Systems Engineering Cybersecurity Measures

BREAKING! The FDA just released this draft guidance, titled Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations, that aims to provide industry and FDA staff with a Total Product Life Cycle (TPLC) approach for developing, validating, and maintaining AI-enabled medical devices. The guidance is important even in its draft stage in providing more detailed, AI-specific instructions on what regulators expect in marketing submissions; and how developers can control AI bias. What’s new in it? 1) It requests clear explanations of how and why AI is used within the device. 2) It requires sponsors to provide adequate instructions, warnings, and limitations so that users understand the model’s outputs and scope (e.g., whether further tests or clinical judgment are needed). 3) Encourages sponsors to follow standard risk-management procedures; and stresses that misunderstanding or incorrect interpretation of the AI’s output is a major risk factor. 4) Recommends analyzing performance across subgroups to detect potential AI bias (e.g., different performance in underrepresented demographics). 5) Recommends robust testing (e.g., sensitivity, specificity, AUC, PPV/NPV) on datasets that match the intended clinical conditions. 6) Recognizes that AI performance may drift (e.g., as clinical practice changes), therefore sponsors are advised to maintain ongoing monitoring, identify performance deterioration, and enact timely mitigations. 7) Discusses AI-specific security threats (e.g., data poisoning, model inversion/stealing, adversarial inputs) and encourages sponsors to adopt threat modeling and testing (fuzz testing, penetration testing). 8) And proposed for public-facing FDA summaries (e.g., 510(k) Summaries, De Novo decision summaries) to foster user trust and better understanding of the model’s capabilities and limits.

3 Minutes of Downtime. Full Microsegmentation. No Changes Required. Most cybersecurity conversations still assume one thing: You can change the environment. But what happens when you can’t? On the plant floor, there are no easy resets. No patch windows. No tolerance for downtime. We’re talking about: • Legacy machines that can’t be touched • Unmanaged assets • Systems where even 1 hour of downtime can cost millions This is where Byos delivers real-world value. In this clip, we walk through a real deployment: Securing a plant floor with CNC and hydraulic machines running on an existing network, without disruption. No rip-and-replace. No re-architecture. No operational risk. We deployed Byos hardware-enforced microsegmentation in-line with: • Minimal downtime (Less than 3 minutes of downtime per machine) • No changes to existing assets or network • Immediate visibility and control That’s the difference between theory and reality: Because in these environments, security isn’t about adding controls. It’s about enforcing them without breaking what already works. If your environment can’t afford trial and error, your security architecture shouldn’t depend on it. Watch the clip to see how hardware-enforced microsegmentation performs where software can’t. #cybersecurity #HardwareMicrosegmentation #Manufacturing #LegacySystems #SASE #FIPS140-2 #ICS #OT #IoT #BYOS

OT Detection Use Cases for your OT SOC When it comes to building an OT SOC, there’s a big misconception: many assume success is about collecting every log or integrating every system In reality, the key is focusing on operationally meaningful visibility — the detections that actually help you understand what’s happening inside your control network >> In industrial environments, context defines everything > The same Modbus write command could mean two very different things: > a maintenance engineer performing a scheduled update — or an attacker changing control logic. > Without context, both look identical in your SIEM. >> An OT SOC must speak the language of process, assets, and operations, not just alerts. It should tell you when something changes, who initiated it, and whether it threatens safety, reliability, or integrity >> Below are 10 detection use cases I always recommend as a starting point. They’re mapped to MITRE ATT&CK for ICS and NCA OTCC, but more importantly, they’re grounded in what actually happens inside real plants and industrial networks 1. Unauthorized PLC Programming Detect logic or configuration changes outside scheduled maintenance windows 2. ICS Protocol in IT Zone Flag Modbus, DNP3, or BACnet traffic on IT networks — strong evidence of segmentation drift or misconfiguration 3. PLC Stop or Mode Change Command Detect STOP or PROGRAM mode changes — an event that can halt production and indicate malicious control 4. Remote Access to HMI from Unapproved Source Identify RDP, VNC, or TeamViewer sessions from IT zones targeting OT HMIs — a common lateral movement path 5. New Device in Control VLAN Catch unauthorized or rogue devices joining deterministic control networks where new assets should rarely appear 6. PLC Firmware Downgrade or Version Change Detect unauthorized firmware rollbacks — a subtle but serious method of tampering or hiding malicious code 7. OPC UA Anonymous Session Identify untrusted or anonymous OPC UA sessions that bypass normal authentication or encryption 8. Engineering Software on Non-Engineering Host Detect the execution of TIA Portal, Control Builder, or similar tools on unauthorized systems — often a sign of credential misuse or insider activity 9. PLC Configuration Upload Monitor FTP/TFTP uploads to PLCs — an activity that could replace control logic or inject malicious configuration 10. Abnormal HMI Behavior Spot rapid screen changes, tag edits, or command spamming from operators — signs of misuse, automation, or compromise They aren’t just security detections — they’re process integrity safeguards. Each one gives the SOC visibility into the exact actions adversaries use during real OT incidents — often before physical impact occurs When combined with contextual data (authorized engineers, maintenance schedules, device baselines) and network telemetry , these detections evolve from simple alerts into actionable operational intelligence #OTSOC #OTsecurity #ICSsecurity

