Internet-of-things (IoT) attacks

IoT devices track equipment locations, monitor temperatures and pressure levels, track fleet performance, and provide early safety warnings against vibrations or toxins. These functions cut costs and improve productivity. However, IoT also introduces network security cyber risks.

Direct access to Internet-of-Things devices enables surveillance and data collection. Attackers can also combine IoT devices in botnets to launch denial-of-service attacks and damage network assets.

Moreover, IoT devices often lack native security measures. Companies struggle to update firmware and keep pace with emerging threat vectors. They may even rely on default passwords, opening the door to opportunistic attacks.

Physical security

The construction sector is particularly prone to physical security risks. Members of the public may gain unauthorized access to work sites, putting their safety at risk. Expensive on-site equipment requires security from theft or damage.

Even worse, hybrid cyber-physical attacks can compromise devices that protect work sites. For instance, attackers may use malware to damage air conditioning or dust extraction systems. Insider threats can also introduce malware via USB devices, giving outsiders access to IT systems.

Best practices to mitigate construction industry cybersecurity risks

A single ransomware attack could lead to missed deadlines, contractual fees, loss of personal information and crippling reputational damage. Given these risks, cybersecurity should be a top priority for all construction companies and third-party suppliers.

However, many constructors are poorly prepared for cyber threats. According to insurance firm Travelers, over half of construction companies lack endpoint security controls or post-breach response plans. The best practices below will help you fill those gaps and secure construction industry assets:

Best practices for cybersecurity in construction

Train employees to raise cybersecurity awareness

Phishing emails are the most common way for attackers to access construction industry networks. Clicking on malicious attachments or following fake links allows criminals to implant surveillance tools and launch ransomware attacks.

One of the most effective solutions to phishing risks is comprehensive employee training. Teach staff how to recognize dangerous emails and avoid unsolicited files or documents. Train employees to raise security concerns and follow password security best practices. And use phishing simulations to war-game real-world threats.

If you use IoT devices, training should cover updating firmware and ensuring security. Regularly reiterate the need to avoid default passwords and check devices.

Implement network security controls

Network security measures detect, assess, and neutralize cyber threats before they cause harm. Construction companies need robust firewalls, intrusion detection systems (IDS), and endpoint monitoring tools.

Uncontrolled access is another critical cybersecurity vulnerability. Use multi-factor authentication to request additional credentials for every login. Manage user permissions according to the principle of least privilege, allowing access to essential resources while blocking everything else.

Security teams must also update operational technology and network assets to minimize exploit risks. Attackers will leverage outdated firmware or operating systems. It’s essential to implement software updates and avoid using obsolete legacy systems.

Manage third-party security risks

Construction sector supply chains often become vectors for cyber attacks. This makes vendor and supply chain management a critical challenge.

Third-party risk assessment is critical. Assess vendors based on their cybersecurity controls and compliance records. Build cybersecurity into vendor contracts to encourage secure practices and prompt notification of security incidents.

Manage vendor access carefully according to Zero Trust security models. Assign sufficient privileges to carry out core tasks, without granting third parties extensive network access.

Follow an efficient incident response plan

Construction companies should assume that security incidents will occur. Security teams need a prepared incident response playbook to organize responses and safeguard sensitive information, such as client data or intellectual property.

Response plans should detect breaches, identify attack vectors, and determine the correct response. Depending on the nature of the threat, responses could entail system downtime, quarantine processes, or ongoing monitoring.

Response plans should also include data backup procedures. Regular backups of critical data allow construction companies to restore operations, even during ongoing ransomware attacks.

Ensure response plans meet regulatory compliance requirements (for example, notifying customers or regulators). Use response outcomes to improve security measures and cut future cybersecurity risks.

Managing IoT security

Secure Internet of Things devices with secure zones guarded by firewalls and access controls. Network segmentation allows authorized access and contains DDoS attacks or malware infections, effectively confining IoT attacks.

Extend IDS monitoring to IoT devices, and encrypt data transfers (such as monitoring data or video feeds).

Use industry frameworks to assist compliance

The construction industry does not fight cyber threats alone. For example, the National Institute of Standards and Technology (NIST) provides a Cybersecurity Framework to guide construction firms. Employ the framework as a checklist to source essential tools and implement security measures.

Construct a cybersecurity strategy with NordLayer

Digital transformation in the construction industry brings many benefits, but also comes with a price tag: increasing exposure to cybersecurity risks. NordLayer can help you manage those risks and enjoy the benefits of technological innovation.

NordLayer provides a comprehensive cybersecurity solution for manufacturing companies of all sizes, from single-building sites to nationwide construction enterprises.

