implementing-purdue-model-network-segmentation

Implement network segmentation based on the Purdue Enterprise Reference Architecture (PERA) model to separate industrial control system networks into hierarchical security zones from Level 0 physical process through Level 5 enterprise, enforcing strict traffic control between OT and IT domains.

Jump to install

Repository: AgentFlocks/flocks
Last source activity: May 5, 2026 at 05:45
Detected SKILL.md language: English
Stars: 445
Forks: 83

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	implementing-purdue-model-network-segmentation
description	Implement network segmentation based on the Purdue Enterprise Reference Architecture (PERA) model to separate industrial control system networks into hierarchical security zones from Level 0 physical process through Level 5 enterprise, enforcing strict traffic control between OT and IT domains.
domain	cybersecurity
subdomain	ot-ics-security
tags	["ot-security","ics","purdue-model","network-segmentation","iec62443","defense-in-depth","dmz","scada"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"]

Implementing Purdue Model Network Segmentation

When to Use

When designing or retrofitting network architecture for an ICS/SCADA environment
When implementing IEC 62443 zone and conduit requirements in a brownfield plant
When creating the IT/OT DMZ (Level 3.5) to control data flow between enterprise and control networks
When remediating audit findings about flat OT networks or direct IT-to-OT connectivity
When segmenting a converged IT/OT network after an acquisition or merger

Do not use for micro-segmentation within a single Purdue level (see implementing-zone-conduit-model-for-ics), for cloud-native environments without traditional ICS networks, or for network segmentation in purely IT environments.

Prerequisites

Complete OT asset inventory with Purdue level classification for each device
Network architecture diagram showing current topology, VLANs, and firewall placements
Industrial firewalls capable of deep packet inspection for OT protocols (Palo Alto, Fortinet, Cisco)
Understanding of required data flows between Purdue levels (historian replication, remote access, patch distribution)
Change management approval from plant operations for network modifications

Workflow

Step 1: Map Current Architecture to Purdue Levels

Classify all network assets and data flows according to the Purdue Model hierarchy.

#!/usr/bin/env python3
"""Purdue Model Network Segmentation Planner.

Maps existing OT/IT network assets to Purdue Model levels and generates
segmentation recommendations including firewall rules and VLAN assignments.
"""

import json
import csv
import sys
from collections import defaultdict
from datetime import datetime
from typing import Dict, List


PURDUE_LEVELS = {
    0: {
        "name": "Physical Process",
        "description": "Sensors, actuators, field instruments",
        "typical_devices": [, , , ],
        : ,
        : [, , , ],
    },
    : {
        : ,
        : ,
        : [, , , ],
        : ,
        : [, , , , ],
    },
    : {
        : ,
        : ,
        : [, , , ],
        : ,
        : [, , , , ],
    },
    : {
        : ,
        : ,
        : [, , , ],
        : ,
        : [, , , ],
    },
    : {
        : ,
        : ,
        : [, , , , ],
        : ,
        : [, , , ],
    },
    : {
        : ,
        : ,
        : [, , , ],
        : ,
        : [, , , ],
    },
    : {
        : ,
        : ,
        : [, , ],
        : ,
        : [, ],
    },
}


 :
    

     ():
        .assets = []
        .data_flows = []
        .firewall_rules = []

     ():
        
         (filepath, )  f:
            .assets = (csv.DictReader(f))
        ()

     ():
        
        classification = defaultdict()
         asset  .assets:
            level = asset.get(, )
            :
                level = (level)
             (ValueError, TypeError):
                level = ._infer_purdue_level(asset)

            classification[level].append(asset)
            asset[] = level

         classification

     () -> :
        
        device_type = asset.get(, ).lower()
        mapping = {
            : , : , : ,
            : , : , : , : ,
            : , : , : ,
            : , : , : ,
            : , : , : ,
            : , : , : ,
        }
         keyword, level  mapping.items():
             keyword  device_type:
                 level
         -

     () -> :
        
        vlan_plan = []
         level, info  PURDUE_LEVELS.items():
            assets_at_level = classification.get(level, [])
            vlan_plan.append({
                : level,
                : info[],
                : info[],
                : (assets_at_level),
                : info[],
            })
         vlan_plan

     () -> :
        
        rules = [
            {
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
            },
            {
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
            },
            {
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
            },
            {
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
            },
            {
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
            },
            {
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
            },
            {
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
            },
            {
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
            },
            {
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
                : ,
            },
        ]
        .firewall_rules = rules
         rules

     ():
        
