| name | implementing-purdue-model-network-segmentation |
| description | Implement network segmentation based on the Purdue Enterprise Reference Architecture (PERA) model, separating ICS networks into hierarchical security zones from Level 0 physical process through Level 5 enterprise and enforcing strict traffic control through IEC 62443-aligned DMZs between OT and IT domains. Use when designing ICS/SCADA network zones or segmenting OT from IT networks.
|
| domain | cybersecurity |
| subdomain | ot-ics-security |
| tags | ["ot-security","ics","purdue-model","network-segmentation","iec62443","defense-in-depth","dmz","scada"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"] |
| mitre_attack | ["T1078","T1190","T1059","T0816","T0836"] |
Implementing Purdue Model Network Segmentation
When to Use
- When designing or retrofitting network architecture for an ICS/SCADA environment
- When implementing IEC 62443 zone and conduit requirements in a brownfield plant
- When creating the IT/OT DMZ (Level 3.5) to control data flow between enterprise and control networks
- When remediating audit findings about flat OT networks or direct IT-to-OT connectivity
- When segmenting a converged IT/OT network after an acquisition or merger
Do not use for micro-segmentation within a single Purdue level (see implementing-zone-conduit-model-for-ics), for cloud-native environments without traditional ICS networks, or for network segmentation in purely IT environments.
Prerequisites
- Complete OT asset inventory with Purdue level classification for each device
- Network architecture diagram showing current topology, VLANs, and firewall placements
- Industrial firewalls capable of deep packet inspection for OT protocols (Palo Alto, Fortinet, Cisco)
- Understanding of required data flows between Purdue levels (historian replication, remote access, patch distribution)
- Change management approval from plant operations for network modifications
Workflow
Step 1: Map Current Architecture to Purdue Levels
Classify all network assets and data flows according to the Purdue Model hierarchy.
"""Purdue Model Network Segmentation Planner.
Maps existing OT/IT network assets to Purdue Model levels and generates
segmentation recommendations including firewall rules and VLAN assignments.
"""
import json
import csv
import sys
from collections import defaultdict
from datetime import datetime
from typing import Dict, List
PURDUE_LEVELS = {
0: {
"name": "Physical Process",
"description": "Sensors, actuators, field instruments",
"typical_devices": [, , , ],
: ,
: [, , , ],
},
: {
: ,
: ,
: [, , , ],
: ,
: [, , , , ],
},
: {
: ,
: ,
: [, , , ],
: ,
: [, , , , ],
},
: {
: ,
: ,
: [, , , ],
: ,
: [, , , ],
},
: {
: ,
: ,
: [, , , , ],
: ,
: [, , , ],
},
: {
: ,
: ,
: [, , , ],
: ,
: [, , , ],
},
: {
: ,
: ,
: [, , ],
: ,
: [, ],
},
}
:
():
.assets = []
.data_flows = []
.firewall_rules = []
():
(filepath, ) f:
.assets = (csv.DictReader(f))
()
():
classification = defaultdict()
asset .assets:
level = asset.get(, )
:
level = (level)
(ValueError, TypeError):
level = ._infer_purdue_level(asset)
classification[level].append(asset)
asset[] = level
classification
() -> :
device_type = asset.get(, ).lower()
mapping = {
: , : , : ,
: , : , : , : ,
: , : , : ,
: , : , : ,
: , : , : ,
: , : , : ,
}
keyword, level mapping.items():
keyword device_type:
level
-
() -> :
vlan_plan = []
level, info PURDUE_LEVELS.items():
assets_at_level = classification.get(level, [])
vlan_plan.append({
: level,
: info[],
: info[],
: (assets_at_level),
: info[],
})
vlan_plan
() -> :
rules = [
{
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
},
{
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
},
{
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
},
{
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
},
{
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
},
{
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
},
{
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
},
{
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
},
{
: ,
: ,
: ,
: ,
: ,
: ,
: ,
: ,
},
]
.firewall_rules = rules
rules
():
()
()
()
()
vlan_plan = .generate_vlan_plan(classification)
()
v vlan_plan:
()
()
()
()
()
rules = .generate_firewall_rules()
rule rules:
action_symbol = rule[] ==
()
()
()
()
__name__ == :
planner = PurdueSegmentationPlanner()
(sys.argv) >= :
planner.load_asset_inventory(sys.argv[])
classification = planner.classify_assets()
planner.print_segmentation_plan(classification)
