As we're starting to see increased attacks affecting mining companies, you're starting to get
boardrooms and senior leadership team going to their you know those cybersecurit leads or CSOs
and going hey are we good? Welcome everyone to the Industrial Security Podcast.
My name is Nate Nelson. I'm here as usual with Andrew Ginter, the
vice president of Industrial Security at Waterfall Security Solutions, who will introduce the subject
and guest of our show today. Andrew, how's it gone? I'm very
well, Thank you, Nate. Our guest today is Rob Lebay. He
is the chair of the Mining and Metals ISAAC, which is information sharing at
Analysis Center, and he's going to be looking at industrial cybersecurity from you know,
almost from an IT perspective. He's going to be taking us through SIXT
to integrating it and ot you know networks, people processes everything. All Right,
Then, without further ado, let's get into your interview. Hello Rob,
and thank you for joining us on the podcast. Before we get started,
can I ask you to say a few words about yourself for our listeners,
and you know a few words about the good work that you're doing at
the Metals and Mining IAC. Sure, absolutely. I'm Raphael Bay. I've
been working in cybersecurity for just over twenty years, the last ten or so
of them focused on securing in the mining industry, in particular operational technology.
Through that process, we started the Mining Metals ISSAC to have a place where
mining companies can work together and collaborate not just some intelligence, but also best
practices and processes to secure or the operational technology in our plants and the autonomous
systems in our minds. Thanks for that. Our topic is cybersecurity in in
mining. We're talking about, you know, six steps to to integrate it
and OT in the mining space. Before we dive into those details, though,
you know, it's been a long time since we've had anyone on the
show from the mining industry, and you're with the Metals and Mining Isaac.
You know, I'm not sure we've ever had anyone on from metals. I'm
not even sure what that is. So before we dive into security, can
you can you give us sort of a big picture of the physical process.
What is metals? What is mining? Um? You know, how are
these systems automated? What are the kinds of cybersecurity concerns that you see in
this industry. Metals and mining are two separate but very highly integrated and interdependent
industries. So if we think about what this world needs as our economies change,
as we work forward, move forward with de carbonization, with you know,
clean energy, the reality is everything we have on this planet as a
building block is either grown like our food or trees or lumber or its mind.
So all the material we need to support this transition, whether it be
you know, copper for electric cars or electric infrastructure, and you know cadmium
and lithium for batteries, as steel for wind turbines, all of those commodities
have to be mine. It's the only place we know how to get them
today. And so when we think about you know, the metals industry,
that's the next step in that process. As that or gets dug up and
mine from the earth, then it's the process of refining that and turning it
into usable metal UM that can be used to build UM you know, your
tesla or your your wind turbine, UM or your power grid. So those
those industries, as global industries are critical to to where we need to get
to UM as a society, as a planet. And so if you think
about what a mine might look like um. You know, at its core,
it's a simple process, right, it's you know, taking big rocks,
turning them into little rocks, and extracting the metals from those. But
the process to do that is huge from a scale perspective. UM, when
you look at open pit mining, which is commonly used in things like um,
you know, copper and gold and zinc and other basement commodities. These
are minds you can see from space. They are you know, several kilometers
you know wide, some of them are several kilometers deep, and in those
environments you've got you know, fleets of huge trucks. You know, these
are trucks with seven hundred gun capacities of rocks. And while traditionally those are
maintained and operated by drivers, we're at the point now we're very quickly those
are being passed over to autonomous systems, and so those vehicles are becoming autonomous,
you know, combined with the processes required to drill into the earth blast
the rock away, though again traditionally done by people, but because we have
a knee to de risk and make that safer and more efficient, those tasks
are being turned over very rapidly. To autonomous automated systems. And then at
the mind, you know, other minds are underground, and these are minds
that have shafts running in a lot of cases dozens of kilometers deep into the
earth. And then we've got you know, automated systems again for drilling,
blasting, and hauling rock. But then we also have systems that are providing
ventilation and fume control for the people that are working there. You know a
lot of battery electric vehicles underground, and so we have charging infrastructure and electric
infrastructure, and so you know the scale and the complexity of these well,
they vary widely from mind to mind. In all cases, there's a significant
safety safety risk component. There's a significant environmental component to ensure that we protect
the environment while we do this and have left us in a position to reclaim
that area of earth once we're done and return that to nature when the work
is finished. So huge challenges from a safety from obviously from a production from
an environmental sustainability perspective that goes into into mining. And then you know on
the plant side, we have all the control systems you had seen any other
manufacturing electric environment, so you know, data systems process control systems, you
know, PLCs, motor control units, all of these systems are there.
