Don’t let the bad guys win. Everyone has a stake in ensuring the cyber resiliency of our mines

Cyber-security attacks have increased in mining. Recent reports of operation shutdowns in Canada, Europe and elsewhere demonstrate the criticality of ensuring the cyber resiliency of mining operations — it’s not a question of whether an attack will happen, but rather whether it will be successful, and if so, are you set up to minimize the impact of such an event? But who is overall responsible for the cyber resiliency of a company and its operations? What roles do boards play, or executives? Is it an information technology (IT) responsibility, or does it sit in operations? Should you take a corporate or decentralized approach? What is good practice? In today’s digital world, cyber security is no longer simply an IT problem. As mine operations are digitalized, autonomous equipment is connected, and much of the operational systems are connected through the cloud, hence the cyber risk is elevated. Cyber resiliency has become a crucial requirement that is driving the need for operational technology (OT)/IT integration and turning the lens on supply-chain resiliency to ensure mine operations are protected from cyber weaknesses brought in by suppliers. Luckily, there are organizations helping advance the mining industry toward a more cyber-resilient future. The Mining and Metals Information Sharing Analysis Centre (MMISAC) brings mining companies together to share threat intelligence, collaborate on best practices, and work throughout the industry to keep our mines and our companies as secure as possible. But where do we start? Today’s threats On Dec. 29, 2022, Copper Mountain Mining Corp. in British Columbia, Canada, announced that “… the company’s IT systems at its Copper Mountain Mine and corporate office were subject to a ransomware attack late on Dec. 27, 2022... The company has isolated operations, switched to manual processes where possible, and the mill has been preventatively shut down to determine the effect on its control system.” It would be well over a week before the mill was back to full production. This major interruption in production could happen to any mining company. In March 2019, Norwegian aluminum processor Norsk Hydro fell victim to an attack that forced its plants across two continents to stop production for almost a week, costing the company more than $50 million. And there are more examples out there. But how do these attacks happen? In the case of Copper Mountain, BleepingComputer.com reported that a cyber criminal had offered to sell account credentials belonging to a Copper Mountain employee on a hacker marketplace on Dec. 13, 2022, and suggested it is likely that hackers used a compromised account to gain access to the company’s network. Phishing emails — bogus emails designed to trick the recipient into providing confidential information — abound. And despite the best training and the best of intentions, mistakes happen and employees (or bosses) click the wrong button. According to the Forbes article on “The True Cost of Cybercrime for Business,” it is estimated that cybercrime has cost organizations approximately $6 trillion per year on average through 2021. “Every organization will get phished, and everyone will have someone that will click on something,” said Rob Labbé, founding chair of the MM-ISAC. “The question is, then, how are you going to minimize the impact?” But emails are not the only access points. With the digitalization of the mining industry and the connectivity across operations and equipment, one of the biggest cyber-security risks today comes from vulnerabilities brought in by vendors, software companies and service providers. “Anyone with a connection to your network can bring in a vulnerability,” said Cherie Burgett, the MM-ISAC’s director of cyber intelligence operations. “Many vendors need remote access to function, to execute their work.” Most mining companies use service providers — consultants, third-party IT or management services — who must remotely connect into the company’s systems. These are the systems being targeted. Those tools (third-party systems) are already white-listed, so a breach of them goes undetected and the system is hijacked. Every software has a vulnerability. Every piece of code can be vulnerable and requires constant updates. Anyone can get phished and can easily give up their passwords to those tools and systems. “The risk is that it provides an avenue for the bad guys to use those same tools,” Labbé warned. “The tools are there for legitimate purposes. They haven’t knowingly installed something malicious, but hackers are looking for them to use as access points.” Alex Dow, co-founder and chief innovation officer at Mirai Security, a boutique security consultancy that specializes in mining, works with many different companies and has seen first-hand some of the common cyber risks. Whereas the major mining corporations tend to have their own internal IT and cybersecurity teams, driving toward implementation of best practices and standards, many of the juniors and smaller mid-tier miners often completely outsource IT, and along with it, cyber security. “Among the juniors, many are going to the Apple store, buying a laptop and that’s it,” Dow said. “And that middle market is generally not internalizing IT but outsourcing to a third party to completely manage it. In these cases, they are less likely to be following the standards but are more often than not doing ‘just-in-time IT’ due to budget and resourcing restraints.” One major risk of this approach is that without proper processes in place, an attack on one part of the organization can give someone swift access to the rest of the organization. For mining companies, that can mean an attacker that gains access through the IT system can connect into the OT systems. “Attacks are inevitable now,” Burgett said. “People are targeting mining and they are targeting mining suppliers. But an attack, like a phishing attack, should never extend to your production. Too many attacks are having successful breaches. I think it’s because of an assumption that a cyber attack will never happen, that ‘no one would target our company.’ But you need to assume it will and plan accordingly.” Cyber security is everyone’s problem Good practice for cyber resiliency requires a multistaged approach. From the board to the site managers, an integrated framework of responsibilities is needed to guide the best decisions for the company. The board of directors and senior executive team own the risk, Labbé explained. This includes requirements for reporting, understanding and mitigation. “Cyber risk is material risk that must be managed by the senior executive team and the board, like other material risks to the business. If you’re a large miner, that means your CISO or security leader should be part of the executive management team that owns that risk. For a smaller miner without a CISO, you need somebody, even a third party, embedded in the executive team to help manage that risk.” Labbé cautions that many companies still see cyber security as an IT or technology problem, but in reality it is a business or process problem. “Cyber resiliency must be managed as part of the senior executive team and reported to the board. It can’t be buried; it’s too material now. Particularly for mining companies further down the innovation path — for them it’s absolutely critical.” Cyber security at site As operational systems become more sophisticated and connected, who, then, is responsible to manage their cyber risk? “Operational technology needs to be decentralized,” Labbé said. “A site has to own their OT, the general manager has to have full management of that. However, cyber security needs to be centralized. This means that at the site level, cyber resiliency is about risk and relationships.” The integration of IT and OT security is a complex task. One challenge is the tendency for many security practitioners to approach the issue as a technical challenge. “OT security is, in my opinion, one of the most human of all cybersecurity domains,” Labbé said. Due to the safety, environmental and other acute risks inherent in most industrial settings, including mines, those operations are built on trust between the people working within it. For the corporate cybersecurity personnel coming into the mine, that means they must take the time to build those relationships, understand the mine, its processes, risks and requirements, and earn the site’s trust. “Demonstrate that the site can trust that you will operate safely,” Labbé cautioned. “Never put production or safety at risk at site.” Cyber security done poorly on the operational side — which can be as simple as blindly applying practices that are accepted in IT to the OT environment — can have devastating effects on production. “You can be worse than any malware and more effective at bringing down operations,” Labbé said. “That risk is real. The general manager sees what we do in IT security and thinks ‘not in my mine.’ In OT, maintaining safety and production comes first.” On the flip side, site personnel need to recognize that they cannot do this by themselves. They need to understand that cyber security is a risk to reliability and safety at site, and no mine is equipped to — or should be expected to — be responsible for cyber resiliency on their own. “Site leadership needs to do their half of that trust building,” Labbé said. “Teach the cyber teams the processes about the mine. Meet in the middle. There will be a need for some change to make improvements but that is a plan you should build together.” Stay away, Chicken Little In a perfect world, mining companies should isolate the business-critical systems that can interrupt production or hurt people, and minimize the accessibility of those operational systems. However, with the digitalization of mining many more actors require remote connectivity to the systems in the mine. “Unfortunately, for a number of suppliers that have been offering technologies for a decade or more, they had developed their products before this isolation requirement existed,” Dow said. GMG/MM-ISAC Cyber Security Working Group The Global Mining Guidelines Group (GMG) facilitates industry-wide collaboration on common challenges, enabling the sharing of experiences and knowledge in a structured way. The GMG/MM-ISAC Cyber Security Working Group aims to foster awareness, develop a culture of cyber security, and provide guidance for the global industry. Why cyber security matters Adopting prudent security measures and implementing an integrated cyber-security management framework is essential for any mining organization to prevent service disruption and to be able to react to threats. It is critical to build reliable, secure and resilient mining operations to enable secure convergence between operational technology and information technology (OT/IT), and to drive accountability across the entire value chain. Everyone is welcome to join and participate in the GMG/MM-ISAC Cyber Security Working Group; membership to either organization is not required and participation is free. Securing the cyber resilience of mining operations is everyone’s responsibility — it is not just the IT department’s responsibility. The more you know, the better equipped you will be to help prevent a breach or attack. Hackers use sophisticated methods to infiltrate organizations, and access points are plentifu. Join peers to learn good practices and/or help guide mining stakeholders in their efforts to design safe, secure, reliable and resilient cyber-security infrastructures that adhere to regulatory, trust and privacy best practices. “They built their entire technology and platform around easy connectivity, which was a good offering at the time. However, today we realize that easy accessibility and connectivity to those systems — necessary for operations support — could also enable bad actors who could gravely impact the mine. So, we try to put blockers in place, but it requires very creative network security architectures.” There is a balance required. On the one hand, major connectivity throughout the mine is a necessity to support the equipment and processes because, at the end of the day, we need to enable the business. But that brings with it heightened cyber risk and often great complexity to mitigate cyber risk across the web of systems in a mine. “We focus on minimizing the attack surface of a mine, through isolation of systems,” Dow said. “The greater the attack surface, the more likely an unsophisticated attacker could gain access to it.” Dow’s advice to mining companies is to focus on mitigating the major risk, but not get caught up trying for a perfect solution. “No business can afford to solve all problems, so mine management and executives need to be clear on where the priorities lie,” Dow said. “Otherwise, it results in the Chicken Little syndrome, with the cyber-security team always squawking that the sky is falling.” There are a few considerations for mining companies: Common attack patterns: Groups such as the MM-ISAC enable companies access to mining-curated threat intelligence and can identify typical patterns. Understand what threats are out there and do an internal review to understand how that threat might play out within the business. Business-critical systems: Identify what systems are business critical and assess what would happen if an attacker gained access (such as the accounting system, the mobile fleet). How is that system accessible? Can they operate manually? What is the impact of that system going down? What does a bad day look like? Make cyber security and information security part of the conversation: Ensure your