Purdue Model

Purdue Model

The reference layering for industrial networks, from the physical process at Level 0 up to enterprise IT at Level 4, with a DMZ in between. The map every OT segmentation argument is drawn on.

The Purdue model (from the Purdue Enterprise Reference Architecture) is the layered reference architecture used to describe and segment industrial networks. It is not a standard you comply with; it is the shared vocabulary that makes an OT network discussion possible, and it underpins IEC 62443.

The levels

Level 5   Enterprise network            corporate IT, internet
Level 4   Site business planning        ERP, email, file servers
----------  IDMZ  (Level 3.5)  ---------- the boundary that matters
Level 3   Site operations               historian, engineering workstations, domain
Level 2   Supervisory control           HMI, SCADA servers, alarms
Level 1   Basic control                 PLCs, RTUs, DCS controllers
Level 0   Process                       sensors, actuators, motors, valves

Level 0 is physical: instruments and final control elements. There is no computer here to secure, only signals.
Level 1 is the controllers that read Level 0 and drive it. plc territory.
Level 2 is what humans watch: the HMI screens and the supervisory logic. scada territory.
Level 3 is site-wide operations, where the data historian, the engineering workstations and the batch systems live.
Levels 4 and 5 are ordinary corporate IT.

The IDMZ

The industrial demilitarised zone at Level 3.5 is the whole point of the model. The rule it encodes is simple and load-bearing:

No traffic crosses between the enterprise side and the control side. It terminates in the DMZ on both sides.

In practice that means the historian is mirrored into the DMZ so business users query the replica and never touch the real one, remote access lands on a jump host in the DMZ rather than reaching in, patch and antivirus distribution is staged there, and no protocol used at Levels 1 and 2 is ever routable from Level 4.

Why the layering is the security control

The devices at Levels 0 to 2 cannot defend themselves. Their protocols have no authentication, their firmware cannot be patched on a normal cadence, and they can be knocked over by a port scan. Given that, the only durable control is to ensure the attacker never reaches them. The model exists to make "who can talk to what" an explicit, reviewable property of the architecture rather than an accident of history.

How it fails in practice

The failures are consistent across sites, and none of them are exotic:

Dual-homed hosts. An engineering workstation with one interface on Level 3 and one on Level 2, or a laptop that moves between them. This is the single most common bridge.
Vendor remote access. A support tunnel, a cellular modem or a remote-desktop tool installed for maintenance and never removed, connecting Level 2 directly to the internet.
Flat networks with VLANs called segmentation. VLANs on a shared switch with a router that permits everything are a naming convention, not a boundary.
The DMZ that forwards. A DMZ host that proxies straight through defeats the model while satisfying the diagram.
Wireless. An access point on the control network, often installed for convenience during a commissioning.

Its limits

The model was drawn before cloud connectivity, IIoT sensors that report directly to a vendor platform, and edge gateways that intentionally bypass the hierarchy. A modern sensor at Level 0 with its own cellular link makes the layering a partial description. It remains the right starting map, and the discipline it teaches (know every path between levels, terminate rather than forward) survives the exceptions.

What it pairs with

ot-security is the discipline, plc and scada are what lives at the lower levels, and incident-response is where the layering determines what containment is even possible.