Cyber security in mining: not an underground risk

Cyber-attacks are not just an IT problem, but can have significant business impact. Types of impact include operational damage, direct financial loss, loss of a deal, reputational harm and the erosion of long-term competitive advantage. This is not a theoretical or abstract risk for the mining sector; some of the industry’s biggest companies have reportedly been the victim of significant cyber breaches that have caused significant business impact.Two overarching factors drive cyber risk in the mining sector; an increasing reliance on interconnected technology within mining operations, and a range of malicious actors who have specific intent to target the sector.From the server room to the coal face: technology in miningTechnology increasingly drives businesses and the mining sector is no exception, with interconnected and internet-connected systems now the norm. For corporate functions within a mining company, technology is essential for day to day operation of the business. Key examples of this are internal and external business communications, development and documentation of business strategy, storage and analysis reserve data, and delivery of the day to day functions of the business (travel, HR, payroll, etc). At the same time, industrial control systems (ICS) are increasingly being used to control processes at an operational level to improve production and efficiency, and smart technology is increasingly being used to increase productivity.The (data) extractives industry: malicious attackers have specific intent to target mining companiesAlthough cyber security is often seen as a technical problem it is not simply about computers attacking computers. Behind every attempted attack is an individual or group, and identifying their capability and intent are crucial in mounting an effective defence.There are three broad categories of threat actor who actively target the mining sector, all of whom have different capabilities and intent. It is not just larger, high profile companies that are at risk of cyber-attack from these malicious actors; smaller companies operating in a particular environment are equally at risk as the larger organisations.Intelligent intelligence: Nation states’ use of cyberNation states are increasingly using cyber as the primary way in which they gather intelligence to meet national intelligence requirements. Developed nations increasingly have sophisticated and stealthy cyber capabilities, termed Advanced Persistent Threats (APTs) as they can operate undetected on networks for years. At the same time, developing nations are utilising cyber espionage as a quick and economical way of increasing their intelligence services’ capabilities. As the world becomes more complex and economic security becomes more important, states’ intelligence requirements are increasingly broadening away from traditional efforts to intercept other governments’ communications towards hacking corporate networks for information and supporting the development of domestic industries.More worryingly, there is an increasing trend towards disruptive and destructive cyber-attacks, where cyber techniques are being used to create an effect in the physical world. The Stuxnet worm, which targeted the Iranian nuclear programme, was the first (and most advanced) example seen to date, but other attacks attributed to nation states have also taken place on the, a Saudi oil company, a Qatari gas company , and a Turkish oil pipeline.Although much of this capability is concentrated in military and civilian intelligence agencies, states also leverage individuals and groups outside their agencies, to both increase their capability and reach, and also provide “plausible deniability” for attacks.The increasing and continued importance of commodities as traded entities on international markets, reliance on natural resources for economic development and the need for countries to benefit from their own mineral deposits, make the mining industry an important intelligence target for nation states. They also mean that mining companies are potentially a high value target for disruptive or destructive attacks linked to wider geopolitical events.In it for the money: cyber criminalsAlthough the classic modus operandi for cyber criminals has (and will probably remain for the foreseeable future) theft of money or personal/payment card data from the financial services industry and its customers, the past few years have seen an increasing diversification in the criminal market. Sophisticated criminals have now realised the value of sensitive data which they are able to obtain using cyber tools. For example, one group stole market-sensitive information from more than 100 companies, and another stole pre-release information from financial newswires. In both cases these were used to trade for profit on the markets. Separately, a small number of groups have been attempting to influence stock prices and currency values since 2011 using denial of service (DoS) techniques to impact on organisations’ reputation (and therefore market value). It is likely that other groups may seek to influence commodity prices for their own benefit in the future. "Given the level of cyber risk that mining companies now face, this is an issue that cannot be ignored by boards and senior leaders in the sector"Another trend is the rise of extortive cyber-attacks against organisations, primarily using ransomware and DoS tools. Historically, ransomware attacks involved malware such as Cryptolocker which would encrypt the entire hard drive of a users’ home computer, before demanding a relatively small Bitcoin ransom. This high volume/low profit model is now changing, with some criminal groups deploying ransomware against organisational systems, with newer ransomware able to move through networks, encrypting data as it goes. As organisations have more money than individuals, criminals are able to demand bigger ransom payments. Although traditionally DoS attacks have been used by activists to take websites offline, criminals are also now using DoS tools to extort money from organisations. More difficult to mount, DoS attacks are possible on ICS, with vulnerabilities discovered regularly.Hacktivism: it’s the modern way to protestHacktivism (a portmanteau of hacking and activism) refers to the use of cyber techniques for political, religious, social and environmental causes. Although hacktivists are generally characterised as lower tech, unpredictable and disruptive actors, their ability to cause damage is increasing. Hacktivists’ main aim is to generate publicity for and awareness of their cause, and their activities are typically more high profile and