Five Steps to Achieve Defense-in-Depth

Note: This is a sidebar to the January feature, "Practical Steps to Secure Industrial Networks."

Rockwell Automation’s Gregory Wilcox and Cisco Systems’ Paul Didier suggest these actions to get the operational process required to establish and maintain the security capability:

1. Identify the automation and control-system asset device types and locations within the plant-wide/site-wide network infrastructure.
2. Identify the potential and external vulnerabilities and threats to those assets—and assess the associated risks.
3. Understand application and functional requirements of automation and control-system assets, such as 24/7 operations, communication patterns, topology, required resiliency and traffic types.
4. Understand the associated risks of balancing the application needs and functional needs.
5. Understand and balance the requirements of the assets with the need to protect the availability, integrity and confidentiality of automation and control-system asset data.