Designing for security
In the previous section, we saw how industrial network architecture and the (inherent) insecurity associated with certain design decisions evolved over time. I am not trying to generalize every ICS owner, but in my experience, the bulk of them will have the Swiss-cheese architecture in place in some shape or form. I have worked with companies that implemented a far more secure architecture and I have also seen some that implemented way less, but typically this is what you find out there.
In this section, we will be exploring the proper process and methodologies around designing a security-focused and resilient industrial network architecture that incorporates cybersecurity right from the start as a foundational design goal and allows for expanding on our cybersecurity efforts in the future.
Network architecture with security in mind
I typically explain the design and implementation of industrial cybersecurity as the process of shielding off the most...