And then you remember these mines are typically not located in urban centers, you
know, you don't put a mine in the middle of a major city.
Are located in remote areas difficult to get two areas, which requires a lot
of remote control and remote access to enable remote support in those places. So
you take that complexity and you layer on an industry that's rapidly changing. UM
it's an industry that's that's discovered the power of machine learning and artificial intelligence to
optimize and make their their minds and their operation from safer, more sustainable,
and to allow the mining of the posits that might not have been economically feasible
using older methods. And so we've got these control systems and operational technology systems,
you know, based on old technology in a lot of cases that was
you know, designed several years ago or decades ago, and we're layering on
top of that modern remote control, modern cloud based AI and machine learning on
top of systems that whenever architectured were designed for that. You know, we're
taking um autonomy and looking for ways to automated equipment that maybe wasn't originally architected
for that, and so a lot of the challenges how do we do that
in a safe way? You know, how do we protect an environment that's
rapidly commoditizing and you know, specialist dual consentric ring mode bus and you know,
specialists dedicated systems have been replaced by PC infrastructure, Windows networks and um,
you know commodity, Cisco switches on top of that, you know,
legacy OT environment. So there's a lot of challenges in the space to I'm
sure we can keep production, but more importantly, to make sure that the
teams at that site go home to the families every day, to be sure
that the environment's protected so that those areas are there for us to us in
nature, to use and live in and enjoy for the next hundred years.
So, you know, it's a challenging space, makes an exciting space as
we go forward. All Right, So Rob covered a lot there, but
there's been something that he said early on that's been sitting with me, which
is he was talking about automation and how automation is increasingly taking over for jobs
in mining that we're historically done by people. Now Andrew, you and I
talk a lot about safety on this show. How does the industrial security calculus
change though, if in one of the most safety critical safety risk industries in
industrial security, namely mining, you start to find fewer people at these actual
sites, maybe then safety becomes a lower wrong of the totem pole because all
the jobs being done by machines. That's a very good observation. And you
know, the short answer is yes, you know, to me, it's
a very good thing that jobs that were you know, historically putting human lives
at risk if there was any kind of malfunction are being automated to the point
where robots are taking the risk, not people anymore. But you know,
all of this increased automation is sort of being coupled with remote operation, and
remote means you know, you're communicating through the Internet, you've got software that's
protecting you, not hardware. It's you know, you're increasing the risk,
the cyber risk. Rather, you're increasing the opportunities for attack by operating everything
remotely and by automating everything. But you're taking the safety consequence off the table,
and in a sense this makes the the the cybersecurity calculus easier. Um,
you still have very consequential potential outcomes, but they tend to be dollar
outcomes, you know, large dollar outcomes, rather than human life outcomes.
And so that does it does simplify your your your cybersecurity equations. Um,
it's still a very big deal though. We're talking multi billion dollar investments in
one of these big minds, so you're still talking about potentially you know,
very serious consequences dollar wise and in a sense reliability wise, m if if
you if you compromise these systems. But in a sense, it's easier to
design security mechanisms for very large dollar losses than it is to design them for
you know, large you know, human casualty losses. If you have a
whole crew that's you know, underground and is at risk because you've met you
know, somebody is messed with the ventilation, that's very very bad. Whereas
you know, you know, a couple of these seven hundred times trucks colliding
and you know, suffering massive damages with no human operators inside of them is
very bad. It's not very very bad. So it does help. Now
when you talk about it being easier to design security around money problems rather than
human life problems, are you talking about just the sheer severity of the consequences,
like the risks involved, Like it's so much more important to protect human
lives, and so it's easier to just be talking about machines. Or is
it that the nature of protecting against financial losses against machines is characteristically different,
like the kinds of security you might otherwise be investing in talking about putting in
place is easier to implement. It's it's a little both. But you know,
let me give you some concrete examples on the safety side. If my
life depended on an air fol system working, I would need to be confident
that the computers controlling it are really secure. I would prefer that they were
air gapped, that you could not reach them from remotely. I would prefer
that there were mechanical fail safes, that there would be two and three sets
of pumps to get the air down there and get the toxic fumes if any
out. You know, there's extra redundancy, there's extra isolation requirements, there's
you know, I would want detectors that are mechanical, not computer controlled.
