Industrial Cybersecurity

Defence-in-Depth

Defence-in-Depth is a cybersecurity strategy that applies multiple independent layers of protection throughout an Industrial Automation and Control System (IACS). Rather than relying on a single perimeter defence, security is implemented across the network, systems, users and operational processes.

The fundamental assumption is not if an attacker gains access, but when. Security is therefore designed to prevent attacks where possible, detect them quickly, slow attacker progression, minimise the impact of a successful compromise and enable rapid recovery.

Summary Diagram

defence-in-Depth Summary — Figure 1 - Defence-in-Depth Overview

Objectives

A successful defence-in-Depth strategy aims to:

Prevent cyber attacks wherever possible.
Detect attacks quickly.
Slow attacker progression.
Limit lateral movement.
Reduce the impact of successful attacks.
Enable rapid recovery of industrial operations.

Key Principle: No single security control is sufficient. Multiple independent and overlapping controls provide resilience against cyber threats.

Characteristics of defence-in-Depth

An effective defence-in-Depth strategy ensures that:

Multiple independent security layers protect the system.
The failure of one security control does not compromise the entire system.
Different security technologies complement one another.
Security controls exist at both the network and device level.
Protection is tailored according to system criticality and risk.

Defence-in-Depth is a risk-based approach, not a fixed architecture. Critical assets generally require additional layers of protection.

The Castle Analogy

Defence-in-Depth is commonly compared to defending a medieval castle. Each defensive layer provides an independent barrier that an attacker must overcome before reaching critical assets.

Castle Component	Cybersecurity Layer	Purpose
Moat	Perimeter Security	Firewalls, DMZs and filtered external communications.
Castle Walls	Network Segmentation	Zones and conduits limit lateral movement.
Drawbridge	Controlled Connectivity	Secure remote access and trusted communications.
Gate	Access Control	Authentication, MFA, RBAC and Least Privilege.
Watch Towers	Monitoring & Detection	IDS, SIEM and continuous monitoring.
Guards	People & Governance	Security awareness, procedures and incident response.
Inner Keep	Critical System Protection	Protect PLCs, DCS, SIS and HMIs through hardening and endpoint security.
Escape Tunnels	Backup & Recovery	Backups, disaster recovery and business continuity.

Layered firewall placement

Distribute security appliances so that compromise of one layer does not reach controllers immediately. Attacks may enter via the internet firewall and pivot from a business PC, or originate inside the plant (for example an infected engineering workstation or USB). Industrial protocol-aware firewalls closer to PLC, DCS and SCADA assets add inner layers.

Balance depth with risk: You can overdo firewalling. Extra appliances add cost, latency and points of failure. Hardening switches and routers with ACLs can support defence in depth for lower-risk boundaries, but do not rely on them alone where a dedicated firewall is warranted. Choose the sweet spot against risk appetite and return on investment — then implement with a proper firewall planning and lifecycle.

Typical defence-in-Depth Layers

1. Perimeter Security

Protects industrial networks from external threats before they reach operational systems.

Examples

Firewalls
Demilitarised Zones (DMZs)
Secure gateways
Virtual Private Networks (VPNs)

2. Network Segmentation

Divides the industrial network into secure zones connected by controlled conduits.

Benefits

Limits malware spread.
Restricts attacker movement.
Protects critical assets.

3. Access Control

Ensures only authorised users can access industrial systems.

Examples

Multi-Factor Authentication (MFA)
Role-Based Access Control (RBAC)
Least Privilege
Strong authentication

4. Critical System Protection

Protects devices directly responsible for controlling industrial processes.

Examples

PLC hardening
DCS security
Endpoint protection
Encryption
Application whitelisting

5. Monitoring & Detection

Provides visibility into abnormal activity and potential cyber incidents.

Examples

Intrusion Detection Systems (IDS)
Security Information and Event Management (SIEM)
Log monitoring
Network anomaly detection

6. People & Governance

Technology alone cannot secure an Industrial Automation and Control System.

Includes

Security awareness training.
Policies and procedures.
Incident response planning.
Change management.

7. Backup & Recovery

Ensures industrial operations can be restored following a cyber incident.

Includes

Configuration backups.
Disaster recovery.
Business continuity.
Incident recovery.

Engineering Perspective

defence-in-Depth should be implemented across multiple dimensions of an industrial control system.

Layer	Examples
Physical	Locked cabinets, fencing, CCTV and physical access control.
Network	Firewalls, VLANs, zones and conduits.
System	PLC hardening, endpoint protection, application whitelisting and patching.
Identity	MFA, RBAC and Least Privilege.
Operational	Procedures, change control and incident response.
Recovery	Backups, disaster recovery and business continuity.

Summary

defence-in-Depth recognises that no single security control can completely protect an Industrial Automation and Control System. Instead, multiple independent and complementary layers work together to prevent attacks, detect malicious activity, slow attacker progression and ensure industrial operations can be safely restored following an incident.

A successful cyberattack should require an attacker to bypass multiple independent security layers rather than exploiting a single weakness.

For a physical-and-cyber treatment model organised as Deter, Detect, Delay, Deny and Defeat, see Five Ds of Treating Risk.