Staying cyber secure is an ongoing process. Organizations that embed security throughout the product lifecycle are better positioned to reduce risk, maintain compliance, and deliver resilient products to their customers. 

duagon offers a comprehensive set of services throughout the entire product lifecycle. The evaluation of a project with cybersecurity requirements follows similar process steps like a standard customization project for duagon products. The process for an individual project can be accelerated when train builder specific security concepts have been pre-defined. 

• At the beginning of your project, duagon will help to define an appropriate security level for your specific use case, offer general cybersecurity consultancy, as well as initial threat & risk analysis. 
• The design process follows IEC 62443-4-1 and makes use of our duagon secure product development platforms which include secure coding, product hardening, penetration tests, user access management, setup & maintenance of Public Key Infrastructure (PKI), security documentation, and the setup of vulnerability watch. 
• Production will take place in duagon’s in-house factories. 
• The delivery of your products will be secured by tamper detection through software integrity checks. You will also receive a security manual. 
• Once your product is put into operation, duagon’s vulnerability watch will monitor the security status of all 3rd party components and detected issues in own components. Depending on the feature package implemented, various services help maintain a secure operation like security audit logging, centralized user management or secure firmware update and firewall functionality. Additionally, duagon offers software security updates to close known security vulnerabilities. 
• At the end of your product’s lifecycle, duagon will take care of secure and verifiable deletion of sensitive data and disposal of hardware according to environmental regulations. 

The IEC 62443 standard defines security levels on a five-point scale (0, 1, 2, 3 and 4), each of which represents an incremental level in terms of cybersecurity measures. 

• SL1 can be covered by the duagon Cybersecurity Basic Package elements 
• SL2 can be covered by the duagon Cybersecurity Extended Package elements 
• SL3 can be covered by the duagon Cybersecurity Advanced Package elements with customizations 
• SL4 may be offered in the scope of a customer specific project 

Cybersecurity services for embedded and connected products help manufacturers identify, reduce, and manage cyber risks throughout the product lifecycle. They can include risk assessments, threat modelling, secure software development, security testing, vulnerability management, SBOM creation, PSIRT setup, and incident support.

These services are particularly relevant for industrial systems, rail applications, medical devices, edge computers, gateways, and other products with digital elements.

Product cybersecurity is the protection of a connected product, its software, interfaces, data, and communications against cyber threats. It covers the complete lifecycle, from development and production to operation, maintenance, updates, and end of support.

For embedded and industrial products, product cybersecurity may include secure boot, authentication, encryption, hardening, secure remote access, vulnerability management, and security monitoring.

Industrial and embedded products are increasingly connected to networks, cloud services, maintenance tools, and other devices. This connectivity can create attack surfaces that may affect availability, integrity, confidentiality, safety, operations, and business continuity.

Cybersecurity helps manufacturers and operators protect devices, networks, software, and data from unauthorized access, manipulation, malware, and service disruption.

A cybersecurity risk assessment identifies relevant assets, threats, vulnerabilities, attack paths, and potential business or operational impacts. It helps determine which security measures are appropriate for a product, system, or application.

For connected products, the assessment should consider the device, embedded software, interfaces, supply chain, user roles, communications, update mechanisms, and expected operating environment.

Threat modelling is a structured method for identifying how a product or system could be attacked, and which controls are needed to reduce risk. It is usually carried out during the design and development phase.

A threat model documents assets, trust boundaries, interfaces, potential attackers, attack scenarios, and security requirements. It supports secure-by-design development and provides evidence for product-security and compliance activities.

Vulnerability management is the ongoing process of identifying, assessing, prioritizing, remediating, and communicating security vulnerabilities in products and software.

For connected products, it includes monitoring vulnerability sources, assessing the affected product versions, coordinating fixes, providing security updates where appropriate, publishing advisories, and maintaining documentation across the supported product lifecycle.

IEC 62443 is a family of international standards for cybersecurity in industrial automation and control systems. It provides guidance for operators, integrators, service providers, and product manufacturers.

The standards address areas such as secure development lifecycle practices, security levels, risk assessment, system architecture, component security, and operational security. The applicable parts depend on the organization’s role and the specific product or system.

Railway cybersecurity requires a risk-based approach that protects rolling stock, signalling, trackside infrastructure, communication networks, maintenance interfaces, and passenger-facing systems.

Typical measures include security architecture reviews, network segmentation, secure remote access, hardening, intrusion detection, vulnerability management, monitoring, incident response planning, and alignment with relevant rail cybersecurity requirements such as TS 50701 where applicable.