OT Security Fundamentals: The Purdue Model and Why IT Playbooks Fail

The One Idea That Changes Everything

In IT, a bad day means data is exposed. In OT, a bad day means a pressure vessel ruptures, a turbine spins down, a water treatment process overdoses a chemical, or someone is hurt.

That difference inverts the usual priority order. IT security conventionally leads with confidentiality. Operational technology leads with safety, then availability, then integrity, with confidentiality last. Recipes and process data matter, but never more than keeping the process safe and running.

Almost every mistake made by IT teams entering OT traces back to not internalizing this. Patch immediately, scan everything, isolate the infected host: all reasonable in IT, all potentially dangerous on a plant floor.

The Equipment You Need to Know

PLC, programmable logic controller. A ruggedized controller that reads inputs, runs its control program, and drives outputs to physical equipment. If you change its logic, you change the physical world.

RTU, remote terminal unit. Similar function, built for geographically dispersed and unstaffed sites such as pipelines and substations, with telemetry over long-haul or wireless links.

HMI, human-machine interface. The operator's window: process state, alarms, and supervisory commands including setpoint changes.

DCS versus SCADA. A distributed control system provides tightly integrated, high-speed continuous control inside one plant. SCADA supervises geographically distributed assets over slower, less reliable links. The distinction drives very different monitoring and segmentation decisions.

Historian. Time-series archive of process values. It is also a favourite pivot point, because it typically has connections both into the control network and out to business reporting.

Engineering workstation. The highest-value target in most OT environments. It holds the programming software, project files, and credentials needed to download logic to controllers, which means compromising it allows authoritative changes to the process using entirely legitimate tooling.

SIS, safety instrumented system. An independent protective layer that brings the process to a safe state when conditions become hazardous. Its independence from the basic process control system is the whole point, and eroding that independence is a serious design failure.

The Purdue Model

The Purdue Enterprise Reference Architecture gives everyone a shared vocabulary for segmentation:

Level 0: the physical process. Sensors, actuators, transmitters, final control elements.

Level 1: basic control. PLCs, RTUs, and safety controllers.

Level 2: supervisory control. HMIs, engineering workstations, local historians.

Level 3: site operations. Manufacturing execution, central historian, domain services for the plant.

Level 3.5: the industrial DMZ.

Levels 4 and 5: enterprise IT and business systems.

The critical rule is at Level 3.5. In a well-designed plant, no session traverses directly between enterprise and control networks. Everything terminates on brokered services in the industrial DMZ: a replicated historian, a patch distribution server, a jump host. An enterprise compromise then cannot reach a controller directly.

Treat Purdue as a reference for reasoning about trust boundaries, not as a literal wiring diagram. Modern plants with cloud analytics and industrial IoT do not map cleanly onto it, but the questions it forces you to ask remain correct.

Protocols With No Security At All

Industrial protocols were designed for physically isolated, trusted serial links. Most carry no authentication, no integrity checking, and no encryption.

Modbus is the clearest example. Any node that can reach a controller can read and write. Function codes that write coils and registers act on real outputs and setpoints, so an attacker with network access can move physical equipment. There is no protocol-level barrier at all.

DNP3 is common in utilities. Secure Authentication (IEEE 1815) adds cryptographic message authentication, countering spoofed and replayed commands, but it authenticates rather than encrypts and is far from universally deployed.

OPC UA is the modern bright spot: platform independent, with certificate-based authentication, message signing, and encryption built in. Classic OPC relied on DCOM, which is notoriously difficult to secure or firewall.

IEC 61850 GOOSE in substations is Layer 2 multicast with millisecond delivery requirements. This matters enormously for security design: inline inspection that adds latency, or fails closed, can defeat the protection scheme it was meant to protect.

The takeaway is that you cannot fix these protocols. You control who can reach them.

Why Standard IT Controls Break

Patching. Vendor validation, revalidation requirements, and the need to restart equipment mean patches wait for planned maintenance outages. A 30-day patching policy applied literally to a control network is either ignored or dangerous.

Active scanning. Unsolicited probes and credentialed enumeration have crashed legacy industrial devices. Passive discovery from a mirror port or optical tap is the default, with active methods reserved for offline systems and approved windows.

Endpoint agents. Controllers cannot run them. Many OT Windows hosts are vendor-validated appliances where installing software voids support