By nature ICS are very defendable. Because ICS systems tend to be stagnant in configuration it is easier to detect anomalies. For example, it is relatively easy to establish a standard traffic pattern on a controls network and start looking for deviations from normal. Also, because ICS don't change very often, the environment they are in is easier to secure. An example to that point is that a PLC can be placed in a locked cabinet with it's program locked into run mode, because once a PLC is running changes are hardly ever necessary. If changes are needed, a change control program should secure the proper management of those changes.
So on one hand an ICS is horribly defenseless because restrictions and requirements ...