Here is what NordLayer offers:

Zero Trust Network Access (ZTNA) enables you to restrict access to specific applications and prevent threats from spreading within the network.
Web Protection effectively blocks phishing links and sites.
Identity and Access Management (IAM) allows you to manage user identities and access for your employees and third parties with multi-factor authentication (MFA), biometric authentication, and Single Sign-On.
Cloud Firewall ensures granular access control and helps secure workflows across remote, hybrid, and on-site environments.
Endpoint security protects endpoints through traffic encryption and access control.

Cybersecurity should not compromise project delivery or data security. Contact NordLayer’s team to explore flexible and effective cybersecurity solutions for the construction industry.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

AI is now being used to guess your business passwords

When you think of a password manager, you probably think about its ability to generate unique and secure passwords for every account. While that’s true, password managers also protect against a range of technical threats you might not expect—threats that can devastate businesses, from phishing attacks using Punycode domains that trick employees into revealing corporate credentials to keyloggers and brute-force attacks on admin panels that expose sensitive systems.

In 2025, with 74% of all data breaches involving some kind of human element or error and costing companies millions in downtime and fines, password managers like NordPass are far more powerful than just a password generator—they’re a business’s shield against financial and reputational ruin. In this article, we’ll break down 5 cyber threats and explain exactly how password managers defend against them.

1. Phishing

Phishing is a cyberattack in which attackers trick users into revealing sensitive information, like usernames and passwords, by creating fraudulent websites that mimic legitimate ones. This type of attack is a huge problem, especially for businesses losing data to fake login pages. In 2025 so far, phishing has accounted for over 36% of all data breaches, and about 3.4 billion phishing emails are sent every day. These numbers show how widespread and persistent phishing has become.

These attacks often rely on techniques like Punycode domains, hijacked subdomains, and typosquatting to deceive users. Phishing links are commonly distributed via email, SMS, or malicious ads, directing victims to fake login pages where their credentials are captured.

For example, an attacker might create a domain like http://www.goоgle.com (using the Cyrillic “о” instead of the Latin “o”), which looks nearly identical to http://www.google.com but directs users to a malicious site. Alternatively, attackers might exploit a misconfigured DNS setting to hijack a subdomain, like secure.login.example.com, making the phishing site appear as if it belongs to the legitimate example.com. In typosquatting, domains like http://www.faceboook.com or http://www.pay-pal.com are registered to exploit common user typing errors.

Image: An example of an open-source phishing kit

Password managers protect against phishing by using exact domain matching when autofilling credentials. When a user visits a phishing site, even if the domain visually resembles the legitimate one, the password manager recognizes the mismatch and refuses to autofill credentials.

For instance, if credentials are saved for http://www.paypal.com, they will not be provided on a phishing domain like http://www.paypa1.com. This prevents users from unknowingly submitting their passwords to fraudulent sites.

Another layer of protection comes from eliminating the need for manual password entry. Password managers use secure browser APIs or system-level frameworks like Android’s Autofill API or iOS’s AutoFill to inject credentials directly into login fields. This bypasses keyboard input entirely, preventing phishing websites from capturing credentials through keylogging or fake form fields.

2. Credential stuffing

Credential stuffing is a type of cyberattack in which attackers use large sets of stolen username and password combinations, often obtained from previous data breaches, to gain unauthorized access to user accounts on different platforms.

For businesses, this is a huge threat—employees reusing personal passwords for work accounts can open the door to attackers who might use a breach of a random website to access corporate emails, CRM systems, or financial tools, costing companies millions in stolen data or ransomware payouts. The attack relies on the assumption that many people will reuse the same credentials across multiple websites and services.

Automated tools are used to test these credential pairs across numerous sites at scale, often with the help of bots, enabling attackers to exploit any reused credentials efficiently.

Image: Cybercrime forum discussions focusing on credential-stuffing tools

For example, if an attacker acquires a leaked database from a breached e-commerce platform, they might use the stolen email-password pairs to attempt logins to banking, social media, or other sensitive services. Automated credential stuffing tools, like Sentry MBA or OpenBullet (as seen above), can test thousands of combinations per minute, often evading basic security measures like rate limiting or CAPTCHA using proxies.

Password managers provide a strong defense against credential stuffing by generating and storing unique, complex passwords for every account. Since credential stuffing depends on the reuse of credentials across multiple platforms, having a distinct password for each account renders the attack ineffective. Password managers make this feasible by securely storing and autofilling these unique passwords, so users don’t need to remember them.

NordPass offers a valuable feature called Password Health. This feature scans all passwords stored in your vault and checks how vulnerable they are, giving you a clear view of your password security. It alerts you about weak, reused, or compromised passwords, helping you take necessary actions to strengthen your online security. This is an effective way to ensure your passwords aren’t putting your accounts at risk.

