The increasing networking of Industrial Control Systems (ICS) requires effective security measures. To still be able to influence the design of automation systems, security measures must be defined early enough during the ICS engineering workflow, which is often called "security by design". This paper presents existing security by design approaches for ICS and clusters them with respect to how they integrate security into existing engineering workflows. Because one major shortcoming of existing approaches is their dependence on the existing engineering workflow, an improved security by design integration mechanism is proposed, where "security decision points" can be integrated flexibly into any ICS engineering workflow.