How to go about defending an ICS?

Looking at all these restrictions and requirements, one starts to appreciate the complexity of defending ICS networks. Implementing straight up IT security practices will not cut it as we just discovered. They are often too intrusive or just not feasible. So how do we go about securing the ICS?

One defensive strategy that has been used extensively for ICS networks is security by obscurity. The idea is that by hiding or obscuring the ICS network, an attacker will not be able to find the network, and one cannot attack what one cannot find. To a degree, this strategy actually worked when the ICS protocols and communication media were proprietary and restrive or limited in what they could achieve. As ICS networks converge and start using commonplace technologies and protocols like Ethernet and Internet Protocol (IP), they are becoming more open in nature and easier to discover. Earlier, a controller would sit on a production floor and the only way to communicate...