3. Brute-force attacks

Brute-force attacks involve systematically guessing passwords by trying all possible combinations, often with the help of automated tools. While most modern consumer platforms include protection mechanisms like two-factor authentication (2FA), CAPTCHA, or account lockouts to prevent these attacks, there are edge cases where brute-force attacks remain viable. This is particularly true for public-facing admin portals or legacy systems that lack built-in protections by default.

For instance, if your business runs a WordPress site without security plugins, it may be leaving its admin panel (/wp-admin) exposed to brute-force attacks. Attackers might use tools like Hydra or WPScan to test thousands of password combinations, starting with weak or default credentials like admin with password123. Without additional configurations, some versions of these platforms remain vulnerable, as they typically don’t include features like rate limiting or CAPTCHA out of the box. Users must proactively install plugins to secure these areas.

Image: An example of WPScan brute-force functionality

Password managers provide an important layer of protection against brute-force attacks by encouraging the use of strong, complex passwords that are resistant to guessing. A password manager can generate a password like Tx8&@K1p!Rv2#, which is more difficult to crack, even with the most advanced brute-force tools. Furthermore, password managers ensure that users don’t rely on weak or default credentials and prevent the reuse of passwords across different systems, which attackers could exploit.

NordPass, in particular, not only generates strong, complex passwords but also stores them securely. Users have the flexibility to determine the complexity of their passwords, allowing them to create passwords that are both highly secure and tailored to their needs. Importantly, NordPass encourages the use of unique passwords for each account, ensuring that even if one set of credentials is exposed, it cannot be used to access other systems.

In addition to generating and securely storing strong passwords, NordPass also includes its built-in Authenticator feature, which can be used as an authenticator app. This adds an extra layer of security by enabling 2FA for your accounts, making it a lot harder for attackers to gain access, even if they manage to crack a password. The NordPass Authenticator is a convenient and secure option to further bolster your defenses against brute-force and other types of attacks.

With a password manager, the only password users need to remember is their master password—the key to unlocking their vault of securely stored credentials. Once this master password is entered, the manager handles the rest, automatically filling in passwords for all other accounts. This removes the burden of remembering each password individually, while still keeping your accounts protected with strong, unique passwords.

Although brute-force attacks are not a genuine risk for most consumers due to modern protections, they still pose a threat in specific scenarios, like unsecured admin portals or systems without rate limiting. By using a password manager to create and store strong, unique passwords, users add an extra layer of defense against this type of attack. In these edge cases, password managers provide protection, ensuring that even if other security layers are missing, accounts are protected with passwords that are resilient to brute-force attempts.

4. Keyloggers

Keyloggers are malicious tools designed to record every keystroke a user types, allowing attackers to steal sensitive information like usernames, passwords, and other private data. Companies can leak important information if keyloggers hit employee devices. They are often deployed as malware through phishing emails, malicious websites, or software downloads, but they can also exist as physical hardware devices installed between a keyboard and a computer.

Software-based keyloggers function by intercepting keyboard inputs at different stages within the operating system. They often utilize API hooks to monitor and record keystrokes as they are being processed.

For example, a keylogger on a Windows system might use the SetWindowsHookEx function to intercept keystrokes in real time. This allows it to capture credentials and other private information as they are typed. Clipboard loggers, another variation, monitor copy-paste actions to steal sensitive data like passwords copied for use.

Image: Guides being shared on a cybercrime forum on how to write keyloggers

Password managers effectively counter these risks by eliminating the need for manual password entry. Instead of requiring users to type their passwords, password managers use secure autofill mechanisms to directly input credentials into login fields. On web browsers, they inject credentials through direct interaction with the DOM, while on mobile devices, they use system-level frameworks like Android’s Autofill API or iOS’s AutoFill. These methods bypass the keyboard entirely, rendering keyloggers unable to capture any useful data during the login process.

Although a keylogger could potentially capture the master password during the initial login to the password manager, modern password managers mitigate part of this risk by minimizing the need for repeated master password entry. Many password managers support biometric authentication, like fingerprint or facial recognition, allowing users to unlock the manager without typing anything after the initial login. Biometric data is securely stored on the device and cannot be intercepted by keyloggers, making it a highly secure and convenient method of authentication.

5. Database leaks

Database leaks occur when attackers gain unauthorized access to databases storing sensitive user information, such as usernames, passwords, and personal details. Businesses face huge losses when customer data spills out. These leaks often happen due to issues like web-application vulnerabilities, misconfigured servers, or outdated software.

Once a database is leaked, attackers can use the stolen credentials in further attacks, like credential stuffing (as mentioned above) or direct account takeovers, particularly if the passwords are weak or reused across multiple accounts.

For example, in a typical breach, a compromised database may store passwords in plain text or use weak hashing algorithms like MD5 or SHA-1, which are vulnerable to tools like Hashcat.