🚨 This is no longer a theoretical OT security scenario. CISA, NSA, FBI, DOE and EPA are now warning of active targeting of Siemens Industry S7 PLCs using AI-generated scripts and libraries such as Snap7. Attackers search for exposed or poorly protected controllers and may gain read/write access via S7comm. For S7-1200/1500, PUT/GET must normally be explicitly enabled. Legacy S7-300/400 systems deserve even closer attention. My checklist: ✅ No PLC directly on the Internet ✅ Restrict TCP/102 ✅ Disable PUT/GET if not required ✅ Segment IT and OT ✅ Monitor S7comm write activity AI changes the scale, not the basics. Are you reviewing your S7 exposure now? 🔗 https://lnkd.in/engqvNmh #OTSecurity #Siemens #SIMATIC #Cybersecurity #TIAPortal

CISA has released its new Operational Technology (OT) Cybersecurity Guide, and it deserves board-level attention. For years, OT systems, the technology behind our power grids, water systems, manufacturing plants, and pipelines, were designed for reliability and safety, not cybersecurity. But as IT and OT environments have converged, the attack surface has expanded dramatically. We’ve already seen what this means in practice: ⚠️ Colonial Pipeline (fuel supply disruption) ⚠️ Oldsmar Water Plant (attempted poisoning) ⚠️ Ransomware groups are increasingly threatening physical operations to force payment. The CISA guide is a practical step forward, outlining what every OT-dependent organization should do: ✔️ Know your assets. Visibility is the foundation of OT security. ✔️ Segment IT and OT networks. Strong separation is essential. ✔️ Secure remote access. Enforce MFA, monitor, and log everything. ✔️ Patch with care. Use compensating controls when downtime isn’t possible. ✔️ Prepare for incidents. OT-specific monitoring, response plans, and recovery options must be in place. ✔️ Build resilience. Backups, redundancy, and even manual controls as a fallback. ✔️ Train people. Both IT and OT teams need a shared understanding of cyber risk. This isn’t just a technology problem. It’s a resilience problem. For executives, OT risk belongs on the same agenda as financial, legal, and regulatory risk. The impact of failure isn’t just data loss; it’s downtime, safety hazards, and national security implications. CISA’s guide is a reminder that OT security is no longer optional. It is a core part of modern business continuity. Please feel free to contact me if you need help or want more information on this. 🔔 Follow me for more real-world takes on cybersecurity, leadership, and tech strategy ♻️ Useful? Share to help others! #CyberSecurity #OperationalTechnology #RiskManagement #CriticalInfrastructure #CISA #BusinessContinuity

Modern rolling stock carries hundreds of sensors, embedded controllers, and connected systems that interact with signaling, passenger Wi-Fi, ticketing, and maintenance networks. This evolution has improved efficiency and passenger comfort, but it has also opened a new cyber battleground. Attacks that were once aimed at back-office IT systems now target train control systems, onboard diagnostics, and even communication protocols like GSM-R and its successor, FRMCS. The railway sector has already seen wake-up calls. In 2022, a ransomware attack on a regional train operator forced service delays and manual traffic control. In 2024, a vulnerability disclosure showed that insecure firmware updates on onboard controllers could allow remote manipulation of braking systems. These incidents illustrate that railway cybersecurity is no longer hypothetical; it is a real operational risk. Resilience starts with architecture. Segmenting train networks is critical, separating passenger Wi-Fi and infotainment systems from safety-critical control domains, and isolating signaling communication from external entry points. The IEC 62443 framework provides a strong foundation, defining zones and conduits that restrict access and limit lateral movement. EN 50159 and TS 50701 add railway-specific guidance, covering secure transmission protocols and lifecycle security management tailored to signaling and rolling stock. Zero Trust principles are increasingly being applied to railway operations, verifying identities and device health before granting access to critical systems. Strong encryption, secure boot, and signed firmware updates are essential to protect embedded devices from tampering. Additionally, the use of intrusion detection tailored to operational technology networks is helping operators detect malicious activity quickly, even in environments where patching cycles are slower due to safety certification constraints. Another critical layer is supply chain assurance. Rolling stock manufacturers depend on a complex network of component suppliers, and a compromised subsystem can introduce vulnerabilities that bypass perimeter defenses. Security audits, SBOMs (Software Bill of Materials), and contractual security requirements are becoming standard to manage this risk. Looking forward, the integration of FRMCS, the next-generation mobile communication system for rail, adds both opportunity and complexity. While FRMCS offers stronger encryption and flexible bandwidth, its IP-based architecture increases exposure to internet-style attacks. Proactive measures, like continuous monitoring, red teaming, and vulnerability disclosure programs, will be key to staying ahead. Railway operators, infrastructure managers, and manufacturers must treat cybersecurity as part of operational safety. The line between digital and physical security has blurred. #RailwaySecurity #CyberResilience #RollingStock #OTSecurity #IEC62443 #EN50159 #TS50701 #CriticalInfrastructure

𝗜𝗻𝗱𝘂𝘀𝘁𝗿𝗶𝗮𝗹 ��𝘆𝗯𝗲𝗿 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗶𝘀 𝗻𝗼𝘁 𝗼𝗻𝗲 𝗰𝗼𝗻𝘁𝗿𝗼𝗹. It is 𝗹𝗮𝘆𝗲𝗿𝗲𝗱 𝗿𝗲𝘀𝗶𝗹𝗶𝗲𝗻𝗰𝗲. In OT environments, mission-critical assets cannot be protected by a single firewall, antivirus tool, or monitoring platform. Real protection comes from 𝗱𝗲𝗳𝗲𝗻𝘀𝗲 𝗶𝗻 𝗱𝗲𝗽𝘁𝗵 — multiple layers working together: • 𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 Code signing, firmware integrity, secure configuration, change management, audit logging, and backup validation. • 𝗘𝗻𝗱𝗽𝗼𝗶𝗻𝘁 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 Host hardening, application allowlisting, removable media control, patch and vulnerability management, and role-based access control. • 𝗡𝗲𝘁𝘄𝗼𝗿𝗸 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 Zone segmentation, VLANs, industrial firewalls, secure remote access, anomaly detection, and unidirectional gateways where required. • 𝗣𝗲𝗿𝗶𝗺𝗲𝘁𝗲𝗿 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 OT DMZ, jump hosts, VPN termination, proxy inspection, perimeter firewalls, and third-party access control. • 𝗣𝗵𝘆𝘀𝗶𝗰𝗮𝗹 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 Site fencing, badge or biometric access, CCTV, locked cabinets, visitor management, and tamper detection. The goal is simple: • 𝗣𝗿𝗲𝘃𝗲𝗻𝘁 what you can. • 𝗗𝗲𝘁𝗲𝗰𝘁 what you cannot prevent. • 𝗥𝗲𝘀𝗽𝗼𝗻𝗱 before safety, reliability, or production is impacted. In OT security, resilience is built 𝗹𝗮𝘆𝗲𝗿 𝗯𝘆 𝗹𝗮𝘆𝗲𝗿. #OTSecurity #IndustrialCyberSecurity #ICSSecurity #CyberSecurity #DefenseInDepth #OperationalTechnology #CriticalInfrastructure #IEC62443 #SCADA #IndustrialAutomation #CyberResilience

