# Piercing The Purdue Model: Zero-Trust In Operational Technology

- Link: https://www.agilicus.com/white-papers/piercing-the-purdue-model-zero-trust-in-operational-technology/
- Published: 2023-02-08T03:01:34+00:00
- Author: Don Bowman

1. [Home](https://www.agilicus.com/)
 2. Piercing The Purdue Model: Zero-Trust In Operational Technology

#### Piercing The Purdue Model

# Zero Trust In Operational Technology

Compare, contrast, merge, enhance. How the Purdue model for Industrial Control Systems
interacts with the Zero Trust Network Architecture.

[CONTACT](https://www.agilicus.com/contact-us/)

![Purdue Conceptual Model](https://www.agilicus.com/www/6ac9d526-purdue-model.svg)

## What is the Purdue Model?

Created in the 1990s, the [Purdue Enterprise Reference Architecture](https://en.wikipedia.org/wiki/Purdue_Enterprise_Reference_Architecture)
catered primarily to manufacturing and process control enterprises. Distinguished
by its ‘5 levels’, often confused with the [ISO networking model’s layers](https://en.wikipedia.org/wiki/OSI_model),
it found its inclusion in standards like [ISA-95](https://en.wikipedia.org/wiki/ANSI/ISA-95)
and [IEC 62264](https://en.wikipedia.org/wiki/IEC_62264). With zones defining levels
and [conduits](https://www.agilicus.com/white-papers-zero-trust-microsegmentation/)
connecting them, its impact lay in the compartmentalization of security.

While the Purdue Model assumed complete trust within a level, it inherently distrusted
the level above. And here, the shift towards the Zero Trust Network Architecture
is evident.

[Zero Trust](https://zero-trust.ca/), with its principle of “never trust, always
verify,” operates on the concept that there are no trusted locations or levels. 
Every interaction must be authenticated, curtailing the menace of lateral movements.
The quintessential question then is – can the stability of the Purdue Model and 
the agility of Zero Trust coalesce to augment each other?

## Acronyms And Modules Explained

But first, let’s explain the components (AKA the acronym soup):

[Operational Technology](https://en.wikipedia.org/wiki/Operational_technology) (
OT) is hardware and software running in the ‘non-carpeted’ parts of your business.
It supports “the direct [monitoring](https://en.wikipedia.org/wiki/Event_monitoring)
and/or control of industrial equipment, [assets](https://en.wikipedia.org/wiki/Asset),
processes and events_._“

![operational-technology](https://www.agilicus.com/www/3861386a-operational-technology.
svg)

Industrial Control Systems (ICS) are a subset of Operational Technology. It is the
hardware and software that runs the process control and manufacturing (distinct 
of e.g. the building heating and door locks).

A Building Management System (BMS or sometimes BAS) is the hardware and software
that manages the building in which your business operates. It controls temperature,
humidity, door locks and access control, surveillance, and alarm systems.

Distributed Control System (DCS) is an architectural model of industrial control
where the sensors, the actuators, and the decision-making are separated. A temperature
control sends a signal, a decision is made to turn off the heating element, all 
in separate devices.

![SCADA system diagram illustrating a Zero Trust architecture implementation within
the Purdue Model for Operational Technology (OT). The diagram showcases secure communication
and access control between different levels of the Purdue model, including enterprise,
control center, supervisory, control, and process levels, using Zero Trust principles
to protect against cyber threats. It emphasizes secure remote access, microsegmentation,
and continuous authentication for enhanced OT security.](https://www.agilicus.com/
www/102f7af9-scada.svg)

Supervisory Control and Data Acquisition ([SCADA](https://en.wikipedia.org/wiki/SCADA))
typically comprises a historical database (historian), a set of signals (sensors),
a set of decision-making (PLC), and, most importantly, the Human Machine Interface(
[HMI](https://en.wikipedia.org/wiki/User_interface)) which may be physical (e.g.
a touchscreen) or logical (e.g. a web page).

Industrial Internet of Things ([IIoT](https://en.wikipedia.org/wiki/Industrial_internet_of_things))
is a Distributed Control System where cloud computing or remote components are allowed.
Rather than sensors being directly wired to the PLC, they may use a messaging bus
such as MQTT or AMQP. IIoT is a key component of [Industry 4.0](https://en.wikipedia.org/wiki/Fourth_Industrial_Revolution).

## The Purdue Model Explained

OK, the terminology is out of the way, lets examine the Purdue Model in some more
detail. The Purdue Model is conceptual; each company implements it in a different
way. The most common is levels 0/1/2 are not segregated; there is 1 big network 
for each.

![Purdue Conceptual Model](https://www.agilicus.com/www/6ac9d526-purdue-model.svg)

A typical Purdue Model diagram is shown below. Level 0 has sensors; Level 1 control
systems; Level 2 supervisory; Level 3 is the plant management; Level 4 is the typical
corporate world, and Level 5 is things that interact with the Internet. The Purdue
Model dates to the mid-1990s when the Internet was nearly unfathomable for the typical
corporation and the idea that part of the core services would be run on “other people’s
hardware” was not included. Industry 4.0 was far on the horizon.

The ‘Firewall’ shown between each of the layers is typically a set of Access Control
Lists (ACLs) on existing routers. The rules are usually nearly wide open due to 
layering violations that have occurred over the years. Reporting products running
in the cloud on big data systems, require access to each layer, breaking down the
protections once inherent in and between layers.

Remote maintenance and support require team members, and extended teams from suppliers,
to remote in through the Internet and through each firewall layer.

Lateral traversal becomes a challenge as each layer has its own inherent weaknesses.
What were once immutable physical control systems became desktop PCs, but retained
the same life-cycle expectations of the industrial world. Patch Tuesday from the
corporate world met the need to not take production down. Today’s plant might have
a Windows XP or CE PC still in operation, long past its safe update cycle.

## Zero Trust and Purdue With Industrial Micro-Segmentation

![Zero Trust Micro-Segmentation for Manufacturing: Secure your industrial network
with granular control. Visualize your OT/ICS environment with micro-segmentation
to prevent lateral movement and protect critical assets. Agilicus provides comprehensive
micro-segmentation solutions for manufacturing, reducing risk and ensuring compliance.](
https://www.agilicus.com/www/99996f98-zero-trust-micro-segmentation-all-micro-segmentation.
drawio.svg)

In “[Industrial Zero-Trust Micro-Segmentation](https://www.agilicus.com/white-papers-zero-trust-microsegmentation/)”
we discuss a method to use an identity-aware firewall to bridge this gap. To create
a logical ‘1-device airgap’ where each resource is individually addressable without
risk of lateral traversal. This allows vital remote maintenance and support functions
to safely occur, lowering the mean-time-to-repair.

By having each person or resource use its identity to unlock the path to only the
things it needs to get its job done, we implement a narrowly tailored, least-privilege
network. We create a practical airgap. We reduce the cognitive load of configuring
the complex ACLs on the switches. We implement defense in depth, meaning that, when
something bad happens, it doesn’t happen everywhere to everything at the same time.

So, how do we reconcile and get the best of each layer? Zero-Trust-Purdue? First,
keep the levels. They serve their purpose. Second, use private-VLAN technology on
the switches, removing the ability to communicate east-west. Third, implement an
identity-aware firewall managing the north-south (and the east-west where appropriate).
A Zero-Trust implementation, centered on the existing industrial PCs and using the
existing switches, makes it simpler and safer for remote workers, regardless of 
origin or company, to use today’s best security practices like single sign-on and
multi-factor, to provide remote maintenance and lower the mean-time-to-repair. Lower
risk, higher efficiency, higher uptime, and lower cost. Modern Zero-Trust augments
battle-tested Purdue Model.

## Conclusion: Enhance the Purdue Model with Zero Trust

Marrying the resilience of the Purdue Model with the dynamism of Zero Trust redefines
security, efficiency, and productivity. It’s not just about juxtaposing two concepts;
it’s about crafting a seamless synthesis for the future.

BOOK A MEETING

Ready To Learn More?

Agilicus AnyX Zero Trust enables any user, on any device, secure connectivity to
any resource they need—without a client or VPN. Whether that resource is a web application,
a programmable logic controller, or a building management system, Agilicus can secure
it with multi-factor authentication while keeping the user experience simple with
single sign-on.

[BOOK A MEETING](https://www.agilicus.com/book-calendar-meeting/)

![Agilicus AnyX platform logo, horizontal orientation.](https://www.agilicus.com/
www/9f758437-agilicus-logo-horizonta.svg)

info@agilicus.com, +1 ‪519 953-4332‬

300-87 King St W, Kitchener, ON, Canada. N2G 1A7

[⌊partner⌉⌊partner⌉[