www.reit.com Open in urlscan Pro
151.101.2.132  Public Scan

Form analysis
3 forms found in the DOM

POST /news/articles/reits-address-cyber-risk-as-innovation-continues-to-accelerate-?destination=/news/articles/reits-address-cyber-risk-as-innovation-continues-to-accelerate-

<form class="user-login-form" data-drupal-selector="user-login-form" action="/news/articles/reits-address-cyber-risk-as-innovation-continues-to-accelerate-?destination=/news/articles/reits-address-cyber-risk-as-innovation-continues-to-accelerate-"
  method="post" id="user-login-form" accept-charset="UTF-8">
  <div class="js-form-item form-item js-form-type-textfield form-type-textfield js-form-item-name form-item-name">
    <label for="edit-name" class="js-form-required form-required">Username or e-mail address</label>
    <input autocorrect="none" autocapitalize="none" spellcheck="false" data-drupal-selector="edit-name" type="text" id="edit-name" name="name" value="" size="15" maxlength="60" class="form-text required" required="required" aria-required="true">
  </div>
  <div class="js-form-item form-item js-form-type-password form-type-password js-form-item-pass form-item-pass">
    <label for="edit-pass" class="js-form-required form-required">Password</label>
    <input data-drupal-selector="edit-pass" type="password" id="edit-pass" name="pass" size="15" maxlength="128" class="form-text required" required="required" aria-required="true">
  </div>
  <input autocomplete="off" data-drupal-selector="form-5x6e3ogydg3imt-e9y2wvgfyvxd4gszpp-75t-0nvi" type="hidden" name="form_build_id" value="form-5x6e3OgyDG3IMt-E9Y2WVgfYVXD4gszpp-75t__0nvI">
  <input data-drupal-selector="edit-user-login-form" type="hidden" name="form_id" value="user_login_form">
  <div data-drupal-selector="edit-actions" class="form-actions js-form-wrapper form-wrapper" id="edit-actions"><input data-drupal-selector="edit-submit" type="submit" id="edit-submit" name="op" value="Log in"
      class="button js-form-submit form-submit">
    <input class="close-button button js-form-submit form-submit" data-drupal-selector="edit-close" type="submit" id="edit-close" name="op" value="Close">
  </div>
</form>

GET /search

<form action="/search" method="get" id="views-exposed-form-search-search-page" accept-charset="UTF-8">
  <div class="form--inline clearfix">
    <div class="js-form-item form-item js-form-type-textfield form-type-textfield js-form-item-keyword form-item-keyword">
      <input placeholder="Start typing search keyword..." data-drupal-selector="edit-keyword" type="text" id="edit-keyword" name="keyword" value="" size="30" maxlength="128" class="form-text">
    </div>
    <fieldset data-drupal-selector="edit-type" id="edit-type--wrapper" class="fieldgroup form-composite js-form-item form-item js-form-wrapper form-wrapper">
      <legend>
        <span class="fieldset-legend">Filter by Type</span>
      </legend>
      <div class="fieldset-wrapper">
        <div id="edit-type" class="form-checkboxes">
          <div class="js-form-item form-item js-form-type-checkbox form-type-checkbox js-form-item-type-1 form-item-type-1">
            <input data-drupal-selector="edit-type-1" type="checkbox" id="edit-type-1" name="type[1]" value="1" class="form-checkbox">
            <label for="edit-type-1" class="option">Company Page</label>
          </div>
          <div class="js-form-item form-item js-form-type-checkbox form-type-checkbox js-form-item-type-2 form-item-type-2">
            <input data-drupal-selector="edit-type-2" type="checkbox" id="edit-type-2" name="type[2]" value="2" class="form-checkbox">
            <label for="edit-type-2" class="option">Event</label>
          </div>
          <div class="js-form-item form-item js-form-type-checkbox form-type-checkbox js-form-item-type-3 form-item-type-3">
            <input data-drupal-selector="edit-type-3" type="checkbox" id="edit-type-3" name="type[3]" value="3" class="form-checkbox">
            <label for="edit-type-3" class="option">News</label>
          </div>
          <div class="js-form-item form-item js-form-type-checkbox form-type-checkbox js-form-item-type-4 form-item-type-4">
            <input data-drupal-selector="edit-type-4" type="checkbox" id="edit-type-4" name="type[4]" value="4" class="form-checkbox">
            <label for="edit-type-4" class="option">Tax Report</label>
          </div>
        </div>
      </div>
    </fieldset>
    <div data-drupal-selector="edit-actions" class="form-actions js-form-wrapper form-wrapper" id="edit-actions--2"><input data-drupal-selector="edit-submit-search" type="submit" id="edit-submit-search" value="Search"
        class="button js-form-submit form-submit">
      <input class="close-button button js-form-submit form-submit" data-drupal-selector="edit-close" type="submit" id="edit-close--2" name="op" value="Close">
    </div>
  </div>
</form>

