The Purdue Model in Practice Versus on Paper

The Purdue model provides a framework for understanding industrial networks, dividing them into five levels, from the process level at Level 0 to the enterprise level at Level 5. Real-world plants often fail to adhere to this model, leading to issues such as shared networks and unsecured access points. To address these problems, the industrial DMZ (demilitarized zone) is introduced, a controlled network situated between Levels 3 and 4.

This intermediate zone serves as a broker for services and facilitates communication between the operational management (Level 3) and site business systems (Level 4) layers.

Within the iDMZ, components such as historian replica servers, patch and antivirus update servers, and file transfer staging areas exist. These elements help manage updates and patches while maintaining a secure boundary between the business and the plant networks. Importantly, outside sessions terminate at the iDMZ rather than within the plant, reducing the risk of an attack reaching the controllers directly.

The blurring of levels within industrial networks poses significant risks, as each overlapping layer provides a pathway for mistakes or attacks. For instance, a single phished engineering workstation can allow unauthorized access to programming tools, while a flat network connecting Levels 1 through 3 can enable a historian query to interfere with controller traffic. These vulnerabilities do not require sophisticated attackers but can be exploited by ordinary bad actors.

To mitigate these risks, a focused approach is essential. First, it is crucial to inventory all devices passively and identify all paths between the business network and the plant, including modems and vendor tunnels. Once these pathways are mapped, they should be replaced with the industrial DMZ. Separating the engineering workstation from general use and splitting Levels 1, 2, and 3 with a firewall that understands the relevant protocols are also vital steps.

Implementing passive monitoring tools enhances the ability to detect changes and potential security breaches.

By following the Purdue model and adhering to IEC 62443-3-2 guidelines for grouping assets into zones and naming conduits, industrial networks can be hardened against attacks. A worked example for small sites is provided in IEC 62443 zones and conduits for a small plant. It is important not to redraw the entire network on paper before making any changes; instead, concentrate on improving specific aspects of the existing infrastructure. Ultimately, these improvements contribute to a more secure and resilient industrial network.