Archives for December 2021

One of the few positives that came out of the pandemic for the commercial real estate industry was that it finally pushed many tech-hesitant brokers to embrace technology—mostly as a way to survive. But while the adoption of digital technologies has produced tremendous efficiencies for brokers, investors, tenants, and others in the CRE transaction chain, it has also increased opportunities for cyber hackers to exploit vulnerabilities. And for an industry that holds a treasure trove of financial and customer data within its networks, cybersecurity at some commercial real estate firms can be woefully lacking.

“In the security industry we encounter a lot of misunderstanding in terms of where the opportunity lies for the bad guys,” says Timur Kovalev, chief technology officer at Untangle, a network security provider for small-to-medium businesses (SMBs). “In the real estate business you usually don’t hear cybersecurity and real estate brokerage mentioned in the same sentence, but if you look at the kind of data that real estate brokers have and what can be done with that data, it’s significant. And it has become kind of a low-hanging fruit for the hackers who know that they can get access to customer data.”

Kim Ford, SIOR, CEO of exclusive tenant representation brokerage firm Rise Pittsburgh agrees. “I think too many people don’t realize that cyber threats are real,” says Ford. “A lot of people are naïve and don’t believe it’s going to happen to them, and the problem is that not only can it happen to us as brokers or brokerage companies, it could happen to our clients as well.”

A recent Untangle whitepaper cites the Keeper Security 2019 SMB Cyberthreat Study, which found that the majority (66%) of business leaders at SMBs don’t believe they will fall victim to a cyberattack. The paper concludes that this attitude often leads to lax security practices, including “weak passwords, ineffective mobile device policies, and not keeping up with cybersecurity threats.” This tendency to downplay threats comes as more businesses are transitioning to a remote or hybrid workforce—using more apps, third-party hardware, online systems, and adding more IoT (Internet of Things) devices to their networks, thus increasing exposure.

“Before, employers could say ‘everyone is on my network, so I can control what websites people go to,’” says Kovalev, “but nowadays, with so many people outside the office, they may be going to websites on their own that are malicious, get malware on their systems and then log into your system and (spread the malware).”

Some of the “it can’t happen to us” mentality is fueled by the hyper-focus on large-scale ransomware events, such as the cyberattacks on Colonial Pipeline that disabled the nation’s largest fuel pipeline and the shutdown of JBS Foods’ entire U.S. beef processing operation. Colonial and JBS paid the hackers $4.4 million and $11 million respectively in cryptocurrency to restore operations (although Colonial was able to recover $2.3 million with the help of the FBI). Those 2021 attacks came following a year where ransomware victims paid at least $406 million worth of cryptocurrency to attackers in 2020—quadruple the amount ($92.6 million) paid in 2019, according to the 2021 Crypto Crime Report issued by blockchain analysis firm, Chainalysis. The report also notes the “drastic growth” in the size of the average known ransomware payment, which also quadrupled from $12,000 in Q4 2019 to $54,000 in Q1 2021.

Given those gaudy numbers, it’s tempting to conclude that cyber-criminals are only setting their sights on larger enterprises, but according to the Verizon Business 2020 Data Breach Investigations Report, “the growing number of SMBs using cloud- and web-based applications and tools has made them prime targets for cyberattackers…as SMBs have adjusted their business models, the criminals have adapted their actions in order to keep in step and select the quickest and easiest path to their victims.

While ransomware garners most of the headlines, phishing (where a malicious perpetrator impersonates a trustworthy individual or business to obtain confidential data) is the biggest threat for small organizations, accounting for over 30% of breaches, followed closely by the use of stolen credentials (login passwords) at 27%, according to the Verizon Business report. Ransomware accounted for 27% of the data breaches involving malware infections last year, but 94% of organizations whose data was encrypted following an attack got it back, with twice as many doing so through backups (56%) than by paying the ransom (26%), according to an independent survey of 5,000 IT managers commissioned by cybersecurity provider Sophos.

One of the most common of the phishing scams is the business email compromise (BEC), where the hacker sends an email message that appears to come from a known source, such as a trusted vendor making a legitimate request. Hackers often use the vendor’s logo and a sender address that is a slight variation of the legitimate email address in order to manipulate unsuspecting employees into revealing sensitive information or to initiate a wire transfer.

“It happens all the time,” says Ford, who reports knowing at least ten people that have been duped in BEC scams. “And they’ve suffered significant—$20,000-plus—losses. So number one, we have to protect ourselves and more importantly, we have to protect our clients. We handle client information that is highly confidential, and it’s in our computers, on our servers, and in our clouds. So if we’re using something like ‘ABC123’ for every one of our passwords and somebody gets access to those, all of our clients are at risk.”

