## 6 Reactive Protection System Applicability
### Integration in Industrial Automation Systems  
In order to demonstrate how the Reactive Protection System can be integrated into an IAS, the IAS reference architecture (Figure 1) has been modified and extended (Figure 4) in order to integrate security components and architectural schemes commonly used for industrial networks. Figure 4: Extended Reference IAS Architecture (Figure 1) with remote access and security components. An Intrusion Detection and Prevention System (IDPS) has been integrated into the Enterprise Network (Level 4). This IDPS allows for monitoring this network in order to identify intrusions occurring at this level. On the other hand, an Industrial Network IDS has been integrated in the Industrial Control Network (Levels 1, 2 and 3). This Industrial Network IDS consists of a centralized platform located in the Operational and Control Network that analyzes information provided by sensors located at lower levels (i.e., Supervisory and Control Networks). The Field and Control Networks have been divided into two remote stations. This has occurred in order to represent a distributed IAS. Moreover, an Industrial Gateway (also known as IoT Gateway) has been deployed in each of these remote stations. Industrial Gateways are a new trend in IAS that has been gaining popularity over the past years [51; 52; 53]. They are devices that allow for _\"establishing and maintaining a secure, robust, fault-tolerant connection between the cloud, and the edge devices to collect and aggregate device data and to manage the device\"_[54]. These devices may also provide extended capabilities depending on their manufacturer. A Remote Access Point for the Supervisory and Control Networks has been integrated. This occurs as remote service access is a common application in IAS, especially in distributed IAS. Examples of this are the following: remote software updates [55], remote patch management and maintenance [21], remote programming, parametrization, monitoring and diagnosis [20; 56], etc. An abstract Communication Network represents the communication between the remote stations, the Supervisory Network and the Remote Access Peer. This Communication Network can be any of the following: the Internet, a Wide Area Network (WAN), a Local Area Network (LAN), etc. Finally, a Reactive Protection System is located in each network zone at the Control and Supervisory Levels (i.e., Levels 1 and 2). As discussed in Section 5, the Reactive Protection Systems receive security-related events from third-party security components located in the IAS. These events may refer to an intrusion or another security violation. After a Reactive Protection System receives a security-related event, it analyzes it in order to verify whether or not a segment security policy for its corresponding network zone was violated. If a security policy violation occurred, it verifies whether or not a reactive action is possible (i.e., is supported by the Reactive Protection System and does not violate any of its zone operational policies). If a reactive action is possible, then it executes it or provides the necessary information to a third-party security component. The third-party security components that may provide security-related events information to the Reactive Protection System or that may execute reactive action in the extended IAS architecture are the following: SIEM, IDPS Platform, Industrial IDS Platform, Industrial Gateway or Firewalls. More security components can be embedded in other IAS devices such as Engineering Workstations; however, they are neglected in this architecture in order to provide more clarity and simplicity for discussion. An example of an interaction between a Reactive Protection System and third-party security components is the following: the Industrial IDS has detected abnormal behaviour in the Remote Station 1 communication which it notifies to the Reactive Protection System located at the Remote Station 1. This Reactive Protection System contains a security policy with a supported reactive action that handles such event.