Security should be implemented at all layers of the control
network, with each layer further isolating subsequent layers
from external threats. Such an approach is referred to as
‘defense in depth’, with the most critical equipment being the
most protected [1]. Such a layered network implementation is
shown in Figure 5.
The outermost layer of security should prevent unauthorised
access to the network itself from external sources. In the
past this was trivial, as industrial networks were generally
stand-alone systems. The growing amount of integration with
business networks has made this a much more complex
requirement. Plant data might be required by engineers or
other employees working on the business network, information
concerning the plant may be needed at other plants or at central
locations and vendors may need dedicated remote access to
assist with troubleshooting.