A Wide Area Network (WAN) is a communications system that covers a large geographic area, such as a city, a country, or even several countries or continents1. WANs are often used to connect local area networks (LANs) and other types of networks together, so that users and computers in one location can communicate with users and computers in other locations2. WANs use various communication infrastructures, such as public telephone lines, undersea cables, and communication satellites, to transmit data over long distances1. WANs are typically established with leased telecommunication circuits or less costly circuit switching or packet switching methods2. WANs are often built by Internet service providers, who provide connections from an organization's LAN to the Internet2. The Internet itself may be considered a WAN2. References: Hardware and network technologies - CCEA LAN and WAN - BBC, Wide area network
- Wikipedia.

The best practice for detection-in-depth according to ISA/IEC 62443 involves layering different types of security controls that operate effectively under multiple scenarios and across various zones within an environment. IDS (Intrusion Detection Systems) sensors deployed across multiple zones within a production environment exemplify this strategy. By positioning sensors in various strategic locations, organizations can monitor for anomalous activities and potential threats throughout their network, thus enhancing their ability to detect and respond to incidents before they escalate. This deployment aligns with the ISA/IEC 62443 focus on comprehensive coverage and redundancy in cybersecurity mechanisms, contrasting with relying solely on perimeter defenses or single-point security solutions.

Application whitelisting (AWL) is a technique that allows only authorized applications to run on a system, and blocks any unauthorized or malicious code from executing. AWL is one of the most effective methods for preventing malware infections and reducing the attack surface of a system. AWL can be implemented at different levels, such as the operating system, the network, or the application itself. AWL is especially useful forindustrial automation and control systems (IACS), which often run on legacy or proprietary platforms that are not compatible with traditional antivirus software or other security solutions. AWL can also help protect IACS from zero-day attacks, which exploit unknown vulnerabilities that have not been patched or detected by security vendors. AWL is recommended by the ISA/IEC 62443 standards as a key component of malicious code protection for IACS. According to the standards, AWL should be applied to all IACS components that support it, and should be configured and maintained according to the security policies and procedures of the organization. AWL should also be complemented by other security measures, such as network segmentation, zones and conduits, and patch management, to provide a defense-in-depth approach to IACS security. References:
* ISA/IEC 62443-3-3:2013, System security requirements and security levels, Section 5.2.3.41
* ISA/IEC 62443-2-1:2010, Establishing an industrial automation and control systems security program, Section 4.3.3.6.42
* ISA/IEC 62443-4-2:2019, Technical security requirements for IACS components, Section 4.2.3.43
* ISA/IEC 62443-3-2:2020, Security risk assessment for system design, Section 7.3.3.44
* ISA/IEC 62443-4-1:2018, Product development requirements, Section 5.2.3.45