🎓 Lesson 6
D4
Designing Zero-Trust ROC Networks
A Zero-Trust ROC Network is a secure digital system for mine remote operations centers that never automatically trusts any device or user—instead, it verifies everything every time before granting access.
🎯 Learning Objectives
- ✓ Design a zero-trust network segmentation strategy for a multi-site mine ROC using NIST SP 800-207 guidelines
- ✓ Analyze authentication and authorization logs to detect anomalous access patterns in ROC control systems
- ✓ Apply micro-segmentation policies to isolate blast initiation subsystems from corporate IT networks
- ✓ Explain the cryptographic requirements for secure device attestation in ROC edge gateways
📖 Why This Matters
In 2023, 68% of mining cyber incidents originated from compromised remote access to ROCs—often due to over-permissive network trust models. A single misconfigured VPN or shared credential can expose blast initiation systems, real-time ore grade sensors, or autonomous haul truck dispatch logic. Zero-Trust isn’t just ‘more firewalls’—it’s the foundational architecture that ensures a contractor accessing a drill pattern file cannot pivot to disable a detonation sequencer. For ROC engineers, mastering Zero-Trust means safeguarding not just data—but lives, production continuity, and regulatory compliance.
📘 Core Principles
Zero-Trust operates on three foundational pillars: (1) 'Never Trust, Always Verify'—every access request undergoes identity, device health, context (time, location, behavior), and policy evaluation; (2) 'Least Privilege Access'—users and devices receive only the minimum permissions required for their role and duration; and (3) 'Assume Breach'—networks are segmented so lateral movement is blocked even if one component is compromised. In ROCs, this translates to enforcing mutual TLS (mTLS) between PLCs and ROC servers, cryptographically binding OT devices via hardware-rooted attestation (e.g., TPM 2.0), and applying policy-as-code to enforce separation between blast management systems (BMS), fleet management systems (FMS), and enterprise ERP. Critically, Zero-Trust in mining requires bridging IEC 62443-3-3 (industrial security) and NIST SP 800-207 (ZTA) frameworks—because ROCs sit at the IT/OT convergence boundary where traditional enterprise security fails.
📐 Trust Score Calculation
The dynamic trust score quantifies real-time confidence in an entity (user/device) before granting access to ROC-critical assets. It integrates identity assurance, device posture, behavioral anomaly detection, and environmental context into a normalized 0–100 scale. Used in policy decision points (PDPs) to trigger step-up authentication or deny access outright.
Dynamic Trust Score (DTS)
DTS = Σ(w_i × m_i)Weighted composite score representing real-time trustworthiness of an entity seeking ROC access.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| w_i | Weight factor for dimension i | dimensionless | Relative importance of identity, device posture, behavior, or environment (sums to 1.0) |
| m_i | Measured metric for dimension i | 0–100 scale | Normalized score reflecting current state (e.g., 100 = fully compliant MFA; 0 = no authentication) |
Typical Ranges:
ROC blast initiation access: 75 – 100
ROC video surveillance feed access: 55 – 85
💡 Worked Example
Problem: A field engineer attempts remote access to the ROC blast sequencing interface at 2:15 AM from an unregistered mobile device. Identity assurance = 90 (MFA verified), device posture = 45 (no endpoint protection installed), behavioral deviation = 30 (off-hours, new geolocation), environmental risk = 20 (public Wi-Fi detected). Weighting factors: identity (0.3), posture (0.4), behavior (0.2), environment (0.1).
1.
Step 1: Multiply each metric by its weight: identity = 90 × 0.3 = 27.0; posture = 45 × 0.4 = 18.0; behavior = 30 × 0.2 = 6.0; environment = 20 × 0.1 = 2.0
2.
Step 2: Sum weighted components: 27.0 + 18.0 + 6.0 + 2.0 = 53.0
3.
Step 3: Compare against ROC policy thresholds: DTS ≥ 75 → full access; 55–74 → step-up MFA + session recording; <55 → deny access with alert
Answer:
The result is 53.0, which falls below the 55 threshold—access is denied, and a Level 2 SOC alert is triggered per IEC 62443-2-4 incident response protocol.
🏗️ Real-World Application
At Newmont’s Boddington Gold Mine (Western Australia), a Zero-Trust ROC architecture was deployed in 2022 after a near-miss incident where unauthorized remote access altered conveyor speed setpoints. The solution segmented the ROC into four policy-enforced zones: (1) Blast Initiation Zone (air-gapped logic, mTLS + hardware-attested Raspberry Pi gateways), (2) Real-Time Monitoring Zone (encrypted MQTT with device certificates), (3) Engineering Workstation Zone (Just-in-Time privileged access via CyberArk), and (4) Corporate Integration Zone (API gateway with OAuth 2.0 and rate limiting). Each zone enforces granular policies—e.g., only authenticated, patched, and geofenced devices may submit blast timing files—and reduced mean time to detect (MTTD) threats from 42 hours to 8 minutes.