Hashcat, a high-performance password-cracking tool, allows attackers or researchers to brute-force or perform dictionary attacks on leaked password hashes to recover plaintext passwords. Even strong passwords can become vulnerable if the hashing algorithm is outdated or poorly implemented (e.g., missing salting).

Image: A researcher or cybercriminal trying to use Hashcat to crack passwords

Password managers protect users from the consequences of database leaks in several key ways. First, they encourage the use of unique, strong passwords for every account. This ensures that even if one set of credentials is exposed in a breach, it cannot be used to access other accounts. For example, a leaked password from an e-commerce site would not provide access to a user’s banking or email accounts if unique credentials were used.

In addition to promoting password uniqueness, password managers generate and store randomized passwords that are resistant to brute-force attacks. A password like T&$9jf@3#1Px2! is much harder to crack using tools like Hashcat compared to common or weak passwords. Password managers also make it easy to update compromised passwords quickly by identifying affected accounts and help in generating secure replacements.

Many password managers further enhance protection by integrating breach monitoring tools. For example, NordPass offers an integrated Data Breach Scanner that provides real-time alerts when your email or credit card details appear in a data breach or leak. This feature allows you to respond proactively by updating your credentials before attackers can exploit the compromised data.

NordPass follows a zero-knowledge architecture, meaning it never has access to user passwords. Additionally, NordPass provides businesses with a free tool to check for potential leaks through its dark web monitoring service. This service helps companies detect any exposed employee or customer data across the dark web, adding an essential layer of defense for businesses concerned about database breaches.

Get protection with NordPass

Credential theft can cause serious problems for businesses of all sizes. When someone’s login details are stolen, it can lead to unauthorized access to accounts, financial scams, identity theft, or even corporate spying. Hackers often sell stolen login details on dark web marketplaces, making them available to criminals around the world.

If a hacker gets into someone’s email, they can reset passwords for other accounts, giving them access to even more services. To protect against credential theft and its harmful effects, it’s important to use strong passwords and a password manager.

Start taking control of your security today. As a business owner, you have the power to strengthen your company’s defenses by mandating the use of a password manager. NordPass Business makes it easy to implement best practices across your team, protecting against the very threats we’ve discussed.

NordPass also constantly passes security audits, ensuring it meets the highest levels of protection. This helps your business achieve information security standard compliance (like ISO and NIS2), which protects against high penalties for non-compliance and potential data leaks.

Get started with a complimentary 3-month trial by clicking here and using the code “danielk”—no credit card required. Don’t wait until it’s too late; secure your business now.

Disclaimer: Examples are provided for informational and educational purposes only. NordPass does not endorse, promote, or support their use and has no affiliation with them. Readers are strongly advised to comply with all applicable laws and regulations. All trademarks mentioned are the property of their respective owners.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

About Version 2 Digital

NordPass Nord Security 2025

How SoundCloud streamlined VPN access with NordLayer

Summary: Tired of VPN maintenance? See how SoundCloud saved 95% of IT admin time and simplified global team access with NordLayer’s Business VPN.

SoundCloud is one of the largest cloud-based music streaming platforms in the world, connecting millions of listeners and creators across the globe. The company has more than 130 million monthly users and hosts over 250 million audio tracks.

Headquartered in Berlin, with offices in London, Los Angeles, and New York, SoundCloud operates in over 190 countries. Each region brings unique markets and localization needs, requiring a flexible, secure solution to keep teams connected and protected.

With SoundCloud expanding globally, their marketing team needed a reliable business VPN with broad location coverage. The company chose NordLayer to provide its marketing and developer teams with an easy setup, strong connectivity, and seamless protection.

The challenge: failing VPN connections and limited geographic coverage

SoundCloud faced several challenges with VPN reliability and geographical coverage. The company was looking for an easy-to-use solution that could provide stable, secure VPN connections in specific markets for localization and marketing purposes. Rafał Kamiński, IT Director at SoundCloud explains:

“Before adopting NordLayer, we struggled with complex VPN maintenance. Also, our previous solution lacked the geographic coverage we needed, for example, in countries like Egypt, Congo, Mexico, or Taiwan.”

To find the right fit, SoundCloud evaluated several VPN tools, focusing on strong security credentials, ease of use, and simple deployment for non-technical users. After shortlisting and testing a few options, they selected NordLayer. It stood out as a reliable, easy-to-use, and budget-friendly solution that met all their requirements.

How NordLayer helped SoundCloud

By switching to NordLayer, SoundCloud simplified VPN use for employees, improved global connectivity, and saved time and resources. What started with just one team quickly expanded to around 90 users across departments.

“With NordLayer, I save 95% of the time I used to spend on setup and maintenance. What used to take hours is now a one-minute task. And that’s not just time saved, it’s real cost savings, too.”

