# Design of Platforms for Experimentation in Industrial Cybersecurity
## 1 Introduction  
The current digital transformation is changing industry in terms of flexibility, management or scalability. The growing connectivity leads to a progressive incorporation of information technologies (IT) into the field of operational technology (OT), whose elements used to be isolated. This IT/OT convergence exposes control systems to more threats that exploit both typical IT vulnerabilities and specific ones [1]. Nevertheless, industrial control systems usually have different requirements than other information systems. Unlike most information systems, availability of information in a control system is a more critical requirement than integrity and confidentiality for an effective operation. The direct use of traditional security solutions might cause production stops or larger response times that are not acceptable [2]. Moreover, long-term deployments use specific outdated technology that disregards the most essential security measures. However, cybersecurity becomes essential for control processes included in critical infrastructures, where a disruption of their services can cause serious damages to environment, human lives, or economy. Given the importance of these services, critical infrastructures are strategical targets for cyber-attacks from several sources such as saboteurs or other nations, with a great level of sophistication. Furthermore, critical infrastructures often possess interdependence relationships between them [3], e.g., cyber-physical dependence (when one requires resources from other), geographical or logical. This interdependence could produce cascading effects as a result of an incident. For this reason, research efforts have been focused on critical infrastructure protection [4, 5], joining efforts of several entities such as government and institutions to make them more resilient. Indeed, the governments enact laws concerned about the security of these facilities, such as the directive 114/08/EC \"_on the identification and designation of European Critical Infrastructures (ECI) and the assessment of the need to improve their protection_\" of the European Commission. Efforts are made to propose effective security frameworks focused on ICS, such as those proposed by the National Institute of Standards and Technology. Standards such as ISA/IEC 62443 (formerly ISA99) provide useful guidelines for the secure implementation and operation industrial control systems (ICS). Furthermore, the Industrial Control System Cyber Emergency Response Teams from countries and/or manufacturers provide information about threats through different reports and training programs. Although security practices developed in the IT field in the last few decades should be taken as a starting point for developing solutions, the particularities of control systems should be considered for its successful application [6]. That is why increasing efforts have been made lately to create industrial-oriented testbeds, where researchers can perform experiments safely and evaluate security-related experiments in similar scenarios to those ones found in critical infrastructures [7]. Furthermore, these environments are also necessary for industrial cybersecurity training in critical infrastructures because of a lack of professionals with the related skills [8]. However, there is not a methodology established for their design because of the difficulty for integrating realistically the cyber and physical aspects and their interconnections. This challenge requires further experimental work in realistic environments in order to achieve fidelity. For mentioned reasons, in this paper, design guidelines for experimentation in cybersecurity of control systems are proposed. The approach is based on several principles such as network reconfigurability, modularity, and integration of virtualized computer systems with real equipment covering technologies used in different levels of automation.