Guardians of the Data | Data Security in Critical Infrastructure - Arturo Santos - Guardians of the Data

Data Security in Critical Infrastructure - Arturo Santos - Guardians of the Data - Episode #27

January 29, 2026 / 45:34/E27

What happens when the systems that move people and power our world aren’t secure?

In this episode of Guardians of the Data, host Ward Balcerzak sits down with Arturo Santos, Director of Cybersecurity Architecture at Amtrak, to explore the growing risks facing operational technology (OT), the realities of protecting critical infrastructure, and why data governance, AI, and industry collaboration are no longer optional.

With more than 30 years of experience in IT and cybersecurity, Arturo shares real-world insights from the rail industry, discusses why legacy data retention practices are putting organizations at risk, and explains how modern cyber-physical systems are reshaping security priorities across transportation, energy, and other critical sectors.

Takeaways:

Implement Strict Data Retention Policies: Organizations must establish clear guidelines for data retention and storage. Develop retention schedules based on legal requirements, business needs, and industry best practices, then enforce them rigorously.
Treat Employee Data with Equal Priority as Customer Data: Many organizations focus heavily on protecting customer information while overlooking employee data. Your employees deserve the same level of protection you provide to your customers.
Adopt a Data Custodianship Mindset: Shift how your organization thinks about personal information. Always remember that the data belongs to the individual, and your organization is merely a temporary steward.
Monitor Threats Across Your Entire Supply Chain: Your organization doesn't operate in a vacuum. Stay informed about security incidents, vulnerabilities, and attack patterns across your industry and related sectors.
Engage with Industry Standards Development: Participate in the creation and refinement of security standards for your sector. Your expertise and real-world experience can help shape standards that are both effective and practical.
Leverage Collaborative Threat Intelligence Sharing: A collaborative approach provides visibility into threats you might never see coming from your own network alone. The key is moving from isolated security operations to participating in a broader intelligence ecosystem.

Quote of the Show: