PERTH (miningweekly.com) – Advisory firm Ernst & Young (E&Y) has warned mining and metals companies that cyber-hacking could become one of the top ten strategic risks in the near future.

E&Y global mining and metals leader Mike Elliott said on Thursday that the increased importance of the sector in global supply chains made it a target, adding that the increased reliance of companies on technology also made the sector more exposed.

“Cyber hacking targets are no longer just the big names, many more companies across the sector are now vulnerable,” said Elliott.

“Mining companies are becoming far more reliant on integrated IT [information technology] systems in their drive to improve productivity and bring down costs, and this makes them more exposed and vulnerable to cyber attacks.”

Elliott noted that, simultaneously, the relative importance that these commodities played in global, regional and local supply chains meant the companies had become priority targets and this was exacerbated by the extreme price volatility E&Y expected to continue for the next two to three years.

A recent report by E&Y revealed that some 41% of mining and metals sector respondents reported an increase in external cyber threats in the past 12 months.

The advisory firm identified three types of groups likely to target mining and metals companies: Criminals, national governments and hacktivists.

“This means many companies who previously thought they would not be targets are now vulnerable,” he warned.

Elliott said that the danger for mining and metals companies was that cyber-hacking and information security have often been narrowly viewed as an IT issue in the past.

“The risk is heightened by the centralised nature of many business functions across supply chains now, and the dependence of operations on sophisticated IT systems. A top-down approach from the board and executive is needed to ensure the issues and threats are understood and addressed,” he said.

Only 18% of mining and metals respondents to the report believed their information security fully met their organisation’s needs.

A further 44% of the respondents indicated that their organisation did not have a threat intelligence programme in place, and 38% had only an informal one in place. E&Y said that this left companies unprepared to identify a cyber-attack-on-information security threat.

“The increasing prevalence of cyber-hacking means companies need to identify and assess the likely threat to their organisation and mitigate accordingly,” said Elliott.