Key benefit 1: Fast deployment across teams

SoundCloud’s IT team deployed NordLayer in less than a day. With bulk user uploads and simple installation on MacBooks, the setup was effortless. Most users needed only a short tutorial and could log in instantly via Google SSO.

Key benefit 2: VPN-based, reliable geo-access for global workflows

Some teams, like the designers in Berlin, needed to access vendor servers that only accepted U.S. IP addresses. With NordLayer, they could switch VPN locations in seconds and connect instantly, bypassing location restrictions without manual workarounds.

“With NordLayer, switching IP locations is easy. It solves the problem instantly, with no delays or complications.”

Settings - Security configurations - Always on VPN

Key benefit 3: Reduced workload and operational costs

By removing the need for internal VPN infrastructure, international travel, or manual system setup, NordLayer helped SoundCloud save both time and money. IT teams could focus on strategic tasks instead of troubleshooting VPN usage.

Key benefit 4: Smooth scaling of VPN access across departments

Adoption started small with the marketing team, then expanded organically as more employees saw the benefits. Today, nearly 90 users rely on NordLayer’s Business VPN to stay connected securely and easily.

“It started with 10 or 20 users. But like a snowball, it grew fast. One person told another, and suddenly we had almost 100 people using NordLayer across the company.”

Key benefit 5: Easy user management with SSO integration

With NordLayer, managing users is straightforward. IT manually creates and deactivates accounts, while Google SSO enables secure, one-click login, which is easy even for non-technical users.

“NordLayer is super easy to use. Our team just clicks one button with Google SSO and they’re in. No setup hassle, no extra steps. It just works.”

Results: 95% of admin time saved

95% admin time saved
NordLayer eliminates the need for manual VPN setups or cloud configurations, enabling instant, secure access to remote systems.
Ease of NordLayer’s use

“Setting up NordLayer for a new employee at SoundCloud takes just a couple of minutes, making onboarding fast, simple, and stress-free.”

Seamless operations and a reliable, secure VPN connection
Teams can now quickly switch locations to access region-specific content.

Why NordLayer works for SoundCloud

SoundCloud has been using NordLayer for five years now. With employees working remotely or across multiple global locations, SoundCloud needed a flexible Business VPN solution that did not require heavy admin work. NordLayer made a perfect fit.

Pro cybersecurity tips from SoundCloud

Conclusion

SoundCloud switched to NordLayer’s Business VPN, which provided secure, reliable connectivity and saved the company many hours of IT work.

“Thanks to fast internet and reliable VPN performance in all locations, our employees can work without connection issues or delays.”

NordLayer also allows users to easily change IP addresses to access region-restricted servers, which is critical for teams working with vendors or platforms based in other countries.

Does your business need secure and reliable connections? NordLayer provides fast deployment, flexible plans, and strong data security.

Visit NordLayer to find the best plan for your needs.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

About Version 2 Digital

Nord Security 2025 NordLayer

5 cyber threats password managers protect against

Prompt: “Guess passwords”

Hackers have always used the latest technologies to make their attacks more effective—and now, of course, they’re using AI. It turns out artificial intelligence has many applications for cybercriminals, from creating personalized phishing messages and advanced malware to, that’s right, guessing people’s passwords.

As a result, instead of trying to hack passwords manually—a process that could take years if they’re even slightly more complex than “123456”—cybercriminals now use AI models to generate highly accurate password predictions based on a target’s online behavior and data. This allows them to launch optimized brute-force attacks, significantly increasing their chances of gaining unauthorized access to company systems and devices.

What our research shows—and what hackers know all too well—is that weak password habits are common across industries. And since most companies still rely on passwords to protect their digital assets, it’s no surprise that cybercriminals are using artificial intelligence to exploit this vulnerability. With AI on their side, they’ve got a better shot at breaking into a company, disrupting its operations, and putting its brand reputation at risk.

How does AI improve password guessing?

It’s simple—AI leaves traditional password-guessing methods in the dust when it comes to both speed and accuracy. Unlike humans, AI isn’t limited by having to type things out on a keyboard. And, unlike traditional brute-force tools, it doesn’t waste time trying every possible combination of letters, numbers, and symbols.

No, AI plays it smart. For instance, it analyzes massive datasets of leaked passwords to find patterns in how people often create passwords, identifying popular formulas like [pet’s name]+[year of birth] or [company name]+123. Some AI tools even gather data from social media or company websites to increase their chances of guessing a password by using employees’ personal information and company-related terms. Not to mention the fact that artificial intelligence also understands all human languages, so it knows what phrases people are more likely to use in their country.

Because of all that, AI doesn’t waste its resources on trying millions of irrelevant combinations—it jumps straight to the most likely guesses. So, if your password is weak and predictable, an AI tool could probably guess it in a matter of minutes.

