Phi Tech Solutions

Engineering for process plants since 2005

phitech.com.pk (opens in a new tab)

Process engineering, process control and OT security, in one company.

Phi Tech Solutions has worked in process plants since 2005. PhiSecure is its OT cybersecurity practice, working alongside the company's process engineering, process control and reliability teams.

Visit phitech.com.pk (opens in a new tab)
An engineer at a control desk working at a screen, with a curved wall of network diagrams and trend displays filling the room behind him

Mirror port

Network Visibility and Monitoring

No list of entry routes into a plant network is complete. The routes that matter are often the forgotten ones, such as a modem left in a cabinet, a laptop that stayed connected or a link added for a good reason and never documented.

Talk to us about monitoringAll five solutions

What it monitors

  1. L4Enterprise network
  2. L3.5DMZ
  3. L3Operations
  4. L2Supervisory
  5. L1Control
  6. L0Process
1.0

What we install

We install a passive sensor that reads a copy of the network traffic from a mirror port. It builds an inventory of the devices on the network, learns its normal traffic and alerts your team to changes. It sends nothing onto the network and cannot stop the process.

What is included

  • Passive sensors on a mirror port or tap, never in the process path
  • An asset inventory based on what is on the network, not on the drawings
  • Protocol-level visibility, so changes to controllers can be identified
  • Alerts tuned to your plant
  • A definition of normal activity, agreed with your operations staff
2.0

Where it sits

  1. L4Enterprise networkBusiness systems, email, the internet
  2. L3.5DMZBetween the plant and the business
  3. L3OperationsWhat it monitors
  4. L2SupervisoryWhat it monitors
  5. L1ControlPLC and DCS controllers, safety systems
  6. L0ProcessInstruments and final elements

The sensor monitors traffic at L2 and L3 through a mirror port. It is not placed at either level, so it cannot affect them.

3.0

How it is installed

The steps we follow

  1. 01

    We agree the mirror port locations with your network engineer, using existing switches.

  2. 02

    The sensor is connected and monitors traffic. Nothing is sent onto the network.

  3. 03

    The inventory it builds is compared with what your team expects to be there, and any differences are investigated.

  4. 04

    Normal activity is defined with your operations staff, so alerts match your process.

  5. 05

    Before handover, your team is trained to read the alerts and respond to each type.

4.0

What this solution is not

  • Not a firewall.

    It detects and reports activity. It does not block traffic, and it is not placed where it could.

  • Not an instant result.

    The first output is an inventory of your network. Detection improves as the system learns your normal traffic.

Related links