As originally published on Canadian Mining Magazine.
The mining and metals sector is facing an evolving cyber threat landscape during COVID-19 that shows no sign of slowing down during recovery.
The middle of a crisis is the last place you want to learn you have a cyber security problem. This unfortunate reality happens to be when a company and its employees are often most vulnerable. Online workforces and rapidly implemented digital tools are exposing mining and metals companies to greater cyber risks, and opportunistic attackers are using the current landscape to ramp up their efforts to exploit fear and confusion. Knowing what to look for and how to prepare for this new wave of threats is the first line of defence.
How are threats evolving?
Cyber security was a growing threat for miners long before the pandemic – it was listed among the top 10 business risks and opportunities facing mining and metals for the last two years. And the EY 2020 Global Information Security Survey shows that across the country, 66 per cent of Canadian security leaders have seen an increase in destructive cyber attacks over the last 12 months.
The outset of the pandemic saw an evolution of cyber threats that many didn’t see coming – threat actors began capitalizing on quarantine measures compromising companies’ incident response effectiveness and crisis management resources. Phishing and targeted spear-phishing campaigns quickly rose as attackers used the pandemic as click-bait to gain access to information through employees.
The Centers for Disease Control and Prevention (CDC) in the United States, for example, was a target for this kind of activity. Attacks seek to “spoof” – or closely mirror – the CDC’s email address and trick receivers into believing they’re clicking through to a trusted source. Similarly, emails containing links, such as cdc.org or cdcgov.org, are popping up and redirecting users to fake login pages for Microsoft, Facebook, and Google, where attackers can steal user credentials.
While countries progressive deploy business reopening plans, many employees will still continue to work remotely online. These individuals are likely to store corporate data to personal cloud accounts, sync corporate passwords to personal browsers or keychains, enable print from home devices, store sensitive information on open team rooms – and the list goes on. Such unsafe practices leave valuable information open and unsecure, increasing the potential attack surface.
How can you protect yourself and your business?
Mining and metals companies – and their employees – aren’t immune to the recent uptick in attacks. Companies need to ensure their data, communications, and interactions are safe and that virtual infrastructure is secure at the enterprise level and with third parties such as suppliers, customers, and contractors. Having the appropriate measures in place to secure the organization and properly detect and respond to threats can allow companies to decrease exposure to potential cyber attacks.
Companies should consider these tips to help protect the business:
- Centrally manage and administer robust tele-working solutions to empower and enable employees, customers, and third parties.
- Ensure all systems are patched and the latest updates are installed.
- Update security policies and educate employees on how to expunge information that has inadvertently been stored to personal accounts.
- Leverage role-based rather than location-based identity and access management solutions, analytics, and controls.
- Establish second-factor authentication for formerly in-person processes, such as manual phone calls, a system of shared secrets, or other authentication controls.
- Conduct mock phishing exercises and educate employees on the dangers of phishing.
- Provide links to official resources for pandemic-related information to avoid the spread of disinformation within your organization.
Readying for recovery
The pandemic’s impact on the workforce, operations, and supply chains has highlighted the need for mining and metals companies to continue their digital acceleration and investments in technologies, such as automation, artificial intelligence, and blockchain to ensure worker safety, profitability, productivity, and – ultimately – business continuity and resilience. In fact, nearly all responses in a recent EY mining industry webcast indicated that they’re increasing their focus on digital transformation in light of COVID-19.
With greater investments in digital and data optimization on the horizon, now is an opportune time for companies to embed security considerations into their business processes. Security needs to be embedded within business processes from the get-go to reduce risks, cut costs, and build a more secure working environment for all.
While the current landscape of the pandemic will eventually stabilize, companies can’t lose sight of the fact that cyber threats will follow them into the recovery phase of COVID-19. Thinking long-term and big picture can help organizations strengthen their defences during this current extraordinary situation. Demonstrating a commitment to building greater cyber resiliency can help to maintain stakeholder trust and business reputation in an era of heightened scrutiny.
