implementing-purdue-model-network-segmentation

Classify all assets into Purdue levels 0-5, assign VLAN ranges per level, then deploy an IT/OT DMZ at Level 3.5 with north and south firewalls. Migrate data flows one at a time through the DMZ and enforce a default-deny rule between zones.

The Level 3.5 DMZ is a demilitarized zone between enterprise IT and OT operations where all cross-boundary data exchange occurs. It hosts historian replicas, jump servers, and patch staging, and it terminates every session so no traffic passes end-to-end.

Capture traffic from Level 4 and confirm zero packets reach Level 1 or 2 IP addresses, and export firewall rulesets to grep for any/any permits on industrial protocols. Use passive discovery tools like Nozomi or Claroty to detect backdoor paths such as vendor laptops or cellular modems.

Avoid it for micro-segmentation within a single Purdue level, cloud-native environments without traditional ICS networks, or purely IT environments. Those cases call for zone-and-conduit modeling or standard IT segmentation approaches instead.

Deny all direct enterprise-to-Level-1 and Level-2 traffic, allow historian push to a DMZ replica, permit RDP only through an MFA-protected jump server, and block Level 1 outbound internet access. End the ruleset with a logged default-deny-all rule.