POST /news/articles/reits-address-cyber-risk-as-innovation-continues-to-accelerate-

<form class="newsletter-sign-up-form" data-drupal-selector="newsletter-sign-up-form" action="/news/articles/reits-address-cyber-risk-as-innovation-continues-to-accelerate-" method="post" id="newsletter-sign-up-form" accept-charset="UTF-8">
  <div class="js-form-item form-item js-form-type-email form-type-email js-form-item-email form-item-email form-no-label">
    <input data-drupal-selector="edit-email" type="email" id="edit-email" name="email" value="" size="64" maxlength="255" placeholder="Enter your e-mail address..." class="form-email required" required="required" aria-required="true">
  </div>
  <input autocomplete="off" data-drupal-selector="form-kju4o013j7qc-wfzu3lzwkvz8s-qjcrf82yekotosey" type="hidden" name="form_build_id" value="form-Kju4O013j7QC_WfZu3lZWkvZ8s-QjcRf82YekOToSeY">
  <input data-drupal-selector="edit-newsletter-sign-up-form" type="hidden" name="form_id" value="newsletter_sign_up_form">
  <div data-drupal-selector="edit-actions" class="form-actions js-form-wrapper form-wrapper" id="edit-actions--5"><input data-drupal-selector="edit-submit" type="submit" id="edit-submit--2" name="op" value="Subscribe Now"
      class="button js-form-submit form-submit">
  </div>
</form>

Text Content

Skip to main content Accessibility statement
Username or e-mail address
Password

 * Reset your password

 * Create new account
 * Reset your password


Filter by Type
Company Page
Event
News
Tax Report

 * Join Nareit
 * Login
 * 


MAIN NAVIGATION

 * What's a REIT? Open submenu
    * What's a REIT?
    * REIT Basics
    * Types of REITs
    * REIT Sectors
    * REIT Glossary
    * REIT FAQs
    * The History of REITs
    * How to Form a REIT
   
   Explore REIT Sectors
   
   REITs invest in the majority of real estate property types, including
   offices, apartment buildings, warehouses, retail centers, medical facilities,
   data centers, cell towers, infrastructure and hotels. 
   
   Learn more
 * Investing in REITs Open submenu
    * Investing in REITs
    * Why Invest in REITs
    * How to Invest in REITs
    * REIT Directory
    * List of REIT Funds
    * ESG (Sustainability)
    * REIT Assets by State
    * Global Real Estate
    * Investor Resources
   
   2022 REIT Industry ESG Report
   
   The report and its 30-plus case studies feature REIT leadership and ESG
   innovation from a variety of sectors and serves as a tool to assess the scale
   and impact of the REIT industry’s ESG commitments and initiatives.
   
   Learn more
 * REIT Data Open submenu
    * REIT Data
    * REIT Indexes
    * REIT Market Data
    * Research Library
   
   2023 REIT Outlook
   
   With strong operational performance and balance sheets, REITs are
   well-positioned to navigate economic and market uncertainty in 2023.
   
   Learn more
 * Industry News Open submenu
    * Industry News
    * Publications
    * Advertising
    * Media Contacts
   
   One Westside Office Campus Showcases the Potential of Adaptive Reuse
   
   Hudson Pacific and Macerich have transformed a former West Los Angeles
   shopping mall into a tech office campus.
   
   Learn more
 * Events Open submenu
    * Upcoming Events
    * CEO Forum & Advocacy Day
    * ESG Jumpstart
    * REITweek
    * REITwise
    * REITworks
    * REITworld
    * REIT IR Symposium
   
   Nareit’s REITwise: 2023 Law, Accounting and Finance Conference
   
   Nareit’s REITwise: 2023 Law, Accounting and Finance Conference offers a
   comprehensive educational program for legal, financial, tax and accounting
   operations within REITs and publicly traded real estate companies.
   
   Learn more
 * About Nareit Open submenu
    * About Nareit
    * Leadership Team
    * Membership
    * Nareit Brand
    * Nareit Foundation
    * Advocacy
    * Industry Awards
    * Career Resources
   
   Nareit Membership
   
   For 60 years, Nareit has led the U.S. REIT industry by ensuring its members’
   best interests are promoted by providing unparalleled advocacy, investor
   outreach, continuing education and networking. 
   