Ford’s firm protects client data as well as their own by practicing sound fundamental cybersecurity “hygiene”—best practices—and it begins at the employee level. The latest report by Untangle cites “employees not following cybersecurity rules” as the top barrier to ensuring a secure workplace, so Rise Pittsburgh takes employees through cybersecurity training as soon as they are hired. Employees are mandated to use the company password manager, which creates long, randomized passwords that protect against hacking. If an employee receives a suspicious email, they are instructed to forward it to the IT person, who then issues an alert to all company employees. Data cannot be stored on any computer for more than 24 hours, and must be transferred by the end of the business day to the cloud-based platform Microsoft Teams, where servers are constantly monitored and data is consistently backed up. “When you don’t keep data on your laptop, you have less risk of people getting to the data—and you also have a lot less risk of losing it,” says Ford.

Gary Joel Schacker, SIOR, principal of Long Island, N.Y.-based United Realty, stresses the value of having a skilled IT person on board, rather than taking a DIY approach. “It’s vital to have someone who really knows what’s going on,” says Schacker. “Don’t try to be your own carpenter.”

Malware protection and firewalls are kept up to date on all United Realty computers, and they back up all of their data to an onsite server stored in a locked closet, which constantly backs up data to a local appliance (DATTO), which in turn backs up multiple times a day to the cloud. “In the case of a ransomware attack, we could be up and running in five minutes,” he asserts. “We do this for our own data, and we obviously have confidential information related to our transactional business, so that is all backed up and kept from any prying eyes.” United owns and manages properties as well, using Yardi Voyager as their property management software, and employ the same measures to protect the data of their tenants.

Schacker and Ford have their IT leadership conduct regular cyber audits for their own companies. And while they avoid offering direct cybersecurity guidance to their clients (“It’s not my business. I don’t advise clients on their IT business or how to protect their own data,” says Schacker), Ford suggests to clients that are preparing to relocate that it may be the ideal time to evaluate their cybersecurity infrastructure. “A relocation is a great time to do a cyber audit as well as other processes because you’re already making a change.”

Whether to conduct an audit or implement other cyber protections may no longer be a choice for companies, as insurance carriers will soon make them mandatory, according to Kevin Heher, president of Liberty Insurance Agency in Pittsburgh. “The requirements to do cyber audits, to have cloud backup services, to have multi-factor verification testing are no longer about ‘If I do these things will I get a better rate?’ It’s now about having those things in order to qualify (to be insured),” says Heher. “Right now the underwriting for the cyber insurance market is understated, so you’re going to see a tightening of underwriting requirements.”

Despite the increased exposure to cybersecurity risks that remote work and new time-saving technologies can potentially bring, real estate companies should not shy away from adopting these innovations, says Kovalev. Instead companies should take a proactive stance towards developing effective cybersecurity strategies to protect themselves and their clients.

Source: “DATA AND PRIVACY: Protecting Your Data – and Your Client’s – from Cyberattack“

E-commerce efforts to appeal to a limited pool of warehouse workers could eventually lead to universal income and more appealing spaces, according to the head of a commercial real estate investment company with properties across more than 20 states.

But Dalfen Industrial President Sean Dalfen said during a Bisnow event last week that the movement among companies to add amenities to warehouse spaces — including air conditioning — and increase hourly pay will likely be temporary until robots take over.

“I can tell you, most corporations don’t really care. What they care about is their bottom line. They can tell you they care, but at the end of the day, they’re having trouble getting goods on shelves, and it’s costing them money. They can condition the warehouse, but on a long-term basis they will get rid of those employees and they will replace them with automation,” Dalfen said. “That’s the risk nobody’s talking about right now.”

America’s labor shortage has impacted much of the service industry, from retail and restaurants all the way to distribution centers. Already, many restaurants are using computers and robots to take orders as the pandemic fueled an automation boom in that industry.

To tackle its labor issue, the e-commerce industry has largely responded with higher pay and other perks, fighting not only to lure in new workers but keep the ones they have from jumping across the street to work at another warehouse for fifty cents to a dollar more an hour, the panelists said.

“You’re starting to see some of the similar characteristics of offices where you don’t have a break room, you have a café,” Ryan Cos. Senior Vice President Cloteen Jasmin said. Air conditioning in warehouses used to be a luxury, but now is becoming common, and bus stops are being set up in front of distribution centers to help commuters get to work.

Higher-end finishes are becoming more common at distribution centers, especially if there is office space attached. Office space at a Whole Foods warehouse developed by Ryan “rivals some of the offices that we see in office buildings,” Jasmin said.

Cushman & Wakefield Executive Managing Director Nicole Bennett said much of today’s labor shortage in the warehousing industry has to do with companies striving to keep costs down but workers tiring of low pay and poor conditions.

“There’s a reason why you don’t have enough people coming in. You work in a dark, dingy building that’s freezing cold and you’re not paying enough. You’re going to have a labor shortage,” Bennett said. “You start throwing $20, $30, $40 an hour at them, you’re going to have massive loads of people coming to pick and pack.”

