2018年-德勤全球_An_integrated_approach_to_combat_cyber_risk_22页_656kb

Summary of "An Integrated Approach to Combat Cyber Risk: Securing Industrial Operations in Mining"

Core Content

The document outlines the growing cyber risks facing the mining industry due to the integration of digital technologies such as IoT, automation, and robotics. It emphasizes the need for an integrated approach that combines IT and engineering expertise to secure Industrial Control Systems (ICS) and address the evolving threat landscape.

Main Viewpoints

• Cyber Security is Critical: The mining industry, once considered a low-priority target for cyber criminals, is now increasingly vulnerable due to digital transformation and greater connectivity.
• ICS Vulnerabilities: ICS were not originally designed with security in mind, making them susceptible to cyber threats that can compromise safety, production, and business operations.
• Threat Landscape Expansion: Cyber threats now include ransomware, data leaks, corporate espionage, and more, with motives ranging from financial gain to political and competitive advantages.
• Collaboration is Essential: Cyber security must be a cross-functional effort involving IT, engineering, operations, and business teams to effectively manage risks.
• Maturity Assessment is Key: Companies need to evaluate their current cyber security maturity to identify gaps and prioritize improvements.
• Unified Program for Cyber Security: A secure, vigilant, and resilient approach is necessary to protect both operational and corporate systems, and to ensure the continuity of mining activities.

Key Information

Cyber Risks in the Mining Value Chain

• Extracting the Ore:

  • Unauthorized access to automated equipment can lead to financial loss, equipment damage, and safety risks.
  • Breach of GPS deployment systems can cause inappropriate ore mixing, safety issues, and environmental concerns.
  • Breach of mine monitoring systems can result in system shutdowns, compromised equipment, and data theft.

• Processing:

  • Interruption or tampering with operational controls can lead to safety issues, downtime, and reduced yields.

• Marketing:

  • Theft of pricing data and customer information can damage competitive positioning, reduce market share, and lower company valuations.

Cyber Risk Management Challenges

• ICS Design Limitations: ICS were not built to be connected, leading to security gaps as they are now integrated into broader digital ecosystems.
• Supply Chain Vulnerabilities: Third-party equipment and components can introduce malware, leading to system failures.
• Human Factors: Lack of awareness and training among employees can expose systems to cyber threats.
• Decentralized Operations: Mines often operate with varying levels of IT integration and security, making centralized oversight difficult.
• Need for Multi-Disciplinary Teams: A unified approach requires collaboration between IT, engineering, operations, and business teams.

Maturity Assessment

• The Deloitte Cyber Security Maturity Model is suggested as a tool for evaluating the current state of cyber security in mining operations.
• The mining industry currently scores around 2.5 on this scale, but a score above 4 is recommended to ensure a secure and resilient environment.

Pillars of Cyber Security Transformation

• Secure: Implement automated controls and monitoring, secure ICS components, and define data access rights.
• Vigilant: Continuously monitor for threats and ensure the organization is prepared to detect and respond to cyber attacks.
• Resilient: Develop incident response plans, conduct regular simulations, and ensure the ability to recover from cyber incidents quickly.

Governance and Talent Management

• Clear ownership and defined roles are essential for effective cyber security management.
• Cyber security in ICS requires a unique talent profile, with professionals often stationed at remote sites for extended periods.
• Career development paths and cross-functional awareness programs are needed to retain and motivate talent in ICS security.

Strategic Importance

• Cyber security is not just about risk mitigation; it is also a strategic enabler for innovation, operational excellence, and maintaining social license to operate.
• Executives must recognize the connection between risk management and value creation, and move beyond traditional risk registers to consider the potential impact of cyber incidents on returns.

Conclusion

The mining industry must adopt a comprehensive and integrated approach to cyber security to protect both operational and corporate systems. This includes improving maturity levels, fostering collaboration between IT and engineering teams, and implementing a unified program that ensures security, vigilance, and resilience. Failure to do so risks significant financial, safety, and reputational consequences.

Key Controls

• Awareness Training: Educate employees on cyber threats and safe practices.
• Access Control: Implement formal authentication and authorization for ICS components.
• Network Security: Secure both wired and wireless networks using best practices in identity and access management.
• Portable Media: Restrict and scan portable media for malware.
• Incident Response: Develop and test policies for managing cyber incidents.

Contacts

• Authors:
  • Sandeep Verma – Global Risk Advisory Leader, Mining & Metals, Deloitte US
  • Andrew Douglas – Managing Director, Risk Advisory, Deloitte US
• Global Contacts:
  • Phil Hopwood – Global Leader, Mining & Metals, Deloitte Touche Tohmatsu Limited
  • Paul Zonneveld – Global Risk Advisory Leader, Energy, Resources & Industrials, Deloitte Canada
  • Andrew Deas – Managing Director, Risk Advisory, Deloitte US
  • Adriaan Davidse – Director, Consulting, Deloitte Canada
  • Rajeev Chopra – Global Leader, Energy, Resources & Industrials, Deloitte Touche Tohmatsu Limited
• Country Contacts:
  • Africa: Andrew Lane
  • Americas: Glenn Ives
  • Argentina: Edith Alvarez
  • Australia: Ian Sanders
  • Brazil: Andre Joffily
  • Canada: Andrew Swart
  • Chile: Christian Duran
  • China: Kevin Xu
  • Colombia: Julio Berrocal
  • France: Damien Jacquart