This is a serious issue for all businesses. Google’s Threat Horizons Report found that over 60% of the breaches it analyzed involved credential issues. Therefore, all companies must enforce a strong password policy before AI-powered password guessers become a major threat to their operations.

The difference between guessing and cracking passwords

Although both fall under the umbrella of “password hacking,” “password guessing” and “password cracking” are two different things. The former describes a trial-and-error process of attempting as many password guesses as possible until one eventually hits the jackpot.

Password cracking, on the other hand, is about decrypting password hashes from a stolen password database. In other words, hackers already have the credential data in their possession, but it’s still protected by encryption. So, they use cracking tools to uncover plaintext passwords.

Who’s most vulnerable to AI password attacks?

While anyone is at risk from AI-powered password guessers, businesses are likely the biggest targets. That’s because companies have a much larger attack surface, and sometimes just one compromised business password can give cybercriminals access to an entire IT ecosystem.

Hackers are also using AI to target corporate platforms to reap bigger profits than they’d get from breaking into individual user accounts. It’s like the saying goes: “The greater the risk, the greater the reward.”

Tips for protecting business passwords from AI

While the threat of AI-powered password guessers may seem daunting, you’re not helpless or without options. There are several strategies and tools that, if implemented correctly, can help protect your business. Here are some of them:

Enable multi-factor authentication (MFA)

Relying only on passwords to protect your company accounts isn’t enough these days. You need extra layers of security so that even if a password is compromised, your systems and data stay safe. That’s where multi-factor authentication comes in.

By setting up MFA on all your company accounts, you ensure that anyone trying to log in will need more than just a password to gain access. As a result, even if an AI-powered password guesser figures out the user’s credentials, hackers still won’t be able to get in.

Don’t reuse passwords

If an employee uses the same password across multiple accounts—both business and personal—they may be doing more harm than they realize. If an AI tool cracks such a password, hackers could break into several company systems at once, making it a nightmare for your IT team to contain the damage. That’s why it’s so important to have a strong password policy that prevents password reuse in your organization.

Educate your team

It’s one thing to ask employees to follow security rules—it’s another to make sure they understand why those rules matter. Investing in cybersecurity training sessions is not only a way to teach your team how to use company systems safely and spot phishing attempts, but it also helps them see the bigger picture behind the risks the company is facing—and how their actions can affect your entire organization. When your employees understand the threat, know what to watch for, and how to respond, you’re much more likely to catch issues early and reduce the chance of human error.

Keep software and devices updated

Most of the tools and systems companies rely on get regular updates to fix bugs and patch up security holes. That’s why it’s really important to make sure all your company’s devices and software stay up to date. Without those updates, you could be leaving vulnerabilities that hackers are just waiting to exploit.

Use a password manager

If your company doesn’t use a password manager yet, getting one should be at the top of your priority list. Why? First of all, a password manager like NordPass allows your employees to generate strong, hard-to-guess passwords for each of their business accounts. It also lets them securely store, manage, autofill, and share those passwords internally with the team. So if you’re concerned about AI-powered password guessers, using a tool like NordPass is one of the best ways to stay ahead.

NordPass also offers additional security features, such as a Data Breach Scanner that informs you if your company’s credentials have been compromised, Password Policy that allows you to enforce strict password rules for all employees, and Email Masking, which hides users’ real business email addresses when signing up for newsletters or online services. With features like these, you’ll have more control over access to your company’s systems—and help protect your business data from threats like AI password guessers.

Bottom line

Hackers are now using AI to guess business passwords based on the targets’ online behavior and data. With this technology, cybercriminals can crack weak passwords in just a few minutes, gaining access to company systems at lightning speed.

To protect themselves, organizations must make sure that all employees use only strong, AI-proof passwords. One way to do this is by investing in tools like password managers (e.g., NordPass) that can generate complex passwords on the spot and securely store each employee’s credentials in encrypted vaults.

About NordPass
NordPass is developed by Nord Security, a company leading the global market of cybersecurity products.

About Version 2 Digital

Nord Security 2025 NordPass

ICS security best practices: How to protect Industrial Control Systems

Summary: ICS systems face increasing cyber threats. Network segmentation, VPN, and threat intelligence are key to protecting your critical infrastructure. Learn how.

Today’s industry depends on automated control systems to maximize efficiency and enable flexible production. However, modern cyber attackers understand this dependence and have evolved many techniques to compromise and damage Industrial Control Systems (ICS).

This blog will explore how ICS fits into the cybersecurity landscape. We will learn about the threats ICS systems face, discuss best practices to mitigate cyber threats, and ensure smooth industrial operations.

