## 6 Reactive Protection System Applicability
### Reactive Actions in the Presence of Intrusions  
From the aforementioned security policies and intrusions (Tables 3 and 4), it is known that security-related event information analyzed by the Reactive Protection System can be provided by third-party components. Similarly, the Reactive Protection System can provide information to these components in order to execute the reactive actions required by each security policy.  
In order to mitigate and counteract the intrusions presented in Table 4 ((i.e., _II-II0_), fifteen possible reactive actions have been derived. These reactive actions have been derived from the literature review performed in Section 4, the guidelines presented in Section 5.3.3 and the empirical knowledge of the third-party security components outlined in Figure 4.  
Table 5 presents these reactive actions, their corresponding third-party security components capable of executing them and the intrusions that each of them help counteract or mitigate. It is important to highlight that these reactive actions are executed according to the security and operational policies of the Reactive Protection System. An action is executed only if a security policy has been violated, it has an associated reactive action and this action does not violate an operational policy.  
Brute Force attacks, misuses caused by users and communication sessions (i.e., _I4_ and _I8_) can be mitigated by a User Management System. This system may block a user account, revoke its privileges or lock a session (i.e., _RA1_, _RA2_ and _RA3_). An application server can also lock or block a session. After  
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \hline  & \multicolumn{6}{c}{**Reactive Actions**} & \multicolumn{6}{c}{**Intrusions**} \\ \hline
**Class** & **\#** & **Description** & **Device** & **II** & **I2** & **I3** & **I4** & **I5** & **I6** & **I7** & **I8** & **19** & **I10** \\ \hline A1 & RA1 & \
\begin{tabular}{c} (Temporarily) block User \\ Account \\ \end{tabular} &
\begin{tabular}{c} \\ User \\ Management \\ \end{the Reactive Protection System has performed any of these actions, it may be necessary for a human to analyze whether or not it is required to undo these changes (i.e., unblocking a user).  
Traffic redirection and Rate Limiting (i.e., _RA5_ and _RA6_) supported by some IDS, Firewalls and Application Servers help mitigate intrusions that increase the network rate (i.e _I1_, _I2_, _I3_ and _I4_). This is especially important in IAS, as real-time capabilities may be affected by high network traffic on ethernet-based networks.  
Antiviruses, Routers, Firewalls, Network IDS and event management systems (_RA8_, _RA9_ and _RA10_) for both the enterprise and industrial network may provide audit and scanning capabilities that help analyze system components in more detail. This is especially useful in the presence of Malware and Brute Force Attacks (_I5_ and _I4_) in order to verify whether the intrusion has succeeded and, in case it has, verify whether or not it has spread or achieved its goal (i.e., compromised a system component).  
Industrial Network IDS may also provide capabilities to perform a back up of- and restore configurations (i.e., _RA11_) specific to IAS components. This may help remove malicious software (i.e., _I5_ and _I7_) or correct misconfigurations (i.e., _I10_). Other misconfigurations on the host device _I10_ can be remedied by software of the host device itself (e.g., _RA14_) or by log and event management systems (i.e., _RA15_).  
Finally, Firewalls and VPN Endpoints (i.e., _RA4_ and _RA7_) also are capable of mitigating intrusions related to communication (i.e., _I1_, _I2_, _I3_ and _I4_). They are also capable of protecting IAS components (i.e., _I7_ and _I8_), as they are widely used in the industry (as observed in Figure 4).