## 1 Introduction  
Over the past decade, integration of security in Industrial Automation Systems (IAS) has changed from being a commodity to a necessity. This has occurred due to the new technological advances and trends that have resulted in increased standardization and interconnection of systems (e.g., Industry 4.0 [1]), which give rise to new threats and vulnerabilities that can be exploited in order to compromise the security of such systems [2; 3]. This security is comprised of a set of security policies and other security mechanisms that allow for enforcing such policies. These security policies represent a set of rules that indicate how a system is to be protected [4]. They may include but are not limited to authorized or unauthorized behaviour regarding physical security, user and network access control, etc. [5]. The security of a system is said to be compromised when its security policies have been violated or its security mechanisms have been bypassed. These events are often referred to as _intrusions_[6]. In order to diminish or counteract the effects that such intrusions may have on the target system, it is recommended to detect them as soon as they occur. Many security solutions exist that allow for carrying out such action (e.g., File Integrity Checkers, Antiviruses, Event and User Authorization Management Systems, etc.). However, the scope of protection of some of them is limited, as they may focus on specific system components. An example of this are File Integrity Checkers (FIC). FIC are capable of detecting only intrusions that occur at a file system-level. Other solutions such as Intrusion Detection Systems (IDS) provide a wider protection scope as they specialize in detecting intrusions at a network- and host-level. However, their response actions are often limited to passively notifying or recording that an intrusion has occurred rather than actively responding to it by either blocking, stopping or modifying it. These passive responses to intrusions often require further analysis or human intervention in order to counteract the effects of an intrusion [7], which results in delayed reactions. These delayed reactions may provide enough time for an intrusion to succeed. A successful intrusion is especially troublesome when dealing with critical systems such as industrial Cyber-Physical Systems (industrial CPS). These types of systems are automation systems comprised of a physical (i.e., control unit, sensors, actuators, etc.) and a cyber part (i.e., managing software) that allow the physical part to interact with the real world [8; 9]. Hence, passive responses may not be enough to protect these systems due to the catastrophic consequences that security intrusions may have on them. Some of these consequences may negatively affect the environment around these systems and pose a great risk to normal operation resulting in monetary losses, safety concerns or political repercussions [10; 11]. Hence, a security solution capable of not only detecting an intrusion but actively responding to it once it is detected in order to protect a system is often desired. Although there exist security solutions (e.g., Intrusion Prevention Systems, Intrusion Response Systems, Security Incident and Event Management System, etc.) capable of automatically and actively responding to intrusions, their integration in IAS is often overlooked. This has occurred due to the concern that some reactive actions in the presence of intrusions may affect the operational requirements of IAS [12; 13; 14]. This paper attempts to address this concern and overcome other challenges related to reactive protection that exist in IAS through the introduction of a novel reactive protection concept. This concept represents the main contribution of this paper. It is comprised of an architecture for a Reactive Protection System capable of executing active responses automatically in the presence of intrusions. The execution of these actions does not negatively influence the operation of the IAS due to the consideration of operational policies.