The Purdue Model in Practice Versus on Paper

The Purdue model is a layered way to describe an industrial network, from the process at Level 0 up to the enterprise at Level 5. Real plants blur it. The fix that follows the model is an industrial DMZ at Level 3.5, with nothing on the business side opening a session into the plant.

The levels, briefly. Level 0 is sensors and actuators. Level 1 is controllers such as PLCs and RTUs. Level 2 is supervision, meaning HMIs, SCADA, and engineering workstations. Level 3 is operations management, including historians, batch, and MES. Level 4 is site business systems, and Level 5 is the enterprise. The free OT course walks through each one.

Where plants blur the levels

Paper diagrams show clean layers. Sites show things like these.

1. One flat network carries Level 1 through Level 3, so the historian and the PLCs share a broadcast domain.
2. The engineering workstation is also the vendor’s remote access point and somebody’s email machine.
3. An MES or reporting server reads PLC tags directly from Level 3 and is also reachable from the business network.
4. A cellular router or wireless link connects a remote station straight to a cloud portal, skipping every level.
5. Smart drives, cameras, and meters on the plant network have web interfaces and run firmware nobody tracks.
6. A single firewall holds the business and the plant on two interfaces with a broad allow rule between them.

None of this is unusual, and it does not mean the model is wrong. It means the model describes intent, and the plant has a history.

What the Level 3.5 iDMZ does

The industrial DMZ is a controlled network between Level 3 and Level 4. It was not in the original model. It is where the brokered services live.

The rule is that no session crosses it end to end. The business side connects in, the plant side connects out, and the DMZ host terminates both. A compromise of the business network lands in the DMZ rather than at the controllers. For the access side of this, see Vendor remote access to OT without the forgotten VPN.

Why the blur matters

Each blurred level is a path a mistake or an attacker can use. A shared engineering workstation means one phished mailbox can reach the programming tools. A flat Level 1 to Level 3 network means a heavy historian query can load the same switch that carries controller traffic. Neither needs a sophisticated attacker, only an ordinary bad day. Naming the blur is how you decide which one to fix before the next outage window.

What to fix first

Order matters, because some fixes make the next one possible.

1. Inventory the devices, passively. See Building an OT asset inventory without active scanning.
2. Find every path between the business network and the plant, including modems and vendor tunnels.
3. Replace those paths with a DMZ. Even a small one beats a direct allow rule.
4. Separate the engineering workstation from general use.
5. Split Level 1 from Levels 2 and 3 with a firewall that knows the protocols in use.
6. Add passive monitoring so you notice what changes.

Use zones and conduits to finish the job

Purdue tells you the layers. IEC 62443-3-2 tells you how to group assets into zones and name the conduits between them, including those that do not fit a layer, such as the cellular link. A worked small-site version is in IEC 62443 zones and conduits for a small plant.

Do not redraw the whole network on paper before changing anything. A plant that moves its vendor access and historian copy into a DMZ has improved more than one that has a perfect diagram and the same flat network.

The broader controls are covered in Security controls for OT networks that hold up in production. See also industrial OT networks, the OT and IT convergence advisory, and the training course Hardening Control Networks.

If you want your site reviewed against this list, see /book/.