disruptive than those of other actors. Hacktivists’ favoured techniques are website defacement, DoS, social media account hijacking and the theft and exposure of sensitive or embarrassing information.As their aim is publicity, hacktivists look for high-profile targets which will generate them maximum exposure, not always targets that are directly linked to their cause. One of the best examples is the Syrian Electronic Army, a pro-Assad activist group that has defaced websites of major companies and sports teams, and has hijacked the social media accounts of major organisations. Environmental groups are also active online targeting the mining sector, in particular Operation Green Rights (a spin-off from the hacktivist collective Anonymous which blends online and real world protest).Given the volatile political environments in which mining companies often operate, and the social and environmental protest movements faced by the sector, hacktivism is a threat that mining companies cannot ignore.Cyber proliferation: the increasing blurring of capabilityAlthough a few years ago the three categories of threat actor were fairly distinct, the boundaries between them are becoming increasingly blurred. One of the reasons for this is the proliferation of cyber technology and expertise, facilitated in large part by the dark web. Criminal marketplaces and forums allow individuals with little or no technical knowledge to purchase malware, anonymous hosting, expertise and supporting services (eg money laundering) to create a “virtual” organised crime group. This moves cyber from being a niche to a mainstream activity and increases the threat to organisations.Another worrying trend is the increasing overlap between hacktivists’ and nation states’ cyber activity. This is characterised either by “patriotic hacktivists” supporting nation states during times of geopolitical tension (eg during the Russia/Ukraine conflict) or by nation states creating or supporting hacktivist groups as proxies for malicious cyber activity. The best example of the latter was the “Guardians of Peace”, a hacktivist group responsible for the attack on Sony Pictures, which the US government believes was created by the North Korean state to mount that attack.ConclusionVery capable malicious actors have specific intent to target companies in the mining sector; both operational and corporate systems are at risk.Given the level of cyber risk that mining companies now face, this is an issue that cannot be ignored by boards and senior leaders in the sector. Unfortunately some organisations still see cyber security as an IT-issue, rather than a business risk with the potential to cause significant damage to a company’s bottom line. Good cyber defence relies on a cross-organisational effort that encompasses both technical defences, and non-technical controls and business processes. Rather than taking a technical, IT-led approach to cyber defence, mining companies should take the following steps to enhance their cyber security:• Understand the specific threat they face, given their company profile and geographical locations.• Prioritise their digital assets (both data and systems) which malicious actors may target and which would cause them damage.• Implement a business-led, holistic cyber security programme covering both technical controls and non-technical business/information security processes.• Accept that even the best-defended organisations can be breached and prepare for the worst case by developing and testing cyber breach response plans.James Hampshire is a senior consultant in Control Risks’ cyber security practice. He joined the firm from the UK National Crime Agency, where he managed the National Cyber Crime Unit’s international engagement team. Hampshire was previously seconded to the UK Cyber Security Operations Centre (CSOC) where he headed intelligence assessment, and was a senior member of the team that managed cyber incident response during the London 2012 Olympic Games Information security when travellingFor many years mining companies have managed physical security risks such as kidnap and theft when their staff have travelled to hostile or remote locations. However, the increasing ability and business need to stay connected to a corporate network exposes business travellers to new forms of risk.Business travellers are often busy, tired and navigating potentially unfamiliar environments. They are therefore vulnerable to making mistakes that present potential attackers with an opportunity. Remote network connectivity also presents opportunities to attackers that do not necessarily exist in the office environment.For example, malicious actors may seek to:• Steal corporate devices.• Hijack or spoof Wi-Fi connections to intercept data.• Physically interfere with devices to copy data or install malicious software.An additional challenge in emerging markets is that governments often do not have effective legislative and law enforcement capabilities to combat cybercrime, meaning these jurisdictions present a low-risk, high-reward opportunity for cyber threat actors.Once they have access to a device or a network, malicious actors can steal data or disrupt systems. Alternatively an advanced attacker may take the opportunity to establish a long term, covert presence on your corporate network. All of these can have a significant business impact. There are a series of sensible steps that mining companies can take to reduce their exposure to cyber security risk when their employees are travelling. The best way to do this is by establishing a corporate information security policy specific to travel which is threat-based, location- and traveller-specific, and is supported by both business processes and technical controls.

ABOUT

SOLUTIONS

LEGAL

SOCIAL

METS

Cyber security in mining: not an underground risk

Already have an account? Sign in here

MORE ON THIS TOPIC

FROM OUR PARTNERS

RESOURCE STOCKS

Forsys Metals' pipeline of catalysts to excite the market

RESOURCE STOCKS

The largest mineable measured uranium deposit in the USA

MOST POPULAR

MINERS

Anglo American shares tumble on planned production cuts

MINER'S RIGHT

Iron ore's unexpected boom rumbles on, defying experts

ESG

WATCH: What do American college students think about mining?

LATIN AMERICA

Lumina's Cangrejos a big beast

RESEARCH

Premium subscribers only

View more

Mining Journal Intelligence World Risk Report 2023 (feat. MineHutte ratings)

Mining Journal Intelligence Mining Equities Report 2023

Mining Journal Intelligence Global Leadership Report 2023: Social licence

Mining Journal Intelligence Project Pipeline Handbook 2023

THE ASPERMONT BRAND PORTFOLIO

Login

Not a Subscriber?

Subscribe Now