The mining sector has become a significant target for cyberattacks. An increasingly uncertain political climate, new emerging technologies and more sophisticated criminals have resulted in many headline-making breaches over the last year.
Cyberattacks in the mining industry tripled from 10 in 2023 to 30 last year, according to the Calgary-based Mining and Metals Information Sharing and Analysis Centre (MM-ISAC).
“Cybersecurity threats are increasing,” says Lester Chng (pronounced Chung), a senior cybersecurity advisor with Rogers Cybersecure Catalyst. It’s a national centre for training, innovation and collaboration in cybersecurity based at Toronto Metropolitan University and headquartered in Brampton, Ont.
“Mining companies are undergoing significant digital transformation and embracing new technologies that include the use of autonomous vehicles, deployment of internet-of-things devices and cloud computing, all of which increases the attack surface and cyber risk,” says Chng.
Data breaches can be extremely costly. In addition to the loss of corporate secrets that could impact everything from a company’s stock price to its M&A prospects, disrupted mining operations that slow or stop production can have a huge financial impact. Aside from the direct costs, indirect costs include risks to relationships with joint-venture and community partners.
“This may put companies in a precarious position,” Chng says. “Mining executives might have to ask themselves: Is it worth paying a ransom to get the information back?”
To help companies better understand and manage the risk, the Catalyst is offering free cybersecurity training targeted towards small and medium-sized businesses in the mining sector. Companies will be able to learn more about the cybersecurity threats facing the industry, and the strategies and best practices to mitigate against them. The programming is in partnership with the Canadian Cyber Threat Exchange and funded by the Government of Ontario.
The program kicks off with an expert panel on Monday May 12 from 10 a.m. to 11:30 a.m. Panelists include David Hayes, CEO and founder of AVO, the Autonomous Vehicle Organization which developed the Stratos digital platform for mining; Sura Alshear, senior director of IT security at Kinross Gold (TSX: K; NYSE: KGC), and Iamgold’s (TSX: IMG; NYSE: IAG) head of cybersecurity, Alexandre Trouchine.
The session will be moderated by Carlos Chalico, a partner and head of cybersecurity, data protection and privacy at EY. To sign up for the webinar, visit this site.
In addition, the Catalyst is holding a free six-week virtual bootcamp from May 15 to June 19 for mining professionals responsible for cybersecurity, operations, digital risk management, supply chains, procurement and product development. No technical knowledge is required. To learn more about the bootcamp, visit this site.
“We are doing our part for the sector to push out education and training programs,” says Chng. “It's critical to develop well-rehearsed response plans and integrate cybersecurity teams closer to day-to-day business management and operations.”
Companies should start by creating an inventory of all the assets in their IT and operational technology (OT) networks.
“If you don’t know what you have,” says Chng, “how are you going to defend against it? You need to know what’s in your enterprise and then start implementing what we call baseline controls.”
Measures to start with include developing an incident response plan, improving security oversight of diverse operating systems, enforcing strong user-authentication, and backing up and encrypting data. Implementing a practical vulnerability management program with due consideration for both IT and OT systems will significantly reduce risks, he says.
What can make the industry particularly vulnerable is that companies often have remote mines and exploration sites, which can open up many infiltration points to cybercriminals and ransomware groups. This requires synchronization of security across multiple locations and continents, Chng adds.
Companies can also be exposed through their supply chains. As large mining companies look to strengthen their cybersecurity posture, they are looking more rigorously at their suppliers.
“It’s more important than ever that mining suppliers strengthen their cybersecurity in order to remain attractive to domestic and international buyers,” Chng says.
According to the industry-owned MM-ISAC, “cyber resilience is the ultimate team sport.”
“We will continue to see developments in how AI is used in mining both in IT and OT,” centre Chair Kristi Cook, wrote in the non-profit’s 2024 annual report. “However, as we embrace these advancements, we must also recognize the risks that come with increasing reliance on operational technology. As the boundaries between physical and digital assets blur, the potential for cyber-attacks on critical infrastructure grows exponentially.”
Cybersecurity threats may also come from state-sponsored attacks, which often target critical infrastructure like energy and natural resources.
In addition, with global demand rising for critical minerals, there could be a risk of more nation-state interference and disruption.
“As demand for critical minerals increases, threat actors will be shifting their attention,” Chng says. “It’s where the money is, and it’s the perfect storm.”
The preceding Joint Venture Article is PROMOTED CONTENT sponsored by Rogers Cybersecure Catalyst and produced in co-operation with The Northern Miner. Visit: www.cybersecurecatalyst.ca/mining-sector/ for more information.
April 23, 2025
April 23, 2025
Comments