OT cyber security and critical networks for rail, energy, oil and gas.

Assessed, designed and built to IEC 62443 by operational network, SCADA and OT security engineers.

Discuss a requirement Stop the attack
IEC 62443 zoned architecture on the ISA-95 levels, linked by secured conduits with attacks stopped at the firewall and the access broker. Railway view: corporate IT, industrial DMZ for remote diagnostics, control centre with traffic management and signaller workstations, interlocking and object controllers, then points, signals and track circuits. Energy view: corporate IT, industrial DMZ for vendor access, control room with SCADA master and historian, protection relays, bay controllers and RTUs, then breakers, transformers, valves and sensors. LEVEL 4–5 Corporate IT · email · asset management Corporate IT · ERP · asset management LEVEL 3.5 Industrial DMZ · remote diagnostics Industrial DMZ · vendor access REMOTE LEVEL 3 Control centre · TMS · signaller workstations Control room · SCADA master · historian LEVEL 1–2 Interlocking · object controllers Protection relays · bay controllers · RTU LEVEL 0 Points · signals · track circuits Breakers · transformers · valves · sensors FW FW ZONES & CONDUITS · IEC 62443-3-2 BLOCKED · FR5 BLOCKED · FR1
Operational networks, SCADA, OT securitySignalling, telecoms, substation and control networks.
IEC 62443Zones, conduits, target security levels. The method on every job.
We build itSupply, install and commission, with our own engineers.
Five countriesUK, Poland, UAE, India, Australia.
Certified

ISO 27001. ISO 9001. ISO 45001. Cyber Essentials Plus.

Information security, quality, health and safety, and UK government-backed cyber assurance, held by IP Global Services.

ISO 27001 information security management, certified ISO 9001:2015 quality management, certified ISO 45001 occupational health and safety management Cyber Essentials Plus
Three attacks. Three controls.

How an attacker reaches the trains, and what stops them.

01

Phishing on an office PC

Malware spreads across a flat network from the office to the SCADA server, then to the interlocking.

Stopped by an industrial DMZ and firewall between enterprise and operations.IEC 62443 FR5 · Restricted data flow
02

Compromised vendor laptop

A supplier's standing VPN account gives a route straight into the control system, past the firewall.

Stopped by brokered remote access: MFA, approval, time-box, recording.IEC 62443 FR1, FR2 · Authentication and use control
03

USB on an engineering laptop

The laptop has legitimate access to program the PLC. Segmentation lets it through, because it has to.

Stopped by hardening and allow-listing on the workstation.IEC 62443 FR3 · System integrity

Try it: five points, three attacks, two minutes

Why a dedicated OT team

One team, accountable from design to handover.

On a railway or a plant, thirty-year-old equipment now shares its networks with new IP systems, and those networks connect to the office IT. Signalling, SCADA, telecoms and IT usually come from different suppliers, so when something goes wrong each one points at the others.

IPGS keeps one OT team that does the whole job: the same engineers assess the estate, design the network and commission it. Operational technology is a discipline of its own at IPGS, with its own engineers, not a sideline of the IT or telecoms business.

  • We deliver itA defined scope under one contract, direct or through your prime contractor: from a signalling network design and CRE package to a full assess, design and build programme. Our engineers hold the design authority and sign the deliverables.
  • We assure itOn the client's side: review and challenge of supplier designs, security requirements traced to evidence, risks stated plainly.
What we do

Assess. Design. Build.

Most OT security suppliers stop at the report. We design the network and we build it. Watch what each phase does to an estate.

An operational estate: enterprise IT and a vendor at the top, a control centre in the middle, an interlocking site and a substation below. Assessment draws the zones and sets a target security level for each; design adds the industrial DMZ, firewalls on every conduit and an access broker; build commissions and verifies them. ENTERPRISE IT Office · ERP · email VENDOR · REMOTE Supplier support laptop CONTROL CENTRE SCADA · historian · engineering INTERLOCKING SITE Object controllers · lineside SUBSTATION Traction power RTU · protection FLAT NETWORK STANDING VPN SL-T 2 SL-T 3 SL-T 2 LEVEL 3.5 · INDUSTRIAL DMZ Jump host · patch relay · historian replica ACCESS BROKER FR5 · RESTRICTED DATA FLOW FR1 · FR2 · BROKERED ACCESS
Zones, conduits, target security level per zone · IEC 62443-3-2

What is connected, what is exposed, what to fix first.

  • The estate mapped into zones, each with a target security level (IEC 62443-3-2)
  • The risks ranked by what they would do to operations
  • The network as built: how it is separated, where it would fail, who can get in remotely
  • The evidence pack for a NIS / CAF assessment
What an assessment delivers
Sectors

Rail, energy, oil and gas.

Core experience in rail. The same method and the same engineers on power, utility and process sites.

Core experience

Rail & Metro

Signalling data networks, operational telecoms, traction power SCADA, control centres, stations and depots. IEC 62443, NIS, CSM-RA.

What we do for rail

Energy, Oil & Gas

Substation and electrification SCADA, utility telemetry, terminals, pipelines and process plants. Segmentation, vendor access and network build around outages and turnarounds.

What we do for energy, oil and gas
The team

New to IPGS. Not new to critical networks.

110+years' combined experience
90+programmes delivered on
8engineers
4accreditations held

Who we are

How we work
  1. A zone gets a target security level before it gets a firewall.We decide how much protection each part of the network needs, to IEC 62443-3-2, before any control is chosen or bought.
  2. No change on a live network without a safety-case check and a rollback plan.Impact on the safety case and type approval is assessed first, and every change can be undone in the same window.
  3. No report without the bill of materials and the people to build it.Every assessment comes with a costed equipment list and the engineers to deliver it.

Discuss a requirement

Send the drawing, the audit finding or the project scope. An engineer will come back to you.

Contact us Capability statement