🎓 Lesson 21
D5
Tanami Cybersecurity Incident Response Drill
A cybersecurity incident response drill is a realistic, hands-on simulation that tests how well a mining operation can detect, contain, and recover from a cyberattack on its autonomous haulage systems.
🎯 Learning Objectives
- ✓ Analyze network traffic logs to identify anomalous CAN frame patterns indicative of vehicle control hijacking
- ✓ Design a layered containment strategy for an AHS fleet compromised via spoofed GNSS signals
- ✓ Explain the forensic implications of real-time telemetry corruption in Cat Command for Hauling (CCH) environments
- ✓ Apply NIST SP 800-61r2 phases to map roles and decision gates for a simulated ransomware event targeting dispatch servers
- ✓ Evaluate incident response timelines against ISO/IEC 27035-1:2016 benchmarks for critical infrastructure
📖 Why This Matters
In 2022, the Tanami Operations site experienced a near-miss incident where malicious firmware updates were pushed to five autonomous Komatsu HD785 haul trucks via a compromised OTA update server—causing erratic steering during night shift operations. Though no injuries occurred, the event exposed gaps between IT security policies and OT operational realities. This drill isn’t about theoretical hacking—it’s about ensuring your blast schedule, haul cycle times, and safety-critical shutdowns remain resilient when cyberattacks target the very systems that replace human drivers.
📘 Core Principles
Cybersecurity in autonomous haulage sits at the intersection of industrial control systems (ICS), embedded real-time operating systems (RTOS), and cloud-connected telemetry. Unlike enterprise IT, AHS networks prioritize deterministic latency over confidentiality—making traditional encryption impractical for CAN FD or J1939 buses. Key principles include: (1) Defense-in-depth across three zones—cloud (dispatch layer), edge (truck-mounted gateway), and device (ECU/VCU); (2) Threat modeling using MITRE ATT&CK for ICS (Tactics: TA0001–TA0043) mapped to AHS architecture; (3) Incident triage prioritization based on safety impact (ISO 26262 ASIL-D criteria) rather than data loss alone; and (4) Forensic preservation of volatile memory (e.g., RAM dumps from NVIDIA Jetson AGX Orin ECUs) before power cycling.
📐 Mean Time to Contain (MTC) Benchmarking
MTC quantifies operational resilience by measuring elapsed time from first detection to full fleet isolation. It anchors response effectiveness against industry SLAs and regulatory expectations. Lower MTC correlates with reduced risk of cascading failures (e.g., runaway trucks triggering secondary collisions or slope instability).
Mean Time to Contain (MTC)
MTC = T_contain − T_detectMeasures operational responsiveness from initial detection to complete containment of compromised AHS assets.
Variables:
| Symbol | Name | Unit | Description |
|---|---|---|---|
| MTC | Mean Time to Contain | seconds | Elapsed time between confirmed detection and verified isolation of affected systems |
| T_contain | Time of Containment Confirmation | UTC timestamp (ISO 8601) | When all affected haul trucks are verified offline or operating in fail-safe mode with remote command disabled |
| T_detect | Time of First Valid Detection | UTC timestamp (ISO 8601) | When SOC or AHS monitoring system generates a high-fidelity alert (not noise) indicating compromise |
Typical Ranges:
Tier 1 response (minor telemetry compromise): 60 – 300 s
Tier 2 response (control-plane compromise, e.g., steering/GNSS): 300 – 900 s
Tier 3 response (multi-fleet ransomware affecting dispatch): 900 – 3600 s
💡 Worked Example
Problem: During the Tanami drill, detection occurred at 03:17:22 UTC via IDS alert on abnormal CAN message ID 0x18FEE500 (steering angle override). Full fleet isolation (disabling remote command injection while preserving local braking logic) was achieved at 03:29:08 UTC. Calculate MTC and compare to ISO/IEC 27035-1 Tier 2 benchmark.
1.
Step 1: Convert timestamps to seconds since epoch or compute delta directly: 03:29:08 − 03:17:22 = 11 minutes 46 seconds = 706 seconds
2.
Step 2: Apply formula: MTC = T_contain − T_detect = 706 s
3.
Step 3: Compare to ISO/IEC 27035-1 Tier 2 threshold (≤ 900 s for high-impact OT incidents); 706 s < 900 s → meets benchmark
Answer:
The result is 706 seconds, which falls within the safe range of ≤ 900 seconds per ISO/IEC 27035-1:2016 Tier 2 requirements.
🏗️ Real-World Application
In the 2023 Tanami drill, red-team operators exploited a misconfigured MQTT broker in the edge gateway (running Eclipse Mosquitto v2.0.14 without TLS client authentication) to inject falsified payload weight readings into the CCH dispatch queue. This triggered premature unloading cycles and destabilized dump pocket fill ratios. Blue-team responders used Wireshark + CANalyzer to reconstruct the rogue topic hierarchy (‘aht/t785/weight/fake’), isolated the broker via VLAN ACLs, and restored integrity using signed firmware rollback to known-good version 3.2.1—validated via SHA-256 hash comparison against offline golden image repository.
🔧 Interactive Calculator
🔧 Open Autonomous Haulage Systems Integration Calculator📋 Case Connection
📋 Gold Mine Cybersecurity Hardening at Newmont Tanami
Legacy OTA update mechanism lacked code signing, enabling spoofed firmware injection