   Learn more


REITS ADDRESS CYBER RISK AS INNOVATION CONTINUES TO ACCELERATE




BREADCRUMB

 1. Home
 2. Industry News
 3. Articles

03/17/2023 | by
Article Author(s)
Beth Mattson-Teig
FacebookLinkedInTwitterEmailPrintShare

REITs are increasingly reliant on technologies across the spectrum of
information technology (IT) and operating technology (OT) that range from
cloud-based systems and the Internet of Things (IoT) to automated building
management systems, workplace experience apps, and augmented reality. The rapid
pace of innovation in an increasingly digital real estate universe means more
blocking and tackling across a larger arena when it comes to shoring up defenses
against cyber threats.

Cyber attacks can have significant business and financial impacts, as well as
threats to human safety. One of the most high-profile attacks is the ransomware
attack that forced a shutdown of the Colonial Pipeline in 2021, with the company
reportedly paying $4.4 million to attackers to regain control of critical
operating systems.



“What we’re seeing with companies’ desires to gain a competitive advantage is
that businesses sought these emerging technologies, but they weren’t always
adequately thinking through the risks,” says Tunde Lawson, principal at EY.

Ransomware attacks account for the majority of cyber attacks with bad actors
that access systems, encrypt or “lock” systems, and infiltrate data. Oftentimes,
a company has to pay to decrypt or unlock systems, and in some cases, pay a
double ransom to remove private information that cyber criminals have posted
publicly.

A proposed SEC rule that is expected to go into effect this year is pushing the
focus on cyber risk even more to the forefront for the REIT industry. Although
the release of the final rule is still pending, at a high level, the rules
outline expectations for the reporting of material cyber incidents in a timely
manner; require disclosures on policies and procedures related to cyber
strategies; and also create some standards around how cybersecurity disclosures
are presented.

“I think the most significant implication is accountability with those charged
with governance and the management teams of the enterprise. Gone are the days
where we would say, ‘cyber is an IT issue.’ There’s recognition that it needs to
be treated no differently than any other strategic initiative that a company is
partaking in and deserves the same level of attention,” Lawson says.


TAKING A PROACTIVE APPROACH

Smarter connected devices and systems are increasingly ingrained in everyday
life. People can see who’s at their front door or adjust their thermostat
anytime and anywhere via their smartphone. Likewise, real estate owners and
managers are using technology to automate a variety of tasks ranging from door
locks and lighting to air filtration systems.


Lucian Niemeyer

“When you have all of these connected technologies that you can operate
virtually, it’s convenient, but it creates a risk. Cyber risk is growing every
day and we need to address it proactively,” says Lucian Niemeyer. The former
assistant secretary of defense for energy, installations and environment is now
CEO of Building Cyber Security (BCS), a non-profit organization that is focused
on advancing physical security and safety in the public and private sectors.

A key focus within the cyber industry is to work with manufacturers and service
providers to create security that is embedded into devices and systems, and BCS
is among the groups that are advocating for the need to design cyber safety and
security into all smart technologies. The non-profit also has created a
performance framework that provides an assessment and then certifies continual
performance.

“The push is to take the framework we’ve developed and inform the design,
development, and construction requirements,” Niemeyer says. The framework also
can be used in existing buildings to identify cyber risk and even simple steps a
company can take to improve security, such as changing default passwords for
smart systems or installing multi-factor authentication.


WORK IN PROGRESS

Property owners and managers now have a full spectrum of IT and OT devices and
systems that they have to protect. Whereas IT is more of a mature space, the OT
side is newer and doesn’t have a strong legacy of cyber security measures,
experts say.


BXP's Jim Whalen

“A lot of systems might last 10 to 15 years, and you need a capital event to
update and move it forward. So, it is a journey for the industry, and the
maturity of the control environment on the OT side is a work in progress right
now for companies operating in the industry,” says Jim Whalen, senior vice
president and chief information and technology officer at BXP (NYSE: BXP).

BXP thinks about cyber across three primary technology buckets. One covers all
of the technology and systems required to run the business. The second relates
to the tech that gets embedded into properties that occupants and guests engage
with, ranging from using a wi-fi system to getting through a turnstile. A third
category focuses more on the behind-the-scenes technology, such as HVAC systems
and security camera networks. BXP looks for cyber security solutions that can
support all three areas.

“We’re using data to drive the efficiency of our buildings, along with
supporting the growth in technologies enabling amenitization, experiences, and
convenience for our clients . Each intervention requires an elevated cyber
posture to protect those assets,” Whalen says.

Whalen is a co-founder of the Real Estate Cyber Consortium (RECC), which serves
as a resource to the broader commercial real estate industry. The mission of the
group is to elevate awareness and share best practices to improve cybersecurity
preparedness so that companies don’t have to reinvent the wheel. RECC also is
working to influence the supply chain to develop proactive cyber safety measures
and security standards.