In addition to the computer controlled. There's just when you've got safety that you
have entire layers or you know, two extra layers sometimes of protection in place.
And so if you can eliminate a couple of those most expensive layers,
it does simplify everything. And you know, if if everything's being operated remotely,
I really don't want my safety system being operated remotely. Um. So
again, you can operate equipment protection systems remotely sort of more confidently than operating
human safety systems remotely because nobody's there at the plant. So yeah, it's
it's it's a lillaboth. Wow, there's you know, there's a lot going
on there. Um, it's a complicated space and you know we're going to
be speaking to uh, you know, six steps to integrating it and OT
uh you know, security wise and otherwise in the medals and mining industry,
you know ITOT integration is a phrase that was coined in like I think two
thousand and five or so by an analyst at the Gardner Group. Um,
you know, it can mean integrating networks, you know, connecting up networks.
It can mean integrating technology stacks. It can mean integrating teams and business
processes. And like I said, this this kind of all started almost twenty
years ago. So what does ITOT integration mean to you and to the industry,
and you know, sort of what's the state of that process twenty years
after it was kind of invented. Yeah, I think when I look at
mining, and I think the same is true in a lot of the resource
based operational technology spaces. When I look at mining even ten years ago,
or even when looking five years ago, at most miners, you had your
corporate network, corporate systems, and they've looked very much like any other business.
And then you had at each mine an individual operational technology system, unique
technology, unique design, unique architecture that is really driven by that site,
that plant, that general manager owning that I'm really in a lot of ways,
each mind, each operation being its own thief too. And what we've
seen over the last ten years rapidly accelerating I would say for the last five
years, is as technology changes and we have the ability to commoditize a lot
of those systems that can drive down costs, which is wonderful, but it
also opens up the door now to you know, using things like AI,
machine learning to UM help optimize. So I mean that makes sense, you
know, business wise, every every you know, industrial automation operation wants to
improve their efficiencies. They want to use, you know, cheaper stuff.
They want to use the standard stuff to reduce training costs. But you know,
the more it in my books, you know, the more that OT
systems look like IT systems, the more you can attack the OT systems the
same way you attack the IT systems. And you know there's thousands of ransomware
incidents on IT systems every year. We really can't afford that on the OT
side. I mean, what do you do about I don't know, risk?
Sort of, Yes, you're migrating technology, are you not also migrating
risk? You are, and you're introducing new risks to the operations that maybe,
you know, somebody who's been mining for twenty years hasn't had to think
of before at the site level. You know, we're seeing now if you
open up the news, you know almost quarterly, if not more often,
a mining company needing to shut down operations because of a ransomware incident or the
ransomware incident shutting it down for them. You know, there was one in
Canada in January, for example. You know, another one in Germany in
March, and so those are becoming exceedingly common. The other challenge risk wise
is with the geopolitical situation globally, which you know, I've got no idea
where it's going, but it's certainly not going to get less complicated. Mining
and the metals industries sit at the beginning of every single global supply chain.
So if we have adversaries that want to disrupt those supply chains, targeting mining
in the metals industry is a great opportunity to interfere with international, national,
international supply chains at a macro level very efficiently, because yeah, that's the
commonplace they'll start. And so the risk is going up and the accessibility of
the systems is going up, and so because of that, we're starting to
see last face three years, the corporate IT teams being asked to step into
operational technology to you know, sort to manage that risk, to secure those
systems, to secure those plans, and quite frankly will last few years.
