AbiDaoud: Technology brings miners visibility, value, plus vulnerability

In Australia to talk to a major gathering of big miners and many of the world's leading mining suppliers, AbiDaoud, a 20-year veteran of the IT space recognised as a "business transformation" leader who has been in mining with HudBay Minerals and now TSX-listed Yamana for the past decade, says the industry faces clear and present threats to IT assets, and financial and customer data. But the biggest threat of all, he believes, is to "your industrial control systems".Highlighting the point was a 10-minute video which showed and told the story of how hactivists systematically infiltrated and then caused catastrophic disruption to a fictitious US power utility, with the tone of narration matching the cold precision of the hackers and their actions. Why did they do it? To cause civil unrest, raise awareness of a cause, or just for the thrill of it, the video narrator suggested, before adding they would surely use the experience gained to commit the crime over and over in future."Pretty scary stuff, huh?" AbiDaoud said at the recent Austmine 2019 conference in Brisbane, Australia, which drew more than 1,200 industry delegates.The mix of awed silence and anxious murmurs in the auditorium conveyed the answer."If there is one thing you can take away from the video, in the context of our industry, it's that industrial control systems are probably our most vulnerable asset from a cyber security perspective," he said."If there is one thing you should focus on - or only one thing you could focus on given limited resources and capital - it's to really secure your industrial control systems."This is not to say your IT assets and financial data, and your customer data, are not important. But if you were thinking of level of risk when it comes to disrupting your company's ability to do business there is no more valuable target than your processing plants, your mines, your equipment …"The conference had already heard from a global Accenture expert on disruption in mining and other industries that the rise of autonomous mine fleets and connected remote operating systems were "a wet dream for hackers".A senior executive with a global mining equipment manufacturer and fleet management technology company told Mining Journal on the sidelines of the conference that current mobile fleet control systems were "absolutely an increased safety risk", even so-called closed operating systems."The mining industry has been isolated, but it ain't going to be anymore," he said."Welcome to the new world."The conference also heard from chairman of the Mining and Metals Information Sharing and Analysis Centre and director of information services at Teck Resources, Rob Labbé that 40% of MM-ISAC members had detected ransomware in their control systems this year."As we move towards digital mining we're going to get to the point in every operation where effective cyber security isn't just about protecting your data - it actually becomes fundamental to save production," Labbé said. "We're still connecting PLCs (programmable logic controllers) that were designed in the 80s, maybe slightly improved in the 90s, to broader network connections."How can we reasonably expect technology that was designed 20 years ago to protect us from threats that were just invented yesterday?"AbiDaoud said outdated technology was one of five significant potential weaknesses for miners using various technologies to connect and optimise mining business value chains, ‘end-to-end', while increasing the visibility and, potentially, vulnerabilities, within said value chains."It's worth talking about the differences between risks, threats and vulnerabilities because a lot of people talk about cyber risks," he said."There is no such thing as cyber risk - that is a misused term [that is] is used all the time. I don't know why it used the way it is. The only kind of risk there is in this world is business risk."There are things called cyber threats, and those threats are what we need to focus on."And if you were to think of them as building blocks for one another, vulnerabilities are the building blocks to threats, and threats are the building blocks of risk."The difference is important because as you begin to invest in your cyber program, you hear a lot of talk about a risk-based approach. This is one of those relationships where one threat can yield many risks, and one vulnerability can yield many threats, and that's the complexity for either security officers or technology leaders to help their business understand that."What would a business risk be? It could be the disruption of your copper mill. That can happen from a fire, an explosion, a cyber attack - a variety of different threats."AbiDaoud said other evident vulnerabilities for miners were supply chains, employees, and poor processes."Our suppliers are probably our biggest challenge because security is built on trust, and rather than come directly at you and try to penetrate your firewall or infiltrate your systems or your servers, it's much easier for me to come through a trusted partner," he said."The video highlighted exploitation and targeting of employees with specific spear phishing campaigns that the employees fell for. If you've ever done covert spear phishing campaign in your organisation you know you'll never get zero response; there will always be about 10% of employees who will click the link no matter how much education and awareness there is, and it only takes one person to click on the link and you're vulnerable."I can't emphasise enough bad software engineering as the third threat. I won't name names but there are software manufacturers used in the mining space that require you to have admin privileges to run their software."How bad is that? Who architects a piece of software that requires admin privileges? That is elevated access [for hackers]!"This is something that we need to start taking seriously."Another major challenge was that miners, particularly smaller ones, were generally "outgunned and outnumbered"."The attackers have a lot more time and patience, they have a tonne more resources than we do, and they're not constrained or confined by the rules of the corporate world that we live in," AbiDaoud said."Many companies are publicly traded so there are certain things we have to do, approvals we have to get … [and] certain things we cannot do quickly, and they're very well aware of that."

ABOUT

SOLUTIONS

LEGAL

SOCIAL

EVENTS COVERAGE

AbiDaoud: Technology brings miners visibility, value, plus vulnerability

Already have an account? Sign in here

MORE ON THIS TOPIC

FROM OUR PARTNERS

RESOURCE STOCKS

Forsys Metals' pipeline of catalysts to excite the market

RESOURCE STOCKS

The largest mineable measured uranium deposit in the USA

MOST POPULAR

ESG

Braskem faces lawsuit over Maceió mines as city declares emergency

BASE METALS

Vale Base Metals boss stands down

REGULATION

Heat grows for Sandfire over Aboriginal artefacts damage

MINER'S RIGHT

Supply squeeze forces iron ore up

RESEARCH

Premium subscribers only

View more

Mining Journal Intelligence World Risk Report 2023 (feat. MineHutte ratings)

Mining Journal Intelligence Mining Equities Report 2023

Mining Journal Intelligence Global Leadership Report 2023: Social licence

Mining Journal Intelligence Project Pipeline Handbook 2023

THE ASPERMONT BRAND PORTFOLIO

Login

Not a Subscriber?

Subscribe Now