## 9 Conclusions and Future Work  
Passive responses in the presence of intrusions are predominant in the field of security solutions for IAS due to the concerns that exist that reactive responses may negatively affect the operation of the automation system. This often requires that any reactive countermeasure be carried out by a human, which results in delayed responses. This increases the vulnerability of the system and provides a window of opportunity for the intrusion to succeed and hence negatively influence the system. In this paper, a concept for a system that allows for reactively and automatically responding to intrusions is presented. This concept addresses the aforementioned concerns, which results in a suitable and feasible reactive protection alternative for IAS. This concept was first conceived by identifying four requirements related to intrusion prevention solutions and other architectural and security trends for industrial systems. From these requirements, the foundation for the presented concept was laid out. This foundation is comprised of security and operational policies, as well as reactive actions that can potentially counteract intrusions. The system resulting from this concept is capable of analyzing security events received from other system components (e.g., third-party security solutions). These events are analyzed in order to identify security policy violations. Once a policy violation has been detected, an appropriate reactive action is selected. Before the execution or triggering of such action, the operational policies are validated. This ensures that only reactive actions that do not violate the operational policies of the underlying automation system are carried out. This means that, as long as the defined security and operational policies represent the true requirements and constraints of the automation system, the reactive actions will not negatively affect it. Furthermore, it is important to highlight that the scope of protection provided by the presented concept allows for protecting the automation system and its components at a network segment-level. This complies with current architectural and security trends of IAS. Moreover, the presented concept provided guidelines that can be followed in order to identify security policies, reactive actions and components to execute these actions. The application of these guidelines and concept was illustrated with a reference IAS architecture and application, and a set of example security policies and reactive actions that highlighted the potential of the presented concept. Additionally, the evaluation of the presented concept was performed as followed. First, a prototypical Reactive Protection System was implemented. In order to test its feasibility and applicability, a real-life scenario was defined, from which use cases were derived. These use case scenarios were emulated with a test setup where the prototype was deployed. Afterwards, to further support the evaluation of feasibility, four hypotheses were derived and proven. These hypotheses allowed for verifying that the requirements presented in Section 3 were fulfilled. The results of these evaluations have shown that the presented concept is suitable and feasible for IAS. Future work will focus on the improvement of the prototypical implementation. This includes extending the capabilities by allowing remote configuration of the Reactive Protection System and enriching the security and operational policies knowledge base. Another important aspect is to further enhance the interoperability with other security solutions, which will allow for adding support for more reactive protection actions (e.g., add new firewall rules). Furthermore, alternatives to improve the usability of the configuration for security and operational policies will be researched. Currently, the configuration of security and operational policies has to be manually carried out by a human operator with knowledge regarding the operation of the automation system and its security.