company has standards and guidance to adhere to. Use tools such as the MM-ISAC threat model. Make cyber security part of the contractual obligation of supply, as well as other site-cyber resiliency aspects such as standards, breach notifications, and remote-access requirements. Business continuity planning/disaster recovery planning: Identify the systems required to help you make money and what happens if any one of those systems break. Dow said, “We all know, for example, that when a haul truck is out of service it means a loss of tons per hour. Now, if the haul truck is autonomous, it relies on more technology and systems to function. If those systems break, can the haul truck operate manually? Then repeat the process across all systems. What is the impact, the cost, of that system stopping, and where does technology touch these systems, providing potential avenues for an attacker? This will map out the cyber-security requirements for your operation.” Whole-of-industry approach Cyber resiliency in mining requires a wholeof- industry approach. Groups such as the MMISAC and Global Mining Guidelines Group (GMG) are driving industry momentum to ensure all of mining has access to good practices and support to mitigate risks and take action. “The reality is that we all face the same risks; the same groups are attacking all of us,” Labbé said. “A collaborative approach like the MM-ISAC is like having a neighborhood watch. It provides the ability to share information and see what each other is seeing. It is critical to amass knowledge to protect. No one gains from their cyber security being better than the others’ — there is no increase in dollars per pound of copper. However, the risk of not collaborating on cyber is major; we all stand to lose. It is in your best interest, regardless of your size of operation, to work together.” As geopolitical risk grows, the positioning of mining and metals at the start of the supply chain for everything makes our industry increasingly a target. Meanwhile, the sophistication of the attacks is only going to get more challenging. “The good news is that we haven’t been as targeted as other industries like healthcare, retail, and oil and gas,” Burgett said. “In fact, not until recently was cyber risk highly affecting mining. My worry is that we become like healthcare and are slammed constantly. We aren’t there yet, but could be very soon.” Organizations that do share and collaborate have a greater chance as they benefit from collectively amassing intelligence. “Together we are stronger than the individual sum,” said Labbé. “Collaboration can work well for a small single-line miner or a global major. That is the key going forward. We need to collaborate at an industry-wide level because the bad guys are already collaborating. The future is uncertain, but there’s a light at the end of the tunnel that isn’t a train. To get there requires a collaborative approach.” Cyber security is a team sport Working as an industry to identify, detect and protect mining operations The Mining and Metals Information Sharing Analysis Centre (MM-ISAC) was established in 2018. Sharing communities have evolved into a central point of trust — collecting, analyzing and disseminating actionable intelligence for its members in near-real time. Threat-intelligence sharing enables community members to defend themselves based upon the threats that federal governments and other peer organizations detect and share. Done correctly, cyberintelligence threat sharing: Speeds attack detection.Deepens detection capabilities.Produces a timely response to new indicators of compromise (IOC) for other organizations that may likely see the same or similar threats. Teamwork makes the dream work The MM-ISAC’s goal is to improve the cyber resiliency of the global mining and metals industry. In the MM-ISAC community there is peerto- peer sharing through events, webinars and workshops; networking and matchmaking; and efforts to make threat intelligence actionable for its members. These members also collaborate within four working groups: Cyber security for OT. Focus areas include high-level guidance around OT risk assessment; sharing best practices and what each member is doing; dealing with the Internet of Things (IoT) and cloud architectures as a mining community and dealing with onboard systems available through public websites. Members are currently outlining a project plan to update and expand the MM-ISAC autonomous haulage systems (AHS) threat model. Internal processes. Focus areas include developing and gathering templates, checklists and more that are specific to the industry; developing an incident response plan, maturity model, and benchmarking mechanism; guidance from peers for a software of security operation center (SOC); building a vulnerability management process; and more. Threat intelligence and threat hunting. Focus areas include sharing of peers’ findings, intelligence, indicators and how members are handling cyber events; threat hunting; how to collect and communicate threat intelligence with different audiences in a company; how to get ahead of headlines; and more. Supply-chain resiliency. Focus areas include growing the MM-ISAC cyber-security readiness rating program; helping the vendor community to improve; and how to build highly functional relationships with both vendors and various departments across the mining company. A centralized and simple approach to risk management assessment The mining sector relies on third parties to deliver products and services. With the uptick in cyber-security incidents, mining companies are needing to assess additional risks a supplier may bring, typically through the dreaded cyber security questionnaire. But a simpler solution now exists: Suppliers: fill out one form that is viewed by many companies.Mining companies: fewer forms makes assessing vendor forms manageable. The MM-ISAC cyber-security readiness rating addresses the increasing security risk within the mining and metals industry supply chain: Cyber-security risk rating for vendors.Identifies risk management capabilities.Assessment of governance and technical capabilities, risk and safety culture. The result is a cyber-security readiness rating that identifies high-level security and privacy facts that provide security and threat risk assurance that can be leveraged by organizations during the vendor screening and selection process. Suppliers fill out one questionnaire for potential business with multiple companies. A rising tide lifts all boats. The MMISAC invites all companies across the global mining industry — operators and suppliers — to collaborate toward improved cyber resiliency for all. Readers can learn more about MM-ISAC and how to join the community, or get more information on the group’s cyber-security readiness rating by contacting programs@mmisac.org or visiting www.mmisac.org.

