The Purdue Model and Network Segmentation

The Purdue Enterprise Reference Architecture (often just called 'the Purdue model') is the classic mental map for organizing an industrial network into layers, and even where a real network does not match it perfectly, it is still the fastest way to reason about where an attack would have to travel to reach something that matters. At the top, Level 5/4 is the enterprise IT network -- email, ERP, general business systems. Level 3 is operations management -- historians, MES systems, engineering workstations that coordinate across the plant but are not directly controlling equipment. Level 2 is supervisory control -- HMIs and SCADA servers that operators actually watch and interact with. Level 1 is basic control -- the PLCs and RTUs directly issuing commands to field equipment. Level 0 is the physical process itself -- sensors, actuators, motors, valves. The security logic of this model is simple: the deeper an attacker has to travel from Level 5 toward Level 0, the more segmentation boundaries, monitoring, and friction they should encounter, because the consequence of compromise increases as you get closer to the physical process. A well-segmented environment does not just have a single firewall between 'IT' and 'OT' -- it has a demilitarized zone (the famous 'Level 3.5 DMZ') that mediates all traffic between the two, with no direct path from the enterprise network straight into Level 1 or 2. Modern architectures increasingly use IEC 62443's zones and conduits alongside or instead of a strict Purdue layer count, especially for distributed environments like substations or pump stations that do not map neatly onto a single-site factory model. But the underlying principle survives either way: distance and friction between the enterprise network and the physical process is the primary defense, not a single perimeter control.