ICS and OT: Definition

Industrial Control Systems (ICS) and Operational Technology (OT) are critical concepts in modern industry. However, the two approaches are slightly different, and understanding these variations is important when protecting ICS deployments.

Operational Technology (OT) vs Industrial Control Systems (ICS)

Operational technology is a subset of industrial technology that monitors machinery and networks across enterprises. OT checks that production or logistics facilities are running smoothly and safely, including physical efficiency, environmental conditions, and cybersecurity factors.

Industrial Control Systems are a subset of OT that manage processes within industrial settings (including cybersecurity). Components of ICS include:

Supervisory Control and Data Acquisition (SCADA): Collects data from industrial sensors and delivers this information to centralized security centers.
Distributed Control Systems (DCS): DCS handles complex industrial settings. For example, companies may integrate monitoring across chemical processing plants or oil refineries. Systems employ distributed sensors to improve efficiency and resiliency.
Programmable Logic Controllers (PLCs): PLCs govern automated industrial processes. They allow technicians to automate production and monitoring functions, including threat data collection, alerts, and incident responses.

Why is cybersecurity important for ICS?

Industrial control systems are fundamental to modern industry. They control production lines that manufacture essential consumer goods, manage power plants and refineries, and help maintain and extend critical infrastructure.

However, the expansion of ICS systems has brought new cybersecurity risks. Cybercriminals now seek to damage vital industries via targeted cyber-attacks, often focusing on ICS technology to achieve maximum impact. As a result, Industrial Control Systems cybersecurity is becoming critically important.

Think about the risks of not securing the ICS network infrastructure. Cyber threats could damage machinery and compromise the physical safety of employees. For instance, in the 2010s, a malware agent called TRITON hit industrial safety systems across the Middle East.

Even worse, attackers could harm entire populations. One attack documented by Verizon targeted water company logic controllers, aiming to contaminate water supplies with harmful chemicals. The attack failed but remains possible.

In most cases, attackers harm companies financially, not physically. ICS attacks often damage productivity by taking plants and equipment offline. For instance, a 2019 attack against Norsk Hydro facilities eventually cost the company over $50 million.

Given these numbers and the consequences of attacks, securing ICS systems should be a cybersecurity priority for all industrial organizations.

Understanding ICS security risks

Industrial cybersecurity starts with awareness of the risks faced by Industrial Control Systems. As ICS/OT becomes more aligned with IT, manufacturers face many critical risks, many of which are evolving and becoming more severe.

Common ICS vulnerabilities include:

Use of legacy systems: Industrial organizations are often slow to update software, which lags behind other technology. Unpatched operating systems and firmware invite bad actors to exploit weak spots. This problem is doubled if vendors no longer support legacy systems. In that situation, companies have no one to advise them or supply updates.
Default settings: Companies often install industrial equipment or IoT devices without changing the default settings. Attackers can quickly access ICS systems via default passwords, compromising an entire industrial environment.
Lack of encryption: ICS systems rely on commands to operate switches and manage processes. However, cyber attackers accessing this traffic can hijack industrial systems and control production equipment. Encryption solves this problem by making commands unintelligible to outsiders.
Risks related to remote access: Vendors and IT staff may access critical systems remotely to manage settings and monitor performance. This represents a vulnerability if companies fail to verify connections via robust access control measures.

Who exploits ICS vulnerabilities? Understanding the threat landscape

Many threat actors exploit these common ICS vulnerabilities. For example, companies without robust access controls, segmentation, and authentication are easy targets for insider threats. Insiders can obtain credentials and mount attacks or supply information to malicious outsiders.

However, many attacks originate overseas. So-called nation-state attacks involve state-backed cybercriminals. The US-created Stuxnet worm, which targeted Iranian nuclear facilities, is a great example, but nation-state attacks also emerged from Russia, China, North Korea, and Israel.

Then there are shady criminal collectives. In 2024, ransomware groups hitting ICS targets surged by 60%, and attacks rose by 87%. Industrial targets are attractive because companies can’t afford to lose production time. For instance, Colonial Pipeline paid ransomware attackers $4.4 million in 2021, and smaller payments happen daily.

Finally, third-party accounts can expose companies to supply chain risks without proper vetting and security assessments. If a vendor suffers a cyber-attack, the effects can cascade to factories that use their products.

What happens when ICS attacks occur?

Whatever threat actor is involved, ICS attacks can be devastating. The most obvious consequences are financial. As noted above, attackers may demand huge ransomware payments to unlock systems. However, ICS attack risks extend beyond ransom payments.

On a practical level, ICS attacks disrupt industrial production as SCADA manipulation causes production lines to behave erratically and halt. DDoS attacks overload and damage machinery, potentially raising fire risks.

Critical infrastructure networks become unreliable and require detailed assessment, which can be a headache for utilities like electricity or water providers. These problems are more severe if attackers disrupt monitoring technology by delivering false readings.

