## 8 Evaluation of Feasibility and Applicability of the Reactive Protection Concept
### Hypotheses
Neglecting or overlooking either of them may result in decreased protection against intrusions or it could also negatively affect the main operational requirements of the automation system. During the discussion of evaluation of the use case scenarios, the possible effects of such event were observed with _Use Case 1_, _Use Case 2_ and _Use Case 3_. Hence, the hypothesis that appropriate definition of security and operational policies ensures that reactive actions do not negatively influence the correct operation of the automation system is proven to be true. **Hypothesis 3**. : _Reactive security measures, as opposed to only passive, can be executed automatically to help counteract possible intrusions in IAS._  
As previously discussed in Section 3, common responses in the presence of intrusions are passive. Any active countermeasure is often carried out by a human expert, which results in delayed responses. In order to address this issue (i.e., fulfill \(R1\)), the presented concept derived a set of reactive actions (i.e., Sections 5 and 6) that provide active protection for automation systems in the presence of intrusions. These reactive actions are automated through the configuration and harmonization of security and operational policies. Although at first human effort is required for their configuration, once the Reactive Protection System is deployed; no other human intervention is necessary as long as the policies remain suitable for the requirements of the automation system--hence automating their execution. This was demonstrated in _Use Case 3_, where the VPN Connection is automatically terminated--hence proving this hypothesis to be true. **Hypothesis 4**. : _Implementation of a Reactive Protection System on a network segment-basis improves the security and reliability of IAS._From the analysis of current architectural and security trends in IAS (Sections 1 and 3), it was observed that network segmentation is widely used in IAS. This occurs as network segmentation allows for facilitating the management of system components, as well as improving the security of the system. These improvements are achieved by allowing to group system components into zones based on their security requirements and other requirements derived from their design and operation. The concept presented in this work exploits these advantages by considering also the network segmentation approach in order to provide protection against intrusions. This is performed by first deriving security policies from the ISA/IEC 62443 series of Standards (i.e., hence fulfilling _R2_ from Section 3). Afterwards, it suggests the deployment of a Reactive Protection System whose knowledge base is built from security and operational policies that apply to a specific network segment and its system components. It also presents a set of reactive protection actions capable of protecting the corresponding network segment. These reactive actions may be capable of the disrupting of counteracting intrusions, which in return may increase the security of the automation system. A system with high and effective security decreases the chances of intrusions being able to disrupt its normal behaviour--hence improving its reliability. Furthermore, the presented concept also allows interoperability with preexisting security solutions. This is performed through the reception and analysis of security events from third-party components (i.e., fulfilling _R2_ from Section 3). This concept does not depend on any specific event format or protocol. Hence, implementations from this concept have flexibility when choosing them. This has been demonstrated with the prototypical Reactive Protection System implemented in this work (Section 7). Hence, the hypothesis that following a network segment approach for reactive protection increases the security and reliability of IAS is proven to be true.