Despite the mining industry’s Operational Technology (OT) systems being vulnerable to cyberattacks, many decision-makers still see these threats as purely an IT issue, even though a breach could potentially disrupt mining operations. By compromising OT systems, cyberattacks can halt mineral extraction processes with severe consequences, including an impact on profitability and damaging reputations, leading to a loss of investor confidence. In the worst-case scenario, an OT hack can endanger the health and safety of mineworkers. Furthermore, OT systems generate huge amounts of historical mining data which, if leaked, can reveal sensitive information to the market or, if lost, can negatively affect future decision-making.
Consequently, this can result in mining houses suffering reputational damage too, as disruptions to operations can affect their share price, cast doubt over their future production capabilities and damage their relationships within the industry.
While there is traditionally role segregation between IT and OT management in mining operations, both areas are technology-based, and mining houses must recognise that both areas should ideally be overseen by the company’s Chief Information Officer (CIO).
From a cyber resilience perspective, IT and OT teams should communicate better and work closer together as this would develop a better understanding of the impact of specific systems going down and how this affects the entire business.
IT must be involved
To effectively manage and protect OT systems, IT has to be involved in the process, especially around securing systems and understanding how they fit into a bigger system architecture.
For mining companies to ensure that their OT systems are adequately protected against cyber threats, they must keep these systems updated and perform regular checks to ensure that they work optimally at all times. Because OT systems form part of the safety ecosystem, these checks should almost be treated like the safety drills that are regularly conducted at a mine.
It is vitally important that OT system operators understand the wider implications of what happens when the system is down. For example, they need to know what happens when the biometric access system goes down and workers cannot be sent down the mineshaft. Additionally, it is also key to understand how various IT systems interlink and whether there are dependencies on specific components that need to be available for a critical system to work.
Furthermore, C-level executives must recognise that some cyber risks extend beyond the IT department and that the right budgets must be made available to both IT and OT to effectively protect these environments. All executives thus need to understand that this must be part of their business objectives and information security has to be at the top of the agenda at board meetings.
Incident response planning
At the same time, mining companies should also not underestimate the importance of having an incident response plan in place to be able to identify, contain and restore systems after a cyberattack. This would include planning for various scenarios when a breach happens, as well as prioritising specific processes and systems based on what the impact of the attack has been on the business.
Mines should also consider implementing cleanroom technology, which plays a key role in ensuring a swift and uncontaminated recovery process for mining operations. Cleanroom technology provides a space on the network where systems can be recovered in an isolated environment and tests whether the data is clean and can be safely brought back into the production environment.
Ultimately, mining companies can benefit significantly from engaging with a specialist in data management and protection to secure their OT environments from cyber threats. While these companies may have general IT and OT skills, their core business remains mining. A data management specialist can bring their expertise to the table and help businesses draw up incident response plans and effectively protect their OT systems while allowing mines to focus on their core business of mineral extraction.