Does cyber risk only become a priority once you’ve been attacked?

Cyber threats are evolving and escalating at an especially alarming rate for asset-intensive industries such as mining and metals (M&M).

Cyber threats are growing at an exponential rate globally. According to the latest EY Global Information Security Survey (GISS), 71% of mining respondents have seen an increase in the number of disruptive attacks over the past 12 months and 55% of M&M executives are worried about their ability to manage a threat.

Today, all mining organizations are digital by default — in an increasingly connected world, the digital landscape is vast, with every asset owned or used by an organization representing another node in the network.

Organizations are increasingly reliant on technology, automation and operations data to drive productivity gains, margin improvement and cost containment goals. At the same time, it has never been more difficult for organizations to understand and secure the digital environment in which they operate, or their interactions with it.

• Every organization’s technology landscape is both bespoke and complex: It spans multiple accountable teams for strategic planning, budgeting and support, as well as encompasses multiple networks and infrastructure that may be on-premises, in the cloud, or owned and managed by a third party.
• Defining an “organization” is difficult: Blurring the security perimeter further, there has been a proliferation of devices belonging to employees, customers and suppliers (including laptops, tablets, smartphones, edge computing solutions, smart sensors and more) with access to the organization’s systems.
• Increased connectivity between information technology (IT) and less mature operational technology (OT) environments widens the “attack surface:” A cyber incident has the potential to disrupt production or processing, safety and cost efficiency and have a direct impact on business strategies and goals.

Cyber incidents can be malicious or unintentional. They range from business service interruptions and large-scale data breaches of commercial, personal and customer information, to cyber fraud, ransomware (such as WannaCry, NotPetya and REvil) and advanced persistence threat campaigns on strategic targets.

What is the cost of cyber threats?

Cybersecurity Ventures expects global cybercrime costs to grow by 15% per year over the next five years, reaching US$10.5 trillion annually by 2025, up from US$3 trillion in 2015.¹

There can be significant consequences, as depicted below, should a cyber attack occur within an operational facility or affect operational assets.

The cyber threat landscape is complex and spans IT and OT

One challenge is that the sector has embarked on a massive digital transformation journey in recent years, with M&M companies connecting their IT with OT to modernize infrastructure and control their supply chains and operations more effectively. Digital transformation creates powerful new opportunities but, as the different environments merge, the attack surface area increases. This is causing a lot of stress. OT systems have started using cloud services, and adoption will accelerate quickly over the next five years, which will open up more cybersecurity challenges.

Threat actors have started targeting the M&M sector with ever-greater frequency: there have been a number of major cyber incidents over the past 18 months, including those affecting Norsk Hydro and BlueScope Steel. These events had a significant impact on operations through outages and the associated financial impact, making the potential ramifications of a threat clear.

The challenge

The research suggests that cybersecurity funding has not kept up with the growing risk. Half of the GISS respondents say budgets are lower than needed to deal with existing cyber-related challenges, and more than 45% think it’s just a matter of time before there is a breach that could have been avoided with adequate funding. This proportion is higher in M&M than in the other sectors surveyed where, on average, 36% of leaders believe that underfunding is making a breach inevitable.

In addition, regulatory fragmentation is causing additional work and resourcing problems. Sixty-seven percent believe that regulation will become more fragmented and therefore more time consuming to manage in the years to come, which is 10% more than other sectors. In addition, 71% of those surveyed believe that the COVID-19 pandemic and the rapid change to working practices has increased the risk of noncompliance, which is significantly more than in other sectors.

Strong connections between CISO and other departments are needed to influence security by design. Yet it appears that the cyber function within mining companies has a good or strong relationship with IT and risk functions; however, it lacks the confidence and trust of other functions.

Being ahead of cyber threats

A step change in the culture and awareness of cyber risk within the M&M sector is needed to resolve the gaping hole that the “human factor” exposes to cyber resilience and preparedness. The urgency becomes more critical when the ideology that it is no longer “if” but “when” is accepted.

Organizations need to apply good risk management principles, which starts with thinking about the issue, such as cyber risk, just like a business risk. Understanding the cyber threat landscape is the first and vital foundational step in the change to improve cyber maturity. To address this, M&M companies need to have a clear plan that forms part of their digital road map and risk management plan.

The first step is to establish a baseline of basic cyber controls. This baseline, supported by a risk-based approach to prioritize strategic and long-term cyber investment, should be aligned with each organization’s top cyber threat scenarios.

Organizations should adopt a cybersecurity framework for the consistent identification of critical cyber control gaps, threats and actions required to achieve the target risk profile. We believe that irrespectively of the framework adopted, a risk-based approach should be taken that is fit for purpose, adopts a balance between “protect” and “react,” and meets the operational requirements of an organization.

The following is a robust cyber threat approach:

• Identify the real risks: map out critical assets across systems and businesses
• Prioritize what matters most: assume breaches will occur, and improve controls and processes to identify, protect, detect, respond and recover from attacks
• Govern and monitor performance: regularly assess performance and residual risk position
• Enhance investments: accept manageable risks where the budget is not available
• Enable business performance: make security everyone’s responsibility