        ()
        ()
        ()
        ()

        vlan_plan = .generate_vlan_plan(classification)
        ()
         v  vlan_plan:
            ()
            ()
            ()
            ()

        ()
        rules = .generate_firewall_rules()
         rule  rules:
            action_symbol =   rule[] ==   
            ()
            ()
            ()
            ()


 __name__ == :
    planner = PurdueSegmentationPlanner()
     (sys.argv) >= :
        planner.load_asset_inventory(sys.argv[])
    classification = planner.classify_assets()
    planner.print_segmentation_plan(classification)

# Level 3.5 DMZ Architecture Configuration
# All IT-OT data exchange flows through the DMZ

dmz_architecture:
  zone_name: "IT_OT_DMZ"
  purdue_level: 3.5
  vlan: 150

  components:
    historian_replica:
      purpose: "Read-only copy of OT historian data for IT/business access"
      direction: "OT pushes data TO DMZ (unidirectional)"
      ip: "10.10.150.10"
      services:
        - port: 1433
          protocol: "SQL"
          direction: "inbound from Level 3 historian only"
        - port: 443
          protocol: "HTTPS"
          direction: "outbound to Level 4 for IT consumers"

    jump_server:
      purpose: "Controlled remote access point for OT maintenance"
      ip: "10.10.150.20"
      services:
        - port: 3389
          protocol: "RDP"
          direction: "inbound from Level 4 with MFA"
        - port: 3389
          protocol: "RDP"
          direction: "outbound to Level 2 HMIs only"
      security_controls:
        - "Multi-factor authentication required"
        - "Session recording enabled"
        - "Maximum session duration: 4 hours"
        - "Approval-based access workflow"

    patch_server:
      purpose: "Staging area for tested patches before OT deployment"
      ip: "10.10.150.30"
      services:
        - port: 8530
          protocol: "WSUS"
          direction: "pulls from Level 4 WSUS, pushes to Level 2-3"

    antivirus_relay:
      purpose: "AV signature distribution to OT endpoints"
      ip: "10.10.150.40"
      services:
        - port: 443
          protocol: "HTTPS"
          direction: "pulls definitions from Level 4, distributes to Level 2-3"

  firewall_rules:
    north_firewall:  # Between DMZ and Level 4 Enterprise
      - allow: "Level 4 -> DMZ jump server:3389 (with MFA)"
      - allow: "Level 4 -> DMZ historian replica:443 (read-only)"
      - allow: "DMZ patch server -> Level 4 WSUS:8530 (pull only)"
      - deny: "ALL other traffic"

    south_firewall:  # Between DMZ and Level 3 Operations
      - allow: "Level 3 historian -> DMZ replica:1433 (push direction)"
      - allow: "DMZ jump server -> Level 2 HMI:3389 (session-limited)"
      - allow: "DMZ patch server -> Level 2/3:8530 (scheduled)"
      - deny: "ALL other traffic"

    critical_rule: "NO traffic passes through DMZ end-to-end. DMZ breaks all connections."

Term	Definition
Purdue Model (PERA)	Hierarchical reference architecture organizing industrial networks into levels 0-5 based on function and trust
Level 3.5 DMZ	Demilitarized zone between IT (Level 4) and OT (Level 3), where all cross-boundary data exchange occurs
Defense in Depth	Layered security approach requiring attackers to breach multiple boundaries to reach critical control systems
Data Diode	Hardware-enforced unidirectional communication device ensuring data flows only from OT to IT, never reverse
Zone	Logical grouping of assets sharing common security requirements as defined by IEC 62443
Conduit	Controlled communication path between zones with defined security policies

PURDUE MODEL SEGMENTATION REPORT
====================================
Assessment Date: YYYY-MM-DD
Facility: [Plant Name]

CURRENT STATE:
  Network Type: [Flat/Partially segmented/Fully segmented]
  IT-OT Boundary: [None/Firewall/DMZ with dual firewall]
  Direct IT-to-PLC paths: [count]

RECOMMENDED ARCHITECTURE:
  Level 0-1: VLAN 110 (Control Network)
  Level 2:   VLAN 120 (Supervisory Network)
  Level 3:   VLAN 130 (Operations Network)
  Level 3.5: VLAN 150 (IT/OT DMZ)
  Level 4-5: VLAN 200+ (Enterprise)

DMZ COMPONENTS:
  - Historian Replica Server
  - Jump Server (MFA-enabled)
  - Patch Staging Server
  - AV Relay Server

FIREWALL RULES: [count] rules generated
MIGRATION STEPS: [count] phases planned