Those teams are struggling, and so one of the focuses for me and for
the I FACT is to come up with a plan or a cycle or a
model that those teams can apply and use in order to secure operational technology from
the I T side and secure that shared technology and our you know, our
topic is six steps to integrating itnot This was a an article you wrote recently
sort of summarizing your your experience in the field. These six steps that you're
talking about, what what are they? So really it starts with key So
the steps, the first stages really are learning and building relationships with the people
of sight and establishing trust. The next the next two are really a bit
understanding the technology. It's understanding the assets and understanding the risks and quantifying those
risks. And then the last you know, then we get into deploying tools
and TTPs and practices to that environment, followed by testing invalidation of what you've
done to be short, actually working, and so you know those are those
are those six steps going through? Okay, and it all starts with relationships.
Can you can you take a little deeper? What what is building relationships
mean? So when I started pushing or deploying, you know, into operational
technology, you know a lot of teams make the mistake of thinking that the
technology is the same Windows as Windows, active directors, active directory at Cisco,
switches at Cisco switch. But really in the environment of mining, where
safety is such an issue, reliance and such an issue. The environment that
you run in is very different. It's not a it's a it's an environment
where availability and safetyre king, not data integrity. For example. You need
to take the time to learn the process, to learn the business, to
build relationships with people, to understand what's going on. Really, that phase
is really about learning that operation, how it works, and earning your right
to be at the table upsite. Building the relationships you know from the top
down. So if you're sitting in a senior Mind managers meeting the GM,
you at least understand all the words that are being spoken at that meeting that
it's no longer a foreign language to you. That you know all the people
that are there, You understand what their priorities are, what keeps them up
at night. So that's that first step, and really I consider that earning
your right to be at the table. So once you've earned that right to
be at that table, it then becomes an exercise of establishing trust in your
abilities and your team's abilities not just to secure stuff, but to deliver on
and protect what's important to that site. And it's in these conversations that a
lot of security people make mistakes because they'll go in and say, well,
here's the right way to do something. The right way to patch is to
patch monthly, you know, right after patch shoose day. We have to
get rid of these legacy you know Windows ninety eight or Windows XP systems that
are kicking around. We just we have to do that. But the reality
is in operational technology, the right thing to do is not often correct.
It's not always correct, and so by building trust and understanding how you can
adjust security posture to what you learned in the previous step, you start to
be seen as somebody who has the priorities of that operation as your priorities,
not trying to just push security best practices from the IT side. In the
beginning of the industrial security revolution, engineers were told to use IT security principles,
protect the information. We were told. We knew this was a poor
fit, but it was all we had. Today. The top security priority
at industrial sites is safety. Don't kill anyone, don't cause an environmental disaster.
And the second priority is reliability. Do not shut down our factory or
infrastructure. Today, safe and reliable operations use unhackable protections from cyber risks,
not just cybersecurity. For a deeper look at the evolution of the revolution.
We invite you to download Waterfall's report on the Emerging Consensus for Industrial Security Engineering.
You can access the report at the Waterfall website Waterfall dash Security dot com,
slash Engineering dash Consensus, or just go to the resources menu and click
on white papers and ebooks. So, Nate, let me, you know,
let me chime in here and just sort of remind you and our listeners
of something I mentioned in the introduction. You heard Rob give his sort of,
you know, description of his background. He came from the IT space
into cybersecurity and mining, which is sort of a bit of an unusual perspective
on the space. I'm thinking the last one hundred episodes of the show here,
most of our guests have been from the engineering side talking about cybersecurity.
You know, in the first fifteen years of the industrial security discipline, it
was mostly engineers who were responsible and stayed responsible for the you know, the
industrial automation for the physical process. And you know, we're sort of pulled
into the cybersecurity because they had to. It was a new risk. They
had to deal with it. This is what engineers do. They took advice
from the IT people, what we're seeing in the last about five years is
that increasingly enterprise security teams are being told you're now responsible for industrial cybersecurity,
go fix that problem. This is something that you did not really see,
you know, in the first ten fifteen years of the discipline. We are
seeing it very recently. And so you know, Rob's perspective here really is
he's giving advice to IT teams, to enterprise security teams who are sort of
going through the same life cycle heated, which is here, you're responsible.
Now, you figure out how to work with the engineers. You figure out
how to make this happen, because you're the ones that you know are going
to be held accountable if if there's an incident at the MIND And so you
know Rob's perspective here's a little unusual because he's giving advice to IT people sort
of as an IT person who's made the transition, not as an engineer saying
here's what I wish you would do. You know, here's Rob's is telling
us what actually worked for him. That's the first two steps. Build relationships,
established trust. They both those those both sound like sort of people focused
tasks and goals. You know, you've got four more steps are we you
know, do you dive into the technology next? What comes next? So
you know, once you've taken the time to build relationships and trust, the
next piece is to really understand the technology landscape and the assets of that site.
