The Chinese translation is being made; the original is shown for now.
Securing access to original equipment manufacturers enables miners to maintain critical equipment support while protecting operational technology.
Mining operators rely on original equipment manufacturers (OEMs) to maintain real-time or near-real-time access to vehicles, processing plants, and critical operational technology (OT) to keep production running.
Modern mining fleets and processing systems are designed with deep OEM integration, often requiring connectivity from OEM support centres into on-site OT networks.
This dependency can create several supply chain and remote access risks. Anchoram Consulting quoted a 2024 Claroty mining industry survey that found 76 per cent of respondents experienced cyber-breaches from third-party OT access.
As a result, Anchoram is urging operators to plan for compromised OEM workstations, stolen credentials, lateral movement into safety or fleet-management systems, and disruption through remote-access platforms shared across customers.
“Persistent operational need does not mean permanent, unrestricted access,” Anchoram said.
“Operators should treat all OEM connections as untrusted external traffic.”
The priority is controlling how these connections enter OT. Networks should be segmented by function and criticality, separating autonomous mobile equipment, fixed plant, safety systems, and links to remote operations centres (ROC).
Remote OEM users should have access limited to an industrial demilitarised zone (DMZ) or Level 3.5 zone containing jump hosts, terminal servers, and remote-assistance gateways; rather than landing directly in the OT network. Secure remote-access solutions can then broker connections to specific devices or applications for limited periods.
Every remote OEM operator should use a named account with multi-factor authentication.
Access should require approval, be granted for a defined window, and expire when the task ends.
Operators should record remote sessions and store logs outside the OT network for independent review.
Least privilege is critical. Each OEM role should receive only the access required for relevant programmable logic controllers (PLCs), human–machine interfaces (HMIs), supervisory control and data acquisition (SCADA) or fleet-management systems, with no direct paths from the internet to OT devices and systems.
Autonomous mobile equipment should have onboard networks treated as critical OT. Communications should be segmented so engine diagnostics cannot access autonomous control or safety functions, and vendor updates should be tested before deployment.
“Technical controls must be backed by strong governance over OEM relationships,” Anchoram said.
Maintenance and support contracts should define requirements for access security, responsibilities, credential management, logging, and incident notification. Operators should retain the right to audit OEM controls, review logs, and participate in joint simulations and recovery drills.
OT-specific third-party assessments should include workshops with critical OEMs and service providers to review shared controls. Operators should also understand their suppliers’ cyber exposure, including platforms they use, and how an incident could propagate across multiple sites.
Involving security teams early in procurement helps assess supplier security maturity and align cyber-resilience strategies.
Once access controls and supplier responsibilities are established, operators need to see how OEM connections are being used.
Passive monitoring can analyse traffic between OT devices and identify anomalous OEM behaviour without disrupting operations. Site OT network monitoring should operate independently of connectivity to either the ROC or corporate IT, maintaining visibility even during communications outages.
OEM access logs, jump host logs, and session recordings should feed into a central security operations platform outside the OT network.
Correlating these records with identity and access management (IAM) events, tickets, and change records helps identify access outside approved maintenance windows, unexpected connections, or deprecated protocols.
Incident-response playbooks should be coordinated and developed with OEMs and explicitly define handovers between cyber, operational, maintenance and vendor teams.
Joint simulations should regularly test these arrangements, while immutable offline backups of critical configurations, PLC logic, and fleet-management data support rapid recovery.
Operators can begin by inventorying every OEM remote access channel, user, and destination. They can then implement segmentation and secure gateways, remove direct internet-to-OT paths, enforce named accounts, MFA, time-bound approvals, and centralise monitoring and logging.
Contracts and access controls should be strengthened through security requirements and risk workshops, while access paths can be tested through simulations, recovery drills, and penetration testing.
“OEM access is inevitable in modern mining, but it does not have to be uncontrolled,” Anchoram said.
“Combining zero-trust architecture, strict access governance, OT-aware monitoring, and strong supply chain governance allows operators to preserve real-time support while reducing supply chain and remote-access risk.”
This feature appeared in the October 2026 edition of Australian Mining.