Mining technology security risks are ever present and the increasing prevalence of IIoT hacking event should focus our attention on ensuring our invisible systems don’t or can’t harm people.
With the increase in networked equipment at mine sites and increasing concerns over potential hacking of critical safety-related infrastructure, AMSJ spoke with Sujith Panikkar from HIMA an expert in the security of industrial automation and workplace safety.
AMSJ Given there’s a range of standards & variable practices associated with security of networked industrial devices, what would be the probability of a major industrial accident occurring over the next few years from a cybersecurity event?
Sujith: The industry has been seeing cybersecurity-related incidents occurring regularly, some with major consequences, others minor. Stuxnet (2010), Ukraine power grid attack (2015), Wannacry Ransomware attacks (2017) being some of the well-known incidents. Standards and good practices capture learning experiences from industry incidents.
The adoption of industry standards to an organization’s standard operating procedures brings into existence an environment that reduces the risk of incidents. However, this does not ensure that incidents are completely eliminated or prevented, as there are always human factors, new attack methods adopted by hackers and other evolving scenarios involved.
In cybersecurity especially, with the increasing focus of industry on digitization and the rapid pace of evolution and adoption of technology, there are new vulnerabilities coming into the picture with every passing day. In practice, this results in standards development lagging behind the advances in technology.
READ RELATED CONTENT
- New guidelines published for autonomous mining equipment
- Malware cant impact human lives and safety
- WA Regulator examining autonomous truck incident
- Managing regulatory capture in mine safety inspection
AMSJ If you were buying a piece of mining equipment that was networked, what would be your expectations in respect of mining technology security?
Sujit: At the minimum, we need to ensure that the equipment adheres to IEC 61511 where the engineering of systems ensures the safety of an industrial process through the use of instrumentation. And in the case of critical infrastructures such as petrochemical or chemical plants which may have dangerous or hazardous materials, the Seveso III Directive comes into play.
When buying networked equipment such as safety controllers, ensure they are certified safe by design and fulfilled current and even emerging requirements. Cybersecurity expertise is rare, especially for industrial and functional safety, and so ensure that while choosing equipment, choose outsourced experts wisely, and ensure that internal employees are adequately trained and build on internal cybersecurity and functional safety expertise.
AMSJ Obviously, there’s so much mining oil and gas technology now networked, do you believe that operators globally have really thought through the security issues for the event of a cyber attack? What can they do retrospectively?
Sujith: Many of the mining, oil and gas installations in existence today have equipment and technology (such as safety and control automation systems) that are some decades older and may not cater to the present day risk scenarios. For example, it is most likely that an installation which had computerised control systems installed 15 years back would not have considered the network security architecture and design approaches such as defence-in-depth which is well known today. The recommended approach for such installations is to start with a gap analysis and then implement holistic lifecycle management to ensure a secure environment for their networks and systems.
AMSJ How important are fail to safe redundancy systems in critical equipment? and do they have any vulnerabilities for mining technology security?
Sujith: Fail-safe design principles for safety systems have been in use for many decades in the industry. Most of the safety systems and products in the industry are designed to fail-safe in accordance with standards such as the IEC 61508. However, there is also the trade-off between safety and availability to consider.
For example, a safety system on detecting a dangerous condition in the process will take a pre-programmed safe action to move the process to the safe state. But this would also mean the process is most likely stopped and the production is affected, incurring business interruption losses which can be quite high in the oil & gas and mining industry.
When a successful cyber attack takes place on a safety system, the safety system is either disabled which means the plant is no longer protected and vulnerable to major safety incidents, or, the safety system acts spuriously due to the attack in which case there would be production stops and business interruption losses. Thus it is now almost essential to ensure a secure environment for safety systems to operate in through the lifecycle phases of the installation.
Add Comment