2. Understanding the Purdue Model: The Foundation of Secure Industrial Networks
If you’ve ever heard terms like:
- Level 0
- Level 1
- Level 2
- OT Network
- IT Network
- DMZ
- Segmentation
you are already hearing concepts that originate from the Purdue Enterprise Reference Architecture (PERA), commonly called the Purdue Model.
The Purdue Model is one of the most widely used frameworks for designing and securing industrial control system networks.
Its primary purpose is simple:
Separate critical control systems from business systems while allowing only the necessary flow of information.
Understanding this model is essential for anyone working with PLCs, HMIs, SCADA systems, industrial networks, and cybersecurity.
Why the Purdue Model Exists
Years ago, industrial systems were mostly isolated.
A PLC controlled a machine.
An HMI displayed information.
Operators ran the process.
There was little or no connection to corporate networks.
Today, companies want:
- Real-time production dashboards
- Cloud analytics
- ERP integration
- Predictive maintenance
- Remote support
- Mobile monitoring
While these technologies provide tremendous value, they also create additional cybersecurity risks.
The Purdue Model helps organize industrial systems into logical layers that can be properly secured.
Purdue Model Overview
The model divides industrial environments into hierarchical levels.
Level 5 Enterprise / Cloud
Level 4 Business Systems (ERP)
Level 3 Site Operations
-------------------------
DMZ
-------------------------
Level 2 Supervisory Control
Level 1 Basic Control
Level 0 Physical ProcessAs you move downward, systems become increasingly critical to production and safety.
Level 0 – Physical Process
Level 0 is where the actual industrial process occurs.
This includes:
- Sensors
- Proximity switches
- Pressure transmitters
- Temperature sensors
- Flow meters
- Valves
- Motors
- Pumps
- Actuators
Examples from a filling line:
- Photoeye detecting bottles
- Motor driving conveyor
- Solenoid valve controlling product flow
- Tank level transmitter
These devices interact directly with the physical world.
If Level 0 is affected, production is affected.
Level 1 – Basic Control
Level 1 contains the devices that directly control the process.
Typical devices include:
- PLCs
- Remote I/O
- Safety Controllers
- VFDs
- Motion Controllers
Examples:
- CompactLogix
- ControlLogix
- GuardLogix
- PowerFlex Drives
- FLEX I/O
These devices make real-time control decisions.
Examples:
If Photoeye ON
Start Conveyor
If Tank Level High
Stop PumpThis level is the heart of industrial automation.
Level 2 – Supervisory Control
Level 2 provides visualization and operator interaction.
Common systems include:
- HMIs
- SCADA servers
- Engineering Workstations
- Alarm Servers
- Historians
Examples:
- PanelView Plus
- FactoryTalk View SE
- Ignition
- Wonderware
Operators use these systems to:
- Start equipment
- Stop equipment
- Monitor alarms
- View production information
Level 2 supervises Level 1 but does not directly execute control logic.
Level 3 – Site Operations
Level 3 is where production management begins.
Typical systems include:
- Manufacturing Execution Systems (MES)
- Reporting Servers
- Production Databases
- Historian Servers
- Batch Systems
- OEE Systems
Examples:
- Production reports
- Downtime tracking
- Quality tracking
- Production scheduling
Level 3 focuses on plant operations rather than direct machine control.
The DMZ (Demilitarized Zone)
One of the most important cybersecurity concepts.
The DMZ acts as a secure buffer between IT and OT.
Enterprise IT
↓
DMZ
↓
OT NetworkA properly designed DMZ may contain:
- Historian replication servers
- Patch management servers
- Antivirus update servers
- Jump servers
- Secure remote access gateways
The purpose is to prevent direct access from IT systems to control systems.
Level 4 – Business Systems
Level 4 contains traditional IT business applications.
Examples:
- ERP Systems
- SQL Databases
- Email Servers
- Active Directory
- Financial Systems
- Inventory Systems
This is where management wants information such as:
- Production rates
- Inventory levels
- Downtime reports
- Quality metrics
Level 4 should not directly communicate with PLCs.
Level 5 – Enterprise and Cloud
Level 5 includes:
- Corporate Data Centers
- Cloud Services
- Enterprise Analytics
- External Vendors
- Corporate Reporting Platforms
Examples:
- Microsoft Azure
- AWS
- Cloud Dashboards
- Enterprise Reporting Tools
This level provides high-level business visibility but should remain separated from control systems.
Example: Beverage Production Line
Let’s follow a bottle count.
Level 0
Photoeye detects bottle.
↓
Level 1
PLC counts bottle.
↓
Level 2
HMI displays count.
↓
Level 3
Historian stores production data.
↓
Level 4
ERP receives production totals.
↓
Level 5
Corporate dashboard displays production metrics.
This demonstrates how information flows upward through the architecture.
Why Cybersecurity Professionals Love the Purdue Model
The Purdue Model helps organizations:
- Identify critical assets
- Create security zones
- Control communications
- Implement firewalls
- Design DMZs
- Reduce attack surfaces
- Support IEC 62443 architectures
Without a structured architecture, networks often become flat and difficult to secure.
Common Mistakes
Never Do This
❌ ERP directly connected to PLCs
❌ PLCs exposed to the Internet
❌ Engineering workstation connected to both IT and OT without controls
❌ Flat plant-wide networks
❌ Unrestricted vendor remote access
❌ No DMZ between IT and OT
These are common pathways used by attackers.
Purdue Model and IEC 62443
The Purdue Model and IEC 62443 work very well together.
The Purdue Model defines:
Where systems belong.
IEC 62443 defines:
How those systems should be protected.
Together they form the foundation of modern industrial cybersecurity architecture.
Final Thoughts
The Purdue Model is much more than a network diagram.
It is a framework for organizing industrial systems, controlling data flow, and reducing cybersecurity risk.
For automation professionals, understanding where PLCs, HMIs, SCADA systems, historians, ERP systems, and cloud services fit within the architecture is essential for designing secure and reliable industrial networks.
Before you can secure an industrial network, you must first understand its structure.
The Purdue Model provides that structure.