feras.me / security

OT & Enterprise Security Architecture

I have spent 29 years on the operator side of security — inside government ministries and critical water infrastructure, not in a consultancy writing recommendations for someone else to ignore. This page describes how I actually approach the work, and what it produced.

Current role

VP of Digital Infrastructure, TAQA Water Solutions (2026 – present)

Previously

CISO, TAQA Water Solutions (2017 – 2022)

Based in

Abu Dhabi, United Arab Emirates

Core certs

(ISC)² CISSP · ISO/IEC 27001:2022 Lead Implementer · ISO 31000 Advanced Lead Risk Manager · CBCI 7.0

Sector

Water utilities, industrial operations, government

Why OT security is a different discipline

The single most expensive mistake I see is treating an industrial network as an office network with unusual hardware attached. The threat models genuinely diverge, and the divergence is structural rather than cosmetic.

In enterprise IT, confidentiality usually leads. In operational technology, availability and physical safety lead, and everything else is negotiated around them. A patch that reboots a domain controller costs you an irritated afternoon. A patch that reboots a PLC governing a chlorine dosing pump is a safety event. That asymmetry cascades into every decision downstream.

The practical consequence: in OT you buy security through architecture, because you cannot buy it through patch velocity. Zone and conduit segmentation, passive traffic monitoring that never touches the process, one-way data flows to the historian, and disciplined change control do the work that endpoint tooling does elsewhere.

What I have actually built

ISO 27001 certification in 10 months

Typical first-time certification runs 12 to 18 months. We closed it in 10. Three things made the difference, and none of them was working harder:

• Tight scoping. We certified the systems that genuinely carried risk rather than drawing the boundary around the entire organisation to look impressive. A smaller, defensible scope certifies faster and survives surveillance audits better.
• Evidence reuse. We were already meeting NESA and UAE Information Assurance requirements. Roughly two-thirds of the ISO control evidence already existed under a different label — it needed mapping, not creating.
• Parallel execution. Risk assessment and control implementation ran concurrently. The textbook sequence is serial; the textbook sequence is also why most programmes take 18 months.

Cutting RTO and RPO by 70%

Re-engineering the disaster recovery architecture reduced both recovery time objective and recovery point objective by 70%. The gain came almost entirely from confronting a gap most organisations quietly tolerate: the difference between the RTO written in the policy and the RTO the infrastructure can actually deliver. Most DR plans have never been executed end to end under realistic conditions. Once you test properly, the real number is usually several multiples of the documented one, and fixing that gap is where the improvement lives.

Securing 18 distributed sites

Designing private 5G and M2M network architecture across 18 distributed OT/SCADA sites is fundamentally a segmentation problem wearing a connectivity costume. Every new link between sites is a new lateral movement path, so the network design and the security architecture have to be the same document — drawn by the same people, at the same time. When connectivity is designed first and security is retrofitted, you get a flat network with a firewall bolted to the edge, which is the topology behind most published OT incidents.

Governance that survives contact with the business

As CISO I chaired the Information Security Committee, implemented the UAE National Cyber Risk Management Framework (NCRMF), and brought Information Assurance to 100% compliance. The durable lesson: a security committee that only reviews incidents becomes theatre within two quarters. One that reviews risk acceptance decisions — with named owners and expiry dates on every accepted risk — stays relevant, because it forces the business to re-confirm its appetite rather than letting a one-time exception quietly become permanent.

How I think about cyber risk

A risk register that nobody argues about is a risk register nobody believes.

Quantification matters less than provoking a real conversation about consequence. If a business unit head cannot articulate what a given failure costs them in operational terms, the control protecting against it will be the first thing cut in the next budget cycle — regardless of the score it carries in the register.

Three positions I hold, having watched each one tested:

1. Compliance is a floor, not a ceiling. ISO 27001 and NESA tell you the minimum defensible posture. They do not tell you your actual exposure, because they cannot know your process.
2. Untested recovery is not recovery. Backup success rates measure the backup job, not your ability to restore. Only a full restore under time pressure measures that.
3. Vendor risk is your risk. In OT the integrator often holds remote access that exceeds anything your own staff have, and it is often the least monitored path into the environment.

Regulatory frameworks I work within

ISO/IEC 27001

Information security management — certified implementation and ongoing operation

ISO/IEC 42001

AI management systems — increasingly relevant as AI enters regulated operations

ISO/IEC 20000-1

IT service management — Lead Auditor and Lead Implementer

ISO 31000

Enterprise risk management — Advanced Lead Risk Manager

NESA / UAE IA

UAE Information Assurance Standards for critical national infrastructure

NCRMF

UAE National Cyber Risk Management Framework

ADDA

Abu Dhabi Digital Authority requirements

CBCI 7.0

Business continuity — Business Continuity Institute

Frequently asked

Related

• Private LLMs and AI agents in regulated industry — securing AI where the data cannot leave
• 0xFK — offensive security research — the attacker-side practice that informs the defensive work
• Full career timeline and certifications