With the recent boom in the e-commerce and logistics industries, fueled by a rise in online shopping, it would appear these companies have plenty of cash to increase salaries. But e-commerce is plagued by low profit margins on all those sweaters and shoes sent directly to U.S. doorsteps, according to a McKinsey & Co. report. Those margins get even more strained as consumers expect deliveries faster than in years past, Dalfen said, forcing retailers and e-commerce companies to open distribution hubs closer to major population centers, real estate that is often much more expensive.

As operation costs rise, automation becomes more appealing. Warehouse automation is expected to grow 14% a year through 2026, taking it from a $15B industry in 2019 to a $30B one by 2026, according to LogisticsIQ.

Increasing automation potentially threatens the total number of jobs and could lead to a major social revolution, Dalfen said. He said cities that adopted higher minimum wages have seen subsequent job losses on the lowest end of the spectrum. Economists at Iowa State University recently reported similar effects, with up to a 3% loss in jobs for every 10% increase in wages. And in April, economists with the International Monetary Fund said past pandemics have led to jobless recoveries among those at the bottom end of the wage spectrum worldwide.

“So you have self-driving vehicles, you have robots stocking shelves. You get rid of cashiers. You’re losing a massive segment of the employment for the population. It will unquestionably be bad,” Dalfen said. “This whole concept of having to re-educate those people, that’s a big deal. We haven’t seen anything like that since the Industrial Revolution, and I think you’re going to have universal basic wage as the need from that standpoint.”

Warehouse automation is not all a bad thing, especially for e-commerce operators facing tight labor supplies across the country, Jasmin said.

“I think that automation is a solution for the labor shortage and it may not necessarily be a zero-sum game. It may actually be complementary, that we make room for automation so that the human experience and human health and wellness can be balanced out so we’re not overworking our people and we’re not pushing them too far. We also reduce human error,” she said. “Robots don’t get sick. They break and you just fix them or put another robot in. Robots don’t get tired.”

The switch to electric labor also comes with design shifts at warehouses. Dalfen said companies like Amazon are designing facilities already with an eye toward automation and ways of reducing the need for human labor.

“They also want their floors perfectly flat. They want laser-guided machinery capabilities. Why? Because they’re going to replace these people with machines,” he said. “This is the elephant in the room.”

Amazon opened a facility in Metro Atlanta, spending more than $200M on technology and automation, CRG Real Estate partner Mike Demperio said. But that didn’t affect the number of workers Amazon needed at the warehouse, where it still employs 1,000 people.

And despite the trend toward automation, Demperio said he is doubtful that will eliminate the number of jobs companies need at warehouses.

“There’s been a push over the last few years to squeeze employees and go to automation. How well did that work?” he said. “We can’t automate the world We’ve tried. But people are necessary. We’re going to have to treat them better. We’re going to have to pay them more. We’re going to have to locate where they can get there. We’re going to have to offer them amenities.”

Source: “Warehouses As Ground Zero For Universal Pay? One Expert Thinks So“

The commercial real estate industry is facing labor shortages across market segments, and companies will need to adapt to hold onto employees.

Commercial real estate companies are facing severe labor shortages in several market sectors, from industrial development and construction to property management and financial analysis. While the industry has a natural proclivity for traditional office space, it is going to have to quickly adapt to hold onto current employees in the midst of the so-called Great Resignation, as well as attract new talent. Flexible work schedules is at the top of the list of employee demands.

The work environment has shifted over the last few years, and companies are beginning to recognize this,” Kent Elliott, principal at RETS Associates, tells GlobeSt.com. “Current employees are seeking new job opportunities that provide a flexible work schedule. Schedule flexibility gives employees the freedom to control their time, which is highly appealing to today’s workforce.”

While flexible work schedules are becoming increasingly important, compensation is still the top factor for candidates. “Many companies are increasing compensation packages and offering items such as signing bonuses or enhanced splits to sweeten the pot for top talent,” says Elliott. “When you are in a negative unemployment market, as we are now in many CRE sectors, it becomes pricier to take someone out of their current job and place them somewhere else.”

These are not temporary changes in employee behavior. Elliott expects the dearth of talent to continue for the next several years, giving prospective employees the upper hand in negotiations. “We are seeing increasing labor shortages across all areas of CRE, and it may take several years for this to abate completely,”’ says Elliott. “The combination of the pandemic and people switching careers during this time has exacerbated the situation and slowed recovery to the labor markets.”

This is why it has become so important for companies to understand the needs and demands of talent to find and secure the best candidates. In light of the current labor shortage, companies need to separate themselves from the crowd to recruit and retain the best possible talent. By offering competitive compensation packages and flexible work schedules, including the option to work from home, [commercial real estate] companies can emerge from The Great Resignation even stronger and, more importantly, position themselves for future strength.”

Source: “How CRE Can Deal With the Great Resignation“