Registered OT security audit firmNational CERT Pakistan, Category I
OT and ICS securityfor plants that must keep running.
We help critical infrastructure operators protect their industrial automation and control systems against threats that keep changing, to the standards auditors recognize. The plants we work in generate power, move oil and gas, and make the fertilizers farms depend on. Keeping them running is the point.
- Process engineering since
- 2005
- OT security since
- 2018
- OT security engagements
- 20+
Our clients
Trusted across Pakistan's process industries and critical infrastructure.
Our clients include fertilizer and chemical producers, oil and gas companies, power generators and terminal operators.
Registered with PKCERT
Category I OT security audit firm
Engro Fertilizers
Engro Polymer & Chemicals
Engro Powergen Thar
Engro Vopak Terminal
Fatima Fertilizer
Fauji Fertilizer Bin Qasim
Fauji Fertilizer Company
Pak-Arab Refinery (PARCO)
Pakarab Fertilizers
Pakhtunkhwa Energy Development Organization
Sui Northern Gas Pipelines
UCH Power
How we work
From assessment to ongoing support
Each engagement follows the same four stages, because each stage builds on the one before it.
- 01
Assess
No scans that could disturb a controller
Identify where your control systems are exposed, measured against IEC 62443 and any regulations that apply to you, such as NEPRA.
Gap assessment - 02
Design
Zones and conduits on the Purdue model
Design a zone and conduit architecture based on the Purdue model, suited to the way your plant operates.
Network architecture design - 03
Deploy
Installed while the plant stays in operation
Install and configure firewalls, data diodes, endpoint protection and passive monitoring while the plant stays in operation.
Our solutions - 04
Sustain
Maintained after the project ends
Put governance, patching and incident response in place, so that security is maintained after the project ends.
Governance and CSMS
Stage 01
Assess
Identify where your control systems are exposed, measured against IEC 62443 and any regulations that apply to you, such as NEPRA.
Gap assessmentStage 02
Design
Design a zone and conduit architecture based on the Purdue model, suited to the way your plant operates.
Network architecture designStage 03
Deploy
Install and configure firewalls, data diodes, endpoint protection and passive monitoring while the plant stays in operation.
Our solutionsStage 04
Sustain
Put governance, patching and incident response in place, so that security is maintained after the project ends.
Governance and CSMSIndustries we serve
Six industrial sectors each with its own systems and risks
Plants in different sectors run different control systems, and the cost of downtime varies from one to the next.
Power Utilities
Power generation and utility assets, where availability is critical and regulators such as NEPRA set cybersecurity requirements.
Typical systems
- A DCS controlling generation
- Turbine and boiler control, often from a different vendor than the DCS
- SCADA at the grid interface
- Historians used for regulatory reporting
Oil and Gas
Refinery control systems and remote telemetry networks, where safety and availability come first.
Typical systems
- Refinery DCS and safety systems
- RTUs and telemetry along the pipeline
- Metering and custody transfer
- SCADA bringing the data back to a central control room
Fertilizers
Continuous process plants run on distributed control systems, with historians holding years of operating data.
Typical systems
- A DCS across the ammonia and urea trains
- Compressor and turbine control
- Historians used for production reporting
- PLCs on bagging and packing lines
Chemicals
Process plants where an unplanned stop has safety consequences as well as commercial ones.
Typical systems
- A DCS running continuous and batch units
- Safety instrumented systems with their own logic solvers
- Recipe and batch management
- Historians and laboratory information systems
Manufacturing
PLC-controlled production lines, secured without stopping production and with regular contractor and vendor access.
Typical systems
- PLC-controlled production lines
- SCADA supervision of the production floor
- MES and ERP connections to the business
- Robotic cells and vision systems
Ports and Terminals
Automated terminal and bulk handling systems, with frequent access from third parties.
Typical systems
- Terminal automation and tank gauging
- Loading arms, pumps and metering
- Crane, gate and weighbridge systems
- Connections to shipping and customs systems
Why PhiSecure
OT security specialists with a process engineering background
Four reasons industrial operators work with us.
- OT practice since2018Dedicated to OT security. Our practice works only on industrial control systems and the plants that depend on them.About PhiSecure
- Delivered againstIEC 62443Based on recognized standards. Our work is delivered against IEC 62443, NIST SP 800-82 or NEPRA, so every finding can be traced to a published requirement.Our services
- Process engineering since2005Process engineering experience. Built on the process engineering background of Phi Tech Solutions. We consider the cost of a shutdown before recommending any change that could cause one.About PhiSecure
- Partners11Vendor neutral. We recommend the technology that suits your plant and are not tied to a single product line.Our partners
Before you get in touch
Questions worth asking and how we answer them
Will you need to shut anything down?
Our assessment work does not change or interrupt any running system, and we do not run scans that could disturb a controller. The plant keeps running while we work.
Do you push a particular brand?
We work with eleven technology suppliers and recommend what suits your plant. Nothing is bought until the design shows what you need and why, and the choice of product stays with you.
Which standards do you work to?
IEC 62443 and NIST SP 800-82. For power generation and utilities, we also work to NEPRA’s cybersecurity guidelines. Every finding points back to a published requirement, so you can check it yourself.
Could your software cause problems on our HMIs?
Ordinary office antivirus can. We use protection built for control systems, and check it against your control system vendor’s support requirements before anything is installed.
Who sees the findings?
We do not report findings to anyone else. They are yours to use whether or not you work with us afterwards.
Are you registered for this work?
Yes. Phi Tech Solutions, the company PhiSecure belongs to, is registered with PKCERT, the National Cyber Emergency Response Team of Pakistan, as a Category I OT security audit firm.