📋 Case Study

Canadian Gold Mine Cyber-Hardened SCADA Power Control

Legacy Modbus TCP SCADA exposed to ransomware via contractor VPN; no segmentation or authentication

🏗️ Project Overview

Kirkland Lake Deep Vein Expansion – Ontario

🎯 Challenge

Legacy Modbus TCP SCADA exposed to ransomware via contractor VPN; no segmentation or authentication

🔧 Design Approach

IEC 62443-3-3 compliant architecture: DMZ firewall, OPC UA over TLS, role-based access control, air-gapped engineering workstation, continuous anomaly detection using ML on packet metadata

📐 Key Calculations

Attack Surface Reduction %

(Old_ports − New_ports)/Old_ports × 100

Result: 87%

Quantifies exposure reduction

Mean Time to Detect (MTTD)

Σ(detection_times)/n

Result: 4.2 min

Meets Tier 3 IEC 62443 SL-C requirement

📊 Results

Zero successful intrusions in 24 months; 92% faster incident response; audit-ready compliance documentation

💡 Lessons Learned

• •OT security must be co-designed with electrical engineers—not bolted on
• •ML-based detection outperformed signature-based tools for zero-day anomalies

✅ Key Takeaways

• 1OT security must be co-designed with electrical engineers—not bolted on
• 2ML-based detection outperformed signature-based tools for zero-day anomalies