And it's a bit different the IT world where IT land. We often
have a CMDB that lists all of our systems, or we can run a
scanner to discover all the systems on the network. Can get us started on
that process. Those don't work in the operation. We can't use scanners to
find things. Oftentimes assets are listed in maintenance systems or on spreadsheets or SharePoint
lists, very non traditional places. So you've got a process to go through
to not only find and identify all the assets, but also have a great
sense of what they do. What part of the plant do they drive?
Are they safety sensitive? What happens as we go down is something we're to
fail? What's the worst thing that could happen? Does the protest stoppers?
Somebody get hurt? And that process will take a while as you dig through
not only the maintenance systems, but a lot of things you're not going to
find. You may have to walk the site and identify and find assets yourself.
You might have to use passive network monitoring pulling data off switches and logs
off switches to find assets. And you know, you might have to do
a search on showdown and find those assets that might not even be connected to
your network but might have se SIM cards in them and actually be connected to
the public cell network in those environments. And so you can't underestimate the challenge
of identify those assets. And then the final piece of the context is actually
quantifying the risk. So that's where we take the assets to be found.
The process, we've learned the actual threat information in mining that would come from
the mining a metal's IAC or other sources, and actually begin to use a
model to quantify that risk and communicate it. I once spent two months shadowing
a MIND general manager, and everybody going into his office told him how the
sky was falling, the world was going to come to an end. They
become very quickly immune to the chicken little sky is falling. Five. So
you have to take the risks, quantify them into dollars with some model,
whether you use fare or some other quantification model, and and actually quantify the
risks so you can prioritize where you've got to focus and where you've got to
work based on actual risk numbers. Okay, so understand the assets, quantify
the risks so that your your business decision makers can make you informed decisions.
What's next in this process? So the next thing you're going to do is
for the risks and the controls you identify, you identified as things you're going
to help mitigate with cybersecurity controls. Anyways, then you're going to start to
look at extending your security measures from it in COOT space, So you're going
to do things again starting from looking at your existing run books and playbooks for
things like into response. How do you have to update and modify them to
work well at site? See in the operational technology space, what about the
security technology that you have, your endpoint solutions, your network solutions. Can
they be safely extended into operational technology or do you have to procure something different?
You know, I'm a big fan of finding an endpoint edr or I
guess the buzzword these days is XDR solution that can work across it and OT.
You may be able to do that, you maybe not. You're going
to look at things like extending logging coverage and log aggregation there. So then
you're going to start to look at extending your base controls so that you can
start to mitigate that risk and you start training the team. And that brings
us to the last step of the cycle, which is testing invalidation. Once
you've worked through that process and you've done the testing, you've done the validation,
and that might look like some automated control testing, but it should also
involve an incident tabletop at that site to be sure that your plans are working,
that it integrates with the site emergency procedures and processes, that all those
things are working. You know, before you can kind of hang the mission
accomplished banner and you know have the team barbecue, make sure you take that
time to test and validate that what you're doing is actually working and that well,
that's the last step in my article identifies it's a cycle. And it's
a cycle because as the site introduces new technology, same machine learning or AI,
as the people change, a new general manager gets appointed, a new
plant manager comes in, you have to start back with the building relationships,
building trust. All of that cycle starts again. So it's not a one
and done. Um, you don't get to finish and go, oh,
that was really hard and I got that done. I don't have to worry
about this again. Um, as soon as you get there, you're you're
starting it again with the new people, the new technology at sight you started
personally in the IT space. This this whole discussion has been it you know,
is or at least you know, enterprise security is coming in and saying,
you know, guys, we have to do something and you know,
here's advice to to to the security team to uh, you know, make
that process more effective. Um. Is this sort of unique to your experience
or is this sort of a more common experience in the mining industry who's leading
uh, you know, the the the charge in terms of driving security into
OT. Is this something that tends to be happening from the the IT side
in mining more so than not. It's interesting in mining, um, you
know, because if you look at a mining company, this is an organization
that will derive ninety plus percent of their revenue and carry most of and all
of their safety environmental risk at sight. Yet traditionally, up until I would
say, you know, five years ago, at most mining companies, the
cybersecurity information security function only impacted it. The whole OT stuff was at a
scope and it's you know, it's almost comical to think that, you know,
you're in charge of securing an organization get you're out of scoping ninety percent
