The Purdue Model and Zero Trust: Microsegmentation and IEC 62443 in Industrial Networks

Flat industrial networks — where every device talks on one level — are an attacker's paradise: a small breach spreads to the whole production line. The answer is the layered Purdue Model combined with zero-trust principles.

The Purdue Model Levels

The Purdue Model divides the industrial network into hierarchical levels:

• Levels 0–2: the physical process, sensors, actuators, and PLCs.
• Level 3: manufacturing operations management (MES).
• Level 3.5 (industrial DMZ): a mandatory buffer zone between OT and IT.
• Levels 4–5: the enterprise IT network and cloud.

Purdue + IEC 62443

The two are complementary: the Purdue Model defines the network architecture, while ISA/IEC 62443 builds its “zones and conduits” model and system security requirements directly on those levels. NIS2 or sector directives then set the legal obligations.

Why Zero Trust?

IIoT and cloud connectivity break traditional zone boundaries. The modern approach is to combine macro-segmentation with zero trust. In industrial zero trust, every connected device — from PLCs to smart meters — must authenticate its identity using Public Key Infrastructure (PKI) before communicating.

The Five-Step Pattern: “Map First, Enforce Last”

1. Map: draw the actual architecture, not the documented one; discover every communication flow.
2. Boundary: secure the Level 4→3.5 boundary with outbound-only, identity-verified access.
3. Segment within levels: isolate inside each level to stop lateral movement.
4. Compensating controls: at the unpatchable process-control layer, add monitoring and compensating controls.
5. Enforce gradually: proceed without halting production or a forklift equipment replacement.

Implementation Tips

• Route contractor remote access through the industrial DMZ with multi-factor authentication.
• Monitor industrial protocols passively so production is not disrupted.
• Keep a live asset inventory; every unknown asset is a risk.