Purdue Model

The model partitions the industrial network into six distinct levels (0 through 5), with a critical air-gapped or firewalled DMZ separating the OT domain (Levels 0-3) from the IT domain (Levels 4-5). This segmentation ensures that a compromise in the corporate network cannot directly propagate to safety-critical physical controllers.

• Level 0: Physical process (sensors, actuators, motors)
• Level 1: Basic control (PLCs, RTUs, VFDs)
• Level 2: Area supervisory control (HMI, SCADA)
• Level 3: Site manufacturing operations (MES, Historian)
• Level 3.5: Industrial Demilitarized Zone (IDMZ)
• Level 4: Business logistics (ERP, CRM)
• Level 5: Enterprise network (Cloud, Internet)

Level 3.5, the IDMZ, acts as a buffer zone between OT and IT. No direct communication is permitted between Level 4/5 and Level 0-3. All data exchange must terminate in the IDMZ using intermediary servers and reverse proxies. This prevents external actors from establishing direct TCP sessions with PLCs.

• Core Function: Breaks direct IP routing between IT and OT
• Key Services: Patch management servers, AV servers, remote jump hosts, and mirrored historians
• Security Posture: Implements strict ingress/egress filtering and deep packet inspection

The Purdue Model enforces a unidirectional data flow principle. Data originates at the physical process (Level 0) and flows upward through aggregation and contextualization layers to the enterprise (Level 4/5). Control commands flow downward but must traverse strict authorization checkpoints at each boundary.

• Southbound: Control commands (high risk, heavily restricted)
• Northbound: Telemetry and status data (low risk, continuous streaming)
• Enforcement: Physical data diodes are often deployed between Level 3 and Level 4 to guarantee unidirectional traffic for the most critical assets

The Purdue Model is intrinsically linked to the IEC 62443 cybersecurity standard. Each Purdue Level is treated as a distinct security zone with specific risk profiles and protection requirements. Conduits are the controlled communication channels between zones.

• Zone Properties: Each zone has defined security policies, asset inventories, and risk assessments
• Conduit Controls: Firewalls, intrusion detection systems (IDS), and application-layer gateways manage traffic between zones
• Critical Rule: A conduit connecting a high-security zone (Level 0) to a lower-security zone (Level 3) must never allow the lower zone to initiate a connection

While the physical Purdue Model remains foundational, modern Software-Defined Manufacturing is evolving it into a logical architecture. Virtualized controllers and edge computing nodes collapse traditional hardware layers, requiring micro-segmentation and identity-aware proxies to enforce the same hierarchical security principles in software.

• Challenge: Virtual PLCs at the edge blur the lines between Level 1 and Level 2
• Solution: Policy-driven network overlays that enforce Purdue-level security zones based on device identity and application fingerprint, not just IP address
• Outcome: A dynamic, zero-trust Purdue Model that adapts to containerized workloads and cloud-based SCADA

The core security principle of the Purdue Model. It divides the network into isolated zones and conduits to limit the lateral movement of threats and contain breaches.

• Zones: Logical groupings of assets with similar security requirements (e.g., all PLCs on Level 1).
• Conduits: The strictly controlled communication paths between zones, secured by firewalls and managed switches.
• Defense-in-Depth: A breach in the enterprise web server (Level 4) cannot directly access a safety controller (Level 1).