The following factors must be taken into account when implementing a defence-in-depth concept in an ICS • The cost of securing legacy systems according to contemporary needs • The growing trend of connecting ICS with business networks • The ability to offer users remote access, in both the ICT and ICS environments • The need to trust the business’s own supply chain • Modern methods of monitoring and protecting ICS-specific protocols • The ability to stay up to date on intelligence about emerging threats to ICS. The defence-in-depth approach makes it more difficult to conduct direct attacks on ICT systems, and makes it more likely that conspicuous or unusual behaviour within the system will be detected at an early stage. This approach also makes it possible to create separate zones in which to implement intrusion detection technology. Table 2 shows the typical elements of a defence-in-depth strategy. Elements of a defence-in-depth strategy Risk management programme • Identify security threats • Risk profile • Detailed management of ICT asset inventory Cybersecurity architecture • Standards/recommendations • Policy • Procedures Physical security • Protection for field devices • Control centre access controls • Video surveillance, access controls & barriers Network architecture • Typical secure zones • Demilitarised zones (DMZ) • Virtual LANs Network perimeter security • Firewalls • Remote access & authentication • Jump servers/hosts Host security • Patch and vulnerability management • Field devices • Virtual machines Security monitoring • Intrusion detection systems • Security audit logging • Security incident and event monitoring Vendor management • Supply chain monitoring & management • Managed services & outsourcing • Use of cloud services The human element • Policy • Procedures • Training and awareness Table 2: Elements of a defence-in-depth strategy Minimum ICT standard 2018 8