OT cyber security and critical networks for rail, energy, oil and gas.

Assessed, designed and built to IEC 62443 by operational network, SCADA and OT security engineers.

Discuss a requirement Stop the attack
IEC 62443 zoned architecture on the ISA-95 levels, linked by secured conduits with attacks stopped at the firewall and the access broker. Railway view: corporate IT, industrial DMZ for remote diagnostics, control centre with traffic management and signaller workstations, interlocking and object controllers, then points, signals and track circuits. Energy view: corporate IT, industrial DMZ for vendor access, control room with SCADA master and historian, protection relays, bay controllers and RTUs, then breakers, transformers, valves and sensors. LEVEL 4–5 Corporate IT · email · asset management Corporate IT · ERP · asset management LEVEL 3.5 Industrial DMZ · remote diagnostics Industrial DMZ · vendor access REMOTE LEVEL 3 Control centre · TMS · signaller workstations Control room · SCADA master · historian LEVEL 1–2 Interlocking · object controllers Protection relays · bay controllers · RTU LEVEL 0 Points · signals · track circuits Breakers · transformers · valves · sensors FW FW ZONES & CONDUITS · IEC 62443-3-2 · EN 50159 ZONES & CONDUITS · IEC 62443-3-2 · NCSC CAF · NIS BLOCKED · FR5 BLOCKED · FR1
Operational networks, SCADA, OT securitySignalling, telecoms, substation and control networks.
IEC 62443Zones, conduits, security levels. EN 50159 for signalling networks.
We build itNot only the report.
Five countriesUK, Poland, UAE, India, Australia.
Certified

ISO 27001. ISO 9001. ISO 45001. Cyber Essentials Plus.

Information security, quality, health and safety, and UK government-backed cyber assurance. Held by IP Global Services, applied to every job.

ISO 27001 information security management, certified ISO 9001:2015 quality management, certified ISO 45001 occupational health and safety management Cyber Essentials Plus
Three attacks. Three controls.

How an attacker reaches the trains, and what stops them.

01

Phishing on an office PC

Malware spreads across a flat network from the office to the SCADA server, then to the interlocking.

Stopped by an industrial DMZ and firewall between enterprise and operations.IEC 62443 FR5 · Restricted data flow
02

Compromised vendor laptop

A supplier's standing VPN account gives a route straight into the control system, past the firewall.

Stopped by brokered remote access: MFA, approval, time-box, recording.IEC 62443 FR1, FR2 · Authentication and use control
03

USB on an engineering laptop

The laptop has legitimate access to program the PLC. Segmentation lets it through, because it has to.

Stopped by hardening and allow-listing on the workstation.IEC 62443 FR3 · System integrity

Try it: five points, three attacks, two minutes

Why a dedicated OT team

One team, accountable from design to handover.

Operational estates run thirty-year assets next to new IP systems, and they are now connected to corporate IT. When several suppliers share one environment, accountability splits the moment something goes wrong.

IPGS runs operational technology as a separate discipline, staffed and billed apart from its telecoms and enterprise IT work. It is the group's flagship practice. The same engineers carry a programme from the zone model to commissioning.

  • We deliver itA defined scope under one contract, direct or through your prime contractor: from a signalling network design and CRE package to a full assess, design and build programme. Our engineers hold the design authority and sign the deliverables.
  • We assure itOn the client's side: review and challenge of supplier designs, security requirements traced to evidence, risks stated plainly.
  • The group behind itPenetration testing, SOC monitoring and telecoms core and RAN engineering from other IPGS practices, under the same contract.
What we do

Assess. Design. Build.

Most OT security suppliers stop at the report. We design the network and we build it. Watch what each phase does to an estate.

An operational estate: enterprise IT and a vendor at the top, a control centre in the middle, an interlocking site and a substation below. Assessment draws the zones and sets a target security level for each; design adds the industrial DMZ, firewalls on every conduit and an access broker; build commissions and verifies them. ENTERPRISE IT Office · ERP · email VENDOR · REMOTE Supplier support laptop CONTROL CENTRE SCADA · historian · engineering INTERLOCKING SITE Object controllers · lineside SUBSTATION Traction power RTU · protection FLAT NETWORK STANDING VPN SL-T 2 SL-T 3 SL-T 2 LEVEL 3.5 · INDUSTRIAL DMZ Jump host · patch relay · historian replica ACCESS BROKER FR5 · RESTRICTED DATA FLOW FR1 · FR2 · BROKERED ACCESS
Zones, conduits, target security level per zone · IEC 62443-3-2

What is connected, what is exposed, what to fix first.

  • Zone and conduit model with a target security level per zone, to IEC 62443-3-2
  • Threat and consequence register, ranked by operational impact
  • Review of the network as built: segmentation, single points of failure, remote access paths
  • NIS / CAF gap analysis and the evidence pack the regulator expects
What an assessment delivers
Sectors

Rail, energy, oil and gas.

Core experience in rail. The same method and the same engineers on power, utility and process sites.

Core experience

Rail & Metro

Signalling data networks, operational telecoms, traction power SCADA, control centres, stations and depots. IEC 62443, EN 50159, NIS.

What we do for rail

Energy, Oil & Gas

Substation and electrification SCADA, utility telemetry, terminals, pipelines and process plants. Segmentation, vendor access and network build around outages and turnarounds.

What we do for energy, oil and gas
The team

New to IPGS. Not new to critical networks.

110+years' combined experience
90+programmes delivered on
8engineers
4accreditations held

Who we are

How we work
  1. A zone gets a target security level before it gets a firewall.We decide how much protection each part of the network needs, to IEC 62443-3-2, before any control is chosen or bought.
  2. No change on a live network without a safety-case check and a rollback plan.Impact on the safety case and type approval is assessed first, and every change can be undone in the same window.
  3. No report without the bill of materials and the people to build it.Every assessment comes with a costed equipment list and the engineers to deliver it.

Discuss a requirement

Send the drawing, the audit finding or the project scope. An engineer will come back to you.

Contact us Capability statement