Disclaimer: All views presented here, in this newsletter, are my own.
Author or the newsletter are not liable for any actions taken by any individual or any organization / business / entity. The information provided is for education and awareness purposes only and is not specific to any business and or situation.
Hey there,
Hope you are doing well. This week’s theme is about:
✍️ Quick updates on my side and the IT-OT CySEAT course.
↪️ Part 2 of The Digital Factory (Hub & Spoke) - Data Lifecycle in 4.0
📘 Few security aspects for Data Flow in 4.0 as part of Cybersecurity Program.
‼️ How CISO’s role have evolved in the context of OT Cybersecurity.
This is Part 2 of “The Digital Factory” series.
In Part 1 - The Digital Factory (Hub & Spoke) we covered and concluded:
what is industry 3.0, industry 4.0, digital factory and UNS concepts.
concluded that these new approaches, challenges the status quo for industry 3.0 and generates a debate around the “questionable” use of Purdue model for network segmentation - whether its dead or alive, reference network architectures and why Security folks are in a fist fight most of the time with solution architects and or automation professionals.
In this Part we’ll briefly touch base on:
industry 4.0 data flow lifecycle, DataOps and security considerations.
In future Part 3, we’ll cover, the reference architectures, the industry debates and few updates.
Ready? let’s dig in.
Yours truly.
— Yousuf.
Securing Things Academy: (coming soon)
IT & OT CySEAT (Cyber Security Education And Transformation) course is designed for IT and OT cybersecurity practitioners. Join the wait-list → here.
Checkout a brief overview below:
But before we begin, do me a favour and make sure you hit the “Subscribe” button to let me know that you care or liked and keep me motivated to publish more. Thanks!
Quick Update:
Its’ been a better start of the year - compared to 2024. The year has begun with doing few focused reviews / consulting / advisory across IT, OT and data privacy, in different manufacturing sectors and critical infrastructure org, so its been a very busy quarter. Interesting to note the similarities and differences in terms of asset owners approach towards cybersecurity.
In this edition, below, I cover a typical industrial data flow lifecycle, something that took me quite a while to uncover and wrap my head around in understanding the concept, so hoping it will save some good time for you.
To know more, please note that the digital factory series and few other previous ones are included as are part of IT-OT CySEAT Training - an upcoming offer. So if you have enjoyed, hope to see you on the wait-list, before its too late.
Drop in your best email address to subscribe and continue reading the rest of the newsletter edition for free.
Industrial Data Flow Lifecycle
First lets look at what is Industrial DataOps, what stages of the maturity curve organisations go through and then understand a typical data flow iteration example.
Finally, we’ll look into some elements of securing this new industrial data.
DataOps in Industry 4.0
DataOps is a set of practices that orchestrates people, processes, and technology to provide trusted, understandable, and ready-to-use data across the organization. In Industry 4.0, DataOps is crucial for managing the vast amounts of data generated by sensors and machines, ensuring data quality, and facilitating secure data flow3.

Source: HighByte
Digital manufacturers going through digital transformation, goes through following DataOps maturity curve.

Source: HighByte
Securing the Industry 4.0 Data Lifecycle
To explain this, here’s an illustration to understand how physical machine data goes through few iteration cycle to become actional intelligence in digital world for the business.