Safety systems may break down or produce false alarms. Physical failure can harm employees, customers, and the environment. When that happens, regulatory compliance violations are almost guaranteed, and reputational harm is never far behind.

ICS security best practices

Cyber threats against critical systems are becoming more sophisticated and damaging. Attackers tailor their methods to specific companies and locations. They research legacy systems, industrial architecture, and security measures to detect seemingly minor vulnerabilities.

In this context, all industrial organizations should strengthen their ICS cybersecurity posture. Let’s explore some best practices to achieve this goal.

Network segmentation

Segmenting ICS environments is an essential part of cybersecurity for Industrial Control Systems. This is because network segmentation divides industrial networks into areas with access permissions assigned to specific teams and employees. Security teams can monitor ICS devices and spot suspicious activity, ensuring only authorized users can access configurations or data flows.

Network segmentation can also help restrict the blast radius of successful attacks. It can, for example, prevent malicious malware from spreading in the network. This is especially helpful in mitigating denial-of-service attacks that flood industrial networks with traffic.

Ideally, companies should use cloud firewalls to implement network segmentation. Cloud firewalls enforce access controls to your ICS devices. You can facilitate smooth access for employees with a legitimate reason to change ICS settings and exclude everyone else.

Not everyone should access everything

Granularly define access policies
Isolate and protect your critical data with network segmentation by NordLayer

Learn more

Training employees

Cutting-edge security tools are useless if employees fail to follow security policies. For instance, companies must educate employees about the importance of MFA and password security. Enforce device security policies, allowing only approved work devices to connect to the ICS network.

Additionally, connect phishing risks with ICS attacks. Employees should know how to identify phishing emails and avoid malicious software infections.

Regularly patch and update software

As we discussed earlier, legacy systems are common failure points in cybersecurity for Industrial Control Systems. Companies let control software become obsolete. Businesses must provide regular patches to mitigate exploits and stay ahead of malicious actors.

Multi-factor authentication (MFA)

Robust access controls prevent unauthorized access, even if attackers obtain user names and passwords. Multi-factor authentication (MFA) requires unique one-time credentials in addition to passwords. This helps block untrusted users at the network edge.

MFA is even more effective with strengthened password security. ICS users should regularly change their passwords and use strong, unique passwords (with no reference to personal information).

Password managers can help by providing a simple interface for credentials management. Integrate tools like NordPass with your ICS security measures to enforce password policies consistently and minimize credential theft risks.

Secure Remote Access

ICS is usually a remote technology. Engineers rarely control equipment on-site and depend on connections between external networks and ICS devices. This opens the door to hijacking and credential theft attacks. Virtual Private Networks (VPNs)help solve this problem.

VPNs help secure company data by creating an encrypted connection for employees to access the network remotely. Business VPN ensures that remote access to critical systems is protected, reducing the risk of cyber-attacks.

Harness the latest threat intelligence

Many ICS attacks originate from organized criminal collectives and nation-states. This level of organization makes attacks more powerful, but has a positive side: targets can research active threats and apply proactive security measures.

Leverage threat detection and intelligence to outpace ICS attackers. Solutions like NordStellar actively monitor current threats and detect leaked credentials on the Dark Web. With this knowledge, security teams can detect critical threats and remedy exploits before attacks occur.

What are the differences between ICS and SCADA systems?

Before we finish, it’s important to clarify how ICS and SCADA systems differ. As mentioned earlier, Supervisory Control and Data Acquisition is a monitoring system that collects data from industrial sensors.

SCADA is most commonly associated with distributed industrial settings. For example, oil pipelines need thousands of SCADA sensors to monitor structural integrity, check employee safety, and spot potential leaks.

ICS is an umbrella term referring to systems that monitor and control industrial environments. SCADA is an element of most ICS deployments, but there is more to ICS than data gathering. ICS is a control model. ICS devices analyze and use data to manage industrial processes.

How can NordLayer help secure ICS systems?

ICS cybersecurity is critically important in the modern economy. Power suppliers, manufacturers, logistics companies, and all industrial organizations face severe and growing cybersecurity risks. Expert assistance is often essential, which is where NordLayer can help.

NordLayer’s cybersecurity for manufacturing solutions help mitigate ICS risks and prevent damaging cyber-attacks.

Our access control solutions regulate access to ICS assets, blocking unauthorized actors and allowing seamless employee access. The cloud firewall allows granular network segmentation, shrinking the attack surface. Threat detection tools monitor your network, while our VPN enables safe remote access to all ICS devices.

Advanced security tools make it possible to secure all types of industrial environments. To learn more, contact the NordLayer team today.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

About Version 2 Digital

Nord Security 2025 NordLayer