Don’t let the bad guys win. Everyone has a stake in ensuring the cyber resiliency of our mines

Authored by:
Heather Ednie

To view the past issues of the UCA magazine you must be a member of SME/UCA.

Gold retains key reserve status despite surging bond yields, central bankers say

China demands copper supply commitments for Anglo Teck merger approval, sources say

Leaders in mining excellence honored by NMA, federal agencies

Gold retains key reserve status despite surging bond yields, central bankers say

China demands copper supply commitments for Anglo Teck merger approval, sources say

Leaders in mining excellence honored by NMA, federal agencies

To view the past issues of the UCA magazine you must be a member of SME/UCA.

MINEXCHANGE 2023 SME Annual Conference wraps up in Denver, CO

Extraction of critical electronic materials from steelmaking wastes

Related Articles

How GeologicAI uses high-resolution data to reduce uncertainty in mining

AI-ready digital twin for mineral processing plants: Maximizing copper production with dynamic water management

Roundtable discussion on mine finance

Bubbles and particles for fun and profit

Gold retains key reserve status despite surging bond yields, central bankers say

China demands copper supply commitments for Anglo Teck merger approval, sources say

Leaders in mining excellence honored by NMA, federal agencies

Gold retains key reserve status despite surging bond yields, central bankers say

China demands copper supply commitments for Anglo Teck merger approval, sources say

Leaders in mining excellence honored by NMA, federal agencies

Use Single Sign On