of the revenue generation and one hundred percent of the safety environmental risk. You
know, when you think about it, it seems a little bit nonsensical,
because it is. And so now as we're starting to see increased attacks affecting
mining companies, you're starting to get boardrooms and senior leadership teams going to their
you know, those type of secure leads or CSOs and going hey, are
we good, and they're The answer they've been getting back is a very unsatisfactory
version of I don't know, which is typically followed by some kind of a
direction to go figure it out. And where this process comes from is now
we have these IT security teams being chartered, instructed however you want to call
it, to go take care of this OT thing so we don't become like,
you know, pick your company in the news. And they've been getting
a lot of pushback and a lot of struggle um overall. And so really
what this process is designed to do is to overcome that that pushback and struggle
that they're they're they're hitting at sight with the engineering teams, with the mind
management teams who may be at the beginning don't see, didn't see cybersecurity as
critical to their world. Um, you know, I've got bigger issues.
Life would be great if you know, the biggest issue I got down to
was, you know, cybersecurity. I've got you know, union contracts and
communities, and I've got you know, supply chain issues on fuel and parts
and all kinds of issues in my world that are potentially going to get in
the way of my success. You know, they didn't see cyber They don't
see at that site level always cybersecurity being one of those things that can get
in their way of their success until it is. And so the drive is
coming from the boardrooms in a lot of cases, and the senior management teams
to the CSOs and to the security teams to you know, go figure this
thing out. Is the drive I'm seeing in mining. You know that sounds
relatively opposite to how we usually conceive of things, At least on this show.
We've spent plenty of conversation talking about how to convince boards of the necessity
of cybersecurity, how to shake loose budget. But here he's saying that the
initiative comes down from the board to the cybersecurity people. Yes, and that
that is unusual. But you know, I have to wonder, is this
another example of scale because when we're dealing with, you know, the oil
and gas majors, they've been leaders in cybersecurity from the beginning. It was
you know, it was always understood that they had to do cybersecurity. Right.
When we're talking smaller operators that are much more cash constrained, you have
to worry about shaking shaking budget loose. You know. To me, what
I see in the industry is more awareness, awareness across the board in the
board sorry, you know board level, you know, feet on the street
level, every and everything in between. Um, it sounds like you know
what I've observed in the rail industry. I know, rail will sort of
head down for a century safety safety, safety, safety, And it's like
they looked up recently and said, oh, shoot, cyber we have to
do that too. You know, without without cybersecurity, we don't have safety.
And they've embraced cybersecurity. There's standards coming out this progress. It sounds
almost like that might be what's happening in mining, but I don't have enough
data points to be to be confident to that. Well. I do have
one data point in addition to you know, the information Rob's giving us.
I was talking recently to a the CSO of a large mining operation, and
he said, Andrew, you know, the investment in minds is in a
sense cyclic. You have a big, massive upfront capital investment, and then
once you've built the mind at a cost of you know, two billion dollars,
it starts producing and then there's a cash crunch and you need to p
douce extremely efficiently to be competitive in the marketplace. And so you know,
the place to put, you know, the opportunity, the easy opportunity to
get cybersecurity or anything into your mind is during the capital phase of the project,
not the you know, stretch every dollar operations phase. But um,
you know, a if there's a new awareness of risk at the board level,
that's a that's a factor. And be what he said was, look,
Andrew, I've been in the industry a long time. He said,
Um, the you know, after you've operated a mind for ten, twelve,
fifteen years, Um, there comes a point where you say, you
know, we have to modernize because we can become more efficient as a result,
because we can exploit another part of the of the resource. Uh,
you know, if we modernize, and so there's you know, after after
a period of running there, you know, ten twelve years, there tends
to be another massive capital injection. I gained. It's an opportunity to get
your new automation, new security, new every thing what he said was and
what he's observed in the industry is that from time to time there's sort of
episodes where almost every mine on the planet looks around and says, there's new
stuff out there, we have to do it. And there's over a period
of three and four years, there's an episode where most of the mining operations
on the planet upgrade, and he says, in his estimation, one of
these is coming up. There's AI, there's cloud based systems, there's new
kinds of automation, there's new kinds of efficiencies that everybody needs to leverage in
their mining operation. And so it looks like, you know, the these
uh, you know, these these stars might be aligning. The boards have
become aware of cybersecurity and they want to fix it. And you know,
if if the gentleman I was talking to is right, there's an opportunity where
almost everybody is going to be investing a large number of hundreds of millions of
dollars or more into their mining operations to take advantage of modern automation. And
you know, we can we can do the automation and this cybersecurity at once.
