Today all organizations are influenced one way or another by the cyber medium. While not every organization relies on digital channels, but the fact is all of them operate within the online landscape. And this is true for the mining industries as well.
According to a report by Accenture, mining companies are investing in digital technologies to improve their processes and systems. They are implementing online technologies across the organization, including mine operation. Technologies that mining companies are leveraging the most include automation, AI, sensing technologies and remote operating centers.
However, embracing online digital technologies also exposes companies to cyber attacks.
In the most recent Global Risks Report, the World Economic Forum has rated cybersecurity breaches as one of the five most serious threats facing industries today. But the mining industry is highly underprepared when it comes to facing this cyber threat.
In this post, we will take an in-depth look at the nature of the cyber threat faced by global mining companies.
Cyber Attacks in the Mining Sector
An Ernest & Young (EY) report had found that the mining sector is struggling to improve cyber security. The sector was found to lag behind other industries when it comes to closing the cyber security gap.
The report had found that around 55 percent of mining companies in 2017 had experienced a significant cyber attack. In addition, around 48 percent of the mining operators surveyed believed that they don't have the capability to address sophisticated cyber attacks.
The mining industry has experienced a spate of online attacks in the past few years.
· In 2010, mining companies Rio Tinto Group, Fortescue Metal Groups, and BHP Billiton Ltd. had experienced network break. The purpose of the attack was commercial espionage.
· Hackers had hacked the website of Lynas Corporate in February 2012 purportedly to protest against environmental impacts in Malaysia.
· In May 2013, Anonymous had targeted AngloAmerican, the largest producer of platinum allegedly, in an online attack leaking confidential data allegedly for "destroying nature and ancient cultures."
· The network system of a Canadian gold mining company Detour Gold Corp. was hacked in April and May 2015 by a group named Angles_OF_Truth releasing 100GB worth of data. The data was later shared on a torrent site.
· On April 2016, another Canadian mining company Goldcorp suffered a major cyber attack that resulted in a leak of 14.8 GB of confidential data including financial information and employee Personally Identifiable Information (PII).
Despite high profile online attacks in the mining industry, cyber security specialists have found that mining companies have not taken serious initiatives to bolster their network systems. Around 97 percent of mining companies according to the EY report had admitted that existing systems are not fully prepared to prevent major online attacks.
Understanding the Type of Cyber Attacks
Organizations face a broad type of cyber threats. Here is a brief look at some of the common types of online threats faced by mining companies.
1. Network Breach
A network breach involves unauthorized access to sensitive, confidential information stored in the company's network. The breach may result in access to intellectual property, trade secrets, and customer and employee personally identifiable information.
Apart from stealing confidential data, malicious users can break into the system and install viruses, malware, or ransomware that can make important resources inaccessible. This can cause a lot of damage for the company due to decreased productivity.
2. Website Attack
Website is also a common point of attack. The attack may not cause monetary damage to the company. However, hackers may post negative information about the company that will affect brand reputation.
3. SQL Injection Attack
SQL injection attacks target servers containing confidential files. The attack exploits a known vulnerability in a SQL-based server. If the server is vulnerable, a hacker can enter malicious code in the website search box thereby forcing the server to dump confidential information stored on the site.
4. Phishing
Phishing attacks involve a hacker sending an email that seems to be from a trusted individual, which could be company boss, HR manager, or a vendor. The email may seem legit and contain an attached document. But upon opening the document, the system gets infected by a malware or ransomware.
5. Ransomware Attack
Ransomware is a malicious application that demands a ransom when it infects a system. The application will corrupt system data if the ransom demand is not met. Ransomware such as noPetya, WannaCry, and others have caused millions of dollars of losses for corporations in different sectors.
6. MITM Attacks
Man-in-the-Middle or MITM attacks include a user altering the communication between two users using a voice digitizing software and impersonating them to gain access to confidential information. The users will not know that they are talking to a hacker. In this way the hacker can steal critical company information and use it to do damage to the company.
7. Cross-Site Scripting
Cross-site scripting is similar to SQL injection attack. However, the attacker does not attack company's website. Instead, the attacker goes after users who access website of the company. The code is usually inserted into the comment section as a link that runs when a user clicks on it. This type of attack is carried out to go after high value vendor, business partners, or customers of a company.
The above list of cyber attacks is by no means exhaustive. Hackers can compromise online systems in many other ways. Mining companies need to understand the threat of online attacks. They need to identify assets that are at risk of a cyber threat. A cyber security culture should be created to tackle the threats and avoid a crisis.
High profile cyber attacks in the past decades have shown that they cause serious losses to companies. A lot of mining companies have found their trade secrets leaked and brand reputation compromised due to a network breach. That's why it's essential to take measures and reduce the threat of online attacks.
Not taking any action in this regard can result in indirect costs as well. Your company can be charged by organizations such as Federal Trade Commission, Federal Communications Commission, Information Commissioner's Office, and other regulatory agencies for letting a breach happen that resulted in the release of confidential customer or employee information.
Argues Michael Rundus of EY Global Mining & Metals Cybersecurity expert, has issued a warning to mining companies: "If companies continue to take an ad hoc approach to cybersecurity, or act when it is too late to manage vulnerabilities, cyber risk could be the downfall of organizations’ productivity gains and digital advancement aspirations.”
Comentários