Phi Tech Solutions

Engineering for process plants since 2005

phitech.com.pk (opens in a new tab)

Process engineering, process control and OT security, in one company.

Phi Tech Solutions has worked in process plants since 2005. PhiSecure is its OT cybersecurity practice, working alongside the company's process engineering, process control and reliability teams.

Visit phitech.com.pk (opens in a new tab)
A wall mounted media scanning station in a plant corridor, with a shelf of USB drives beside it and a hand presenting a drive to the reader

Plant entrances

Removable Media Sanitization

USB drives are still one of the most common ways malware reaches a control network. They do not arrive over the network. They are carried in by staff and contractors and plugged directly into plant computers.

Talk to us about media controlAll five solutions

What it protects

  1. L4Enterprise network
  2. L3.5DMZ
  3. L3Operations
  4. L2Supervisory
  5. L1Control
  6. L0Process
1.0

What we install

We install a scanning station at each entrance and apply device control on plant computers, so that unscanned drives cannot be used. Each drive is checked at the entrance, and only a clean medium issued by the station is taken into the plant.

What is included

  • Scanning and decontamination stations at the entrances people use
  • A clean transfer medium issued after scanning, so the visitor’s drive goes no further
  • A written procedure that contractors can follow without training
  • Device control on plant computers, so unscanned drives are blocked
  • A record of what was scanned, what was found and what was refused
2.0

Where it sits

  1. L4Enterprise networkBusiness systems, email, the internet
  2. L3.5DMZBetween the plant and the business
  3. L3OperationsHistorians, domain services, engineering
  4. L2SupervisoryWhat it protects
  5. L1ControlWhat it protects
  6. L0ProcessInstruments and final elements

This solution is not installed at any of these levels. It is placed at the plant entrances and protects the equipment that a drive could otherwise be plugged into.

3.0

How it is installed

The steps we follow

  1. 01

    We walk the site to identify the entrances people use, which may differ from those on the drawings.

  2. 02

    The procedure is written with your team, including what happens when a drive is refused.

  3. 03

    Stations are installed and tested at the entrances, with no changes to the control network.

  4. 04

    Device control is applied to plant computers, after approval from your control system vendor.

  5. 05

    Your staff and regular contractors are shown the procedure before it goes live.

4.0

What this solution is not

  • Not a ban on removable media.

    Bans that stop work tend to be ignored. This solution makes the approved route the easiest one.

  • Not only a technical control.

    The scanning station is one part. The other is a procedure that contractors can follow, written together with your team.

Related links