If if this is what's coming out, so that's in a sense good
news we can look forward to. This has been great, Rob. Thank
you for joining us. Before we let you go, can you sum up
for us? What should we take away? What's the you know, the
number one thing to remember about this this advice you're giving us. For me,
especially as a security professional, the opportunity to reach into the operation technology
you know when I started working like ten years ago, is a golden opportunity
you shouldn't pass up. It's a chance to really work on securing what matters,
to really work on helping protect people's safety, helping protect the environment,
helping protect sustainability. It's a great opportunity when you get you know, asked
to go do that. But unlike a lot of other areas, you can
only move as fast as you build trust operational technology. Security is the most
human of all security disciplines because you're affecting people's safety, you're affecting people's sense
of well being. Unlike almost any other discipline of security, you have to
go slow. Take the time to build the trust. Those first two steps
could take a year, sometimes more. Take the time that those need to
get right, and you'll get it done safely. You'll get it done efficiently,
and you'll end up with something that gives you a secure, sustainable,
reliable operation going forward. If this is something you've sort of been charged with,
I do encourage you to pop onto the minumental Iacs website or LinkedIn you
can. You can find the article that we reference here today. And you
know, I spend an hour in a webcast digging into this a bit deeper.
So you're you're more than welcome to download and to watch that webcasts as
well. So, Andrew, that was your conversation with Rob Leabay, Do
you have any final insights to take us out with today. I've been learning
a lot about the mining industry. I'm very grateful that Rob was able to
join us. You know, he's the CEO of the Mining and Metals ISAAC.
UM. You know, the the ISAAC is comparatively new. They're you
know, they're looking for new members. UM. I think there's like two
years old. UM. Some other information about the ISAAC. If if you
want to get involved in the metals and mining industry, UM, you know,
Waterfall is getting involved. This is how I know rob Um. Rob
didn't mention it, but he is also hosting a podcast for the ISAAC.
The first episode is up on the ISAAC. It's h mmisac dot org and
the first episode is up there. So I'm going to be listening to to
his podcast as well. M There's other opportunities to get involved in cybersecurity at
the ISAAC. The one that I'm thinking of that I'm looking to become involved
with. They have a committee that is working out how to interact with cloud
based AI programs. The concrete example was, look, every shovel of ore
that comes out of a mine, you know, is a sort of a
quantum of seven or eight hundred tons of ore. Every shovel is different,
and so they take the shovel of ore, they dump it on the truck
they're driving it to the primary processing facility and they're analyzing this stuff, you
know, in the course of filling the shovel and dumping it on the truck
and driving it away, and they're sending all the analysis into the cloud,
and the cloud based AI figures out how to process that shovel of ore optimally
and sends the optimal processing instructions back into the mind. So, in a
real sense, you've got cloud based AI controlling part of the mining process,
part of the primary processing system, and you know, how do you do
that safely? This is how thing I'm keenly interested in, and you know,
I hope to be working with the committee. So if you're interested in
the medals of mining ISAC. Again, it's comparatively new, it's a couple
of years old, and there's opportunities to get involved, to learn more about
it on Rob's podcast, and to contribute to the process MMISAC dot org.
All right, Well, with that, thanks to Rob Lebey for speaking with
you, Andrew, and Andrew, as always, thanks for speaking with me.
It's always a pleasure. Thank you, Nate. This has been the
Industrial Security podcast from Waterfall. Thanks to everybody out there listening.