Data Flow and Security Implications by M. Yousuf Faisal
The data flow can be divided into following stages as illustrated above:
Connect
Collect
Store
Analyse and Visualise
Finding Data Patterns and Reporting.
Every stage and interaction point represents an opportunity, and as they say, where there’s an opportunity, there’s some elements of cyber risks that we need to cater.
At the connect and collect stage: we need to ensure using secure methods of connectivity and collection using secure protocols etc.
At the store, analyse and visualise stage: we are more concerned with data classification, governance, access controls and protections (at rest / motion).
At the finding data patters and reporting stage: we are still concern around same things as in previous stage, and in addition, cloud / AI security elements.
This is where/how OT data meets IT style data governance and security controls.
Ever wonder, why you keep hearing “IT and OT are converging….” ?
Though over rated and misinterpreted in most context, but gives you some ideas.
Data Security Challenges
Connected Devices: IoT devices increase the attack surface, making it easier for hackers to access sensitive data.
Data Sharing: Sharing data across the supply chain can expose proprietary information.
Cyber Risks: Smart factories face risks like denial-of-service attacks and data breaches.
Security Concepts and Frameworks
DataSecOps: Automates data security processes like classification, access controls, and incident response1 .
Distributed Ledger Technology (DLT): Provides secure and transparent data management using blockchain or similar technologies4.
Privacy by Design: Ensures data privacy is integrated into the system design from the outset4.
Implementing DataOps and Security in the Digital Factory
Key Elements
Illustrative Example
Consider a smart factory using IoT sensors to monitor production. Implementing DataOps involves:
Data Collection: Sensors collect data on production efficiency and quality.
Data Processing: Data is processed in real-time to identify bottlenecks.
Data Security: DataSecOps ensures that only authorized personnel can access sensitive production data.
Data Governance: Data Fabric ensures that data is properly governed and compliant with regulations.
Conclusion
Securing Industry 4.0 data lifecycle and implementing effective DataOps strategies are crucial for the success of digital factories. By integrating robust security frameworks and leveraging technologies like DLT and Data Fabric, organizations can protect their data while enhancing operational efficiency and decision-making capabilities.
Supporting Diagrams and Models
For a visual representation of the concepts discussed, consider the following models:
DataSecOps Journey: Illustrates how data security processes are automated and integrated into data operations1.
Industry 4.0 Production Life Cycle: Shows how cybersecurity risks evolve across different stages of production2.
Data Fabric Architecture: Depicts how data is managed and governed across diverse environments7.
I’d love to know what have you seen works for:
your Industrial environment → if working as an asset owner.
your Industrial customers → If you are consultant / vendor / solutions provider.
If you’d like to learn more on this head to:
IT-OT CySEAT Training & join the wait-list soon, before its too late.
How have CISO’s role evolved in OT Cybersecurity
In 2024, Chief Information Security Officers (CISOs) have taken on a more strategic role in Operational Technology (OT) cybersecurity decision-making.
This shift is driven by their increased recognition as strategic leaders, aligning cybersecurity with business strategies and risk management.
CISOs are now more involved at the board level, with 30% sitting on corporate boards, enhancing their influence on cybersecurity investments and strategies.
Improved alignment with board members facilitates informed decision-making.
CISOs focus on quantifying cyber risks and bridging IT and OT security, ensuring comprehensive protection.
They also adopt advanced technologies like AI and ML for better threat detection and response.
Overall, CISOs' roles have evolved to encompass risk management, board engagement, and technological integration, highlighting the growing importance of cybersecurity in organizational leadership.
My Recent Most Viewed Social Posts:
In case you’ve missed - here are some of my recent most viewed social posts.
Cybersecurity & Data Privacy for Hong Kong - HK Cybersecurity Market, upcoming Critical Infrastructure Bill 2024 regulations, Data Privacy Program Core elements, HK markets and more
ISA/IEC 62443 Standards - Part 4 - Covering updates to 62443-2-1:2024.
Cybersecurity and AI Across the Industrial Automation Stack - Monthly Digest # 0. - Idea and poll around the subject.
ISA/IEC 62443 Standards - Part 3 - series covering essentials of the standard.
OT Security Visibility Solutions & Metrics -✅Lessons learned consulting on top OT Security Solutions, KPIs/ODMs, & more🚀.
Tip to remember ISA/IEC 62443 Standards Group & Overview Part 2.
What the heck is ITDR - A crash course on Identity Threat Detection & Response.
IT & OT/ICS Cybersecurity Policy(/ies) - Deciding on the Policy Route for your industrial environments.
Securing Things Academy:
IT & OT CySEAT (Cyber Security Education And Transformation) course is designed for IT and OT cybersecurity practitioners. Join the wait-list → here.
Checkout a brief overview below:
Ways in which I can help?
Whenever you are ready - I can help you with:
A - IT & OT Cybersecurity Advisory / Consulting services - for securing your business and or its digital transformation journey.
B - Security Awareness Training & Phishing Awareness Portal - Train your staff and build a Security awareness program subscription based service.
C - Securing Things Academy (STA) - Security trainings for IT & OT practitioners.
Visit the newsletter website for Links to above services and or reach out at info[at]securingthings[dot]com or DM me via LinkedIn.
D - Securing Things Newsletter - Sponsor this newsletter to showcase your brand globally, or subscribe to simply Get Smarter at Securing Things.
Reach out at newsletter[at]securingthings[dot]com or DM me via LinkedIn.
✉️ Wrapping Up - How are we doing?
I invite you as part of #SecuringThings community to share your feedback.
Rate the newsletter content
Your feedback and input is invaluable to me as we work together to strengthen our cybersecurity defenses and create a safer and smarter digital society.
Let us know how we can improve this and or what you’d like to see in future?
Thank you for your trust and continued support.
Do register, validate your email, and request login link to submit poll to be able to enter a chance to win a future course giveaway.
Thanks for reading - until the next edition!
It’s a Great Day to Start Securing Things for a Smart & Safer Society.
Take care and Best Regards,
M. Yousuf Faisal. (Advice | Consult Cyber & business leaders in their journey on Securing Things (IT, OT/ICS, IIOT, digital transformation, Industry 4.0, & AI) & share everything I learn on this Newsletter | and upcoming Academy).