BXP thinks about cyber issues across three primary technology buckets. Image
courtesy of BXP


OVERCOMING CHALLENGES

REITs face a number of issues as it relates to managing cyber risks. One is
simply the growing scale and rapid pace of change with technology that is
becoming increasingly entrenched in a variety of systems, applications, and
devices.

“As we try to guide our clients to protect against trends we’re seeing in the
sector, it really begins with understanding their situational awareness,” Lawson
says. Some key questions to assess a company’s cyber awareness are:

 * Do you understand what your high value assets are?
 * How can your business strategies make those assets vulnerable?
 * Could you detect if you have been breached?
 * Do you have a plan in place to respond to a breach, and have you routinely
   practiced that plan?
 * Are you able to continue with business operations and minimize disruption in
   the face of an attack?

The answers to those questions help to guide a framework for how to think about
practical solutions, processes, and controls to address cyber risks, and
ultimately safeguard assets, Lawson says. In addition, challenging a company’s
capabilities across some of those questions, as well as adopting a security risk
management framework that is aligned to leading practices, helps businesses keep
up with rapidly changing and evolving technologies, he adds.


EY's Tunde Lawson

Another key issue for REITs relates to third-party service providers, vendors,
and business partners that have different maturity levels on cyber, which can
potentially create vulnerabilities to cyber threats. One of the notable examples
of third-party risk is the Target data breach in 2013, where hackers gained
access through an HVAC vendor.

“Establishing a third-party security risk management framework is a really
effective tool to mitigate risks from those business relationships,” Lawson
says. A third-party security risk framework allows companies to design policies,
procedures, and standards on how they engage with those third parties.

An important step in creating that framework starts with gathering an inventory
of vendors, service providers, and other business partners. Once a company has
that inventory, they can then classify them according to risk level depending on
the nature of the data and level of access into a business or specific property.

Yet perhaps one of the biggest challenges companies face relates to the human
element within organizational change, Whalen adds. “You need to drive awareness
across all of your teams— physical security, engineering teams, facilities and
property management—and closely partner with them in adopting the required
changes,” he says. “It’s not just that IT comes in and puts a cyber security
solution in place, it really requires working with the human side of our talent
that service clients and operate buildings every day.”

READ MORE NEWS ABOUT:

Development

COMPANIES:

Company name
BXP
 * Office REITs

1 Year Total Return
-57.12% As of market close 03/17/2023
Stock price
$51.10


YOU MIGHT ALSO LIKE...

WHAT'S A REIT?



REITs, or real estate investment trusts, are companies that own or finance
income-producing real estate across a range of property sectors. These real
estate companies have to meet a number of requirements to qualify as REITs. Most
REITs trade on major stock exchanges, and they offer a number of benefits to
investors.



WHY INVEST IN REITS



REITs historically have delivered competitive total returns, based on high,
steady dividend income and long-term capital appreciation. Their comparatively
low correlation with other assets also makes them an excellent portfolio
diversifier that can help reduce overall portfolio risk and increase returns.
These are the characteristics of real estate investment.



ABOUT NAREIT



Nareit serves as the worldwide representative voice for REITs and real estate
companies with an interest in U.S. real estate. Nareit’s members are REITs and
other real estate companies throughout the world that own, operate, and finance
income-producing real estate, as well as those firms and individuals who advise,
study, and service those businesses.




GET DAILY REAL ESTATE NEWS


 * Facebook
 * LinkedIn
 * Twitter
 * YouTube
 * RSS Feed

©Copyright Nareit 2023. All rights reserved.

1875 | STREET, NW
SUITE 500
WASHINGTON, D.C. 20006

1-202-739-9400
1-800-3-NAREIT
1-202-739-9401 (fax)


FOOTER LINKS

 * Search
 * RSS feeds
 * Privacy
 * Cookie Policy
 * Terms of Use
 * Contact Us

Nareit® is the worldwide representative voice for REITs and publicly traded real
estate companies with an interest in U.S. real estate and capital markets.
Nareit's members are REITs and other businesses throughout the world that own,
operate, and finance income-producing real estate, as well as those firms and
individuals who advise, study, and service those businesses. National
Association of Real Estate Investment Trusts® and Nareit® are registered
trademarks of the National Association of Real Estate Investment Trusts
(Nareit).


✓
Thanks for sharing!
AddToAny
More…



THIS WEBSITE USES COOKIES TO ENHANCE CONTENT, ANALYZE TRAFFIC AND SERVE
ADVERTISING, ENSURING YOU GET THE BEST EXPERIENCE ON OUR WEBSITE.

By continuing to use our site you are agreeing to our cookie policy.

I accept No, thanks