I’ve spent 3 decades building security products for Indian businesses, audited 100s of setups, and spoken to 1000s of IT heads, business owners, and CIOs. Still, I keep hearing the same lines before or after things break. Here are the 7 costliest cybersecurity assumptions I hear in Indian mid-sized companies: (1) “That vendor contract includes incident response.” Most don’t. They’ll patch systems. Not lead breach comms at 2 AM. (2) “We have backups, so we’re safe from ransomware.” Until the ransomware encrypts your backups too. (Yes, that happens. Often.) (3) “Our firewall blocks exfiltration.” Firewalls are great. But data doesn’t always leave via the front door. (4) “We’re not a target. No one’s interested in our data.” Your vendor access, email server, or tax filings say otherwise. (5) “We use X tool. It’s very advanced.” Tools don’t save you. People and processes do. (6) “Our developer used SSL. So it’s secure.” That’s like saying “I locked the front door,” while leaving the back gate wide open. (7) “We’ll worry about compliance later.” In India, you’ll likely worry after the media finds out. Most mid-sized businesses don’t need 100 tools. They need less overconfidence, more visibility. And sometimes, just asking “What are we assuming is true, but we’ve never actually tested?” …can save you months of chaos. What’s the most dangerous security assumption you’ve seen firsthand? (Photo from a recent fireside chat at CyberCred Conference.) Quick Heal Seqrite #CyberSecurity #InfoSec #CyberAwareness #Ransomware #DataProtection #IndianBusiness #Leadership #SecurityCulture

In the third part of my Understanding Energy Resilience series, I want to start with something many of you will have seen in the news: recent drone disruptions at major airports. Munich having to temporarily close its airspace. Oslo halting landings. Copenhagen pausing operations for hours. These incidents showed how quickly one small object can halt a critical service, create chaos and cost millions. Now take that thought to energy. If a drone over a runway makes headlines, a drone over energy infrastructure often doesn't. Yet the consequences can be just as real: disruptions to electricity supply, halted rail services and factories forced to stop production. Across Europe, operators are not allowed to neutralize hostile drones themselves – even when a threat is visible above critical infrastructure. Simply put: the rules have not caught up with reality. In my view, clarity and speed here are essential for public safety. Next to physical threats we also face digital ones. Every hour, around 35 million cyberattacks happen worldwide – almost 10,000 every second. Around 5% of them target energy companies and infrastructure. This is the world we operate in: attacks can appear out of nowhere and put entire systems to the test in real time. From my perspective, defending energy infrastructure comes down to a few key priorities: 1���⃣ Let protection happen: Regulation needs to enable energy operators to protect themselves. Clear rules must define who can intervene, when and how – including stopping a hostile drone. We cannot afford hesitation while minutes turn into outages. 2️⃣ Treat physical and digital as one: Fences, cameras and access control on the ground. Network separation and continuous monitoring in the control room. Physical and digital security must be treated as one because if someone can walk in, they can often plug in and disrupt the system. 3️⃣ Harden the infrastructure no one can afford to lose: The majority of physical and cyberattacks on energy systems target a small number of high-impact sites – such as substations, control rooms and interconnectors. Better detection and stronger barriers here make the difference between local disturbance and national outage. 4️⃣ Practice recovery, not just prevention: Real resilience is measured in how quickly power is restored. Simple restart plans, spare parts ready on site and regular drills with operators and authorities turn days in the dark into hours. 5️⃣ Stop naivety – talk openly about risk: We need public awareness without drama – which is one of the reasons I started this series. The more people understand that drones over critical sites are serious and that malware or phishing mails are no joke, the more support there will be for sensible protection. I believe this is the right balance: clear authority to act, practical protection on the ground and in the network with a constant focus on rapid recovery. In a more contested world, that is how energy systems stay open for business.