Promise of the Cloud Depends on Security
The mining industry must manage security across geographies, far-flung mine site locations, and the growing interconnections between Information Technology (IT) and Operational Technology (OT). Security must span those networks.
The biggest risk mining industry executives face in terms of cyber security is uncertainty about what, exactly, to do about it. Executives agree cybersecurity is critically important, according to numerous industry surveys. A 2020 survey by market research firm KPMG shows just how slow the mining industry has been in adopting good practices.
Cyberattacks aren’t new. But they’ve gotten worse fast with digital transformation and Pandemic-fuelled remote work. Any company considering cloud capabilities must first establish a strategy with regard to cybersecurity.
Defend and Recover
In late September 2021, the Glasgow, UK-based mining engineering firm Weir Group was hit with a sophisticated cyberattack that forced it to temporarily isolate and shut down core Enterprise Resource Planning (ERP) and engineering applications. The attack cost the company about £5 million (US $6.5 million) in direct costs and between £10 million (US $13 million) and £20 million (US $26 million) in lost revenue, Enterprise Times reported. Weir contained the attack and recovered quickly, but it failed to prevent it.
Most cloud vendors operate with heightened security practices tailored toward protecting their infrastructure, applications and customer data. A good cloud provider will adhere to industry standards and best practices that include:
- ISO 2700x standards, and in particular Implementation Guide ISO 27002
- NIST 800 series
- OWASP (Open Web Application Security Project) methodologies
- CobIT framework
Security Layers
Good cloud providers employ multiple, independent and redundant mechanisms at various levels to block attacks. These measures provide far better security than most organizations can provide for themselves. Levels include application-level security, in-cloud security, virtual systems security, physical security and security tests and reviews.
This multi-pronged approach is necessary because attacks are so varied. For example, Distributed Denial of Service can shut down whole systems by flooding large number of requests from many sources that overwhelm systems. Eavesdropping and “network sniffing” as well as “man-in-the-middle” attacks try to intercept data for malicious purposes. Hackers use IP spoofing to trick a target into thinking traffic is coming from a trusted source. Network reconnaissance surveils network and system topography to plan later attacks, and vulnerability cascading creates a flaw that reverberates throughout a system. Cross Site Scripting (XSS) is a family of attacks that affect access controls.
Protections against such attacks include penetration testing, secure coding, security-in-depth that stops any breach from spreading, patches and Transport Layer Security (TLS) encrypted channels for network communications.
Inventory and Monitor IT and OT Assets
Mining manages business and operational data security across geographies and fleets in far flung site operations, complex logistics, and transportation networks. Most data and cloud security covers Information Technology (IT) assets for business processes. But with mining, Operational Technology (OT) assets are critical and must also be incorporated.
OT assets control machines and physical devices that drill, dig, load, haul, crush, convey, sense and monitor. Any component, equipment control or intelligent sensor could open a door for hackers. Security experts recommend doing a complete inventory of all IT and OT assets and defining roles and responsibilities for both IT and OT functions.
Include OT into regular reporting on threats, vulnerabilities and actions taken. Patch IT and OT assets based upon their criticality and on a regular basis. Monitor the IT and OT networks, devices, and assets, especially where vendors do not provide regular patches or updates for cyber security vulnerabilities.
In our next post we look at cloud implementation and operational requirements for continuous, reliable connectivity to ensure that the right data is pushed to the cloud at the right time.
****
Access the following articles in the Sustainable Mining Network community. Create your free account today!
Learn more within the GEOVIA community which is open to all mining professionals. This is a unique platform in which to discover expert GEOVIA knowledge and more about Sustainable Mining as well as to ask questions about all things mining-related.
The community is also THE place in which to access exclusive GEOVIA expert led articles and videos relating to the sustainable development of the mining sector, industry trends, reports and information on upcoming events and E-seminars. To join for free, just click on the banner above.
To stay up to date with the latest digital innovations enabling the sustainable mines of the future, follow #GEOVIA
