Mining and Metals Sector Has a Long Road Ahead to Address its Cyber Maturity Gap

Increasing connectivity of technology across the mining and metals sector is making it more difficult than ever for companies to keep pace and secure their digital environment, according to a report by EY on ‘Does cyber risk only become a priority once you’ve been attacked?’

According to the report, 55% of energy and resources companies have experienced a significant cybersecurity incident in the last year, yet 48% of respondents believe it is unlikely that they would be able to detect a sophisticated cyber-attack.

Mr. Burgess Cooper, Partner – Cyber Security, EY said, “As mining and metals companies continue to move into the digital age, cyber security needs to be viewed as a key business priority in order to manage risk, particularly in light of the growing threats that exist in today’s digital landscape. It is critical for businesses to ensure that the responsibility of limiting the exposure to cyber risks is not one that can be delegated to one or two individuals. Cyber security is a shared responsibility therefore, to ensure a robust security framework, organisations need to involve all areas of the business, including media relations, investor and government relations, legal, operations, business, executive risk and any material third parties.”

For asset-intensive industries such as mining and metals, the threat is escalating particularly rapidly due to increasing investment in digital, reliance on automation and heightened connectivity between information technology and less mature operational technology. As a result, the report highlights that the entire supply chain is now at risk.

According to Mr. Anjani Agrawal, Partner and National Leader – Metals and Mining, EY, the Indian mining and metals industry is at the cusp of a transformational change, and digital technologies are at the forefront of driving this change. Operations hitherto considered ‘remote’ are being connected through integration of OT and IT systems. “Being asset intensive, the need for productivity is driving internal digital investments, while increasingly global supply chains also expand the attack surface and pathways. A cyber event can impact its sensitive commercial/commodity trading data, and also its social licence to operate, safety, and environment obligations. The metals & mining companies thus need to embed cyber risk management into their agenda to better react and protect,” he added.

Rising threat; inadequate resources

The physical security of remote mining and metals operations is no longer sufficient to protect the enterprise, according to the report. Equipment and infrastructure that would traditionally have been disconnected is now integrated to provide greater operational control. Combined with rising system complexity encompassing multiple networks, this has led to further expansion of the attack paths that can be used by cyber attackers to compromise operations across the whole value chain.

The report also finds that boards are taking an increasingly active role in addressing the growing threat, amid increasing demand on management to provide visibility and assurance relating to cyber risk. However, only 35% of energy and resources companies’ boards have sufficient cybersecurity knowledge for effective oversight of cyber risks, the report finds.

As mining and metals companies continue to move into the digital age, the report further highlights that current budgets may not be sufficient to manage cyber risk. While 53% of energy and resources companies state that they have increased cybersecurity budgets over the last 12 months, more resources may be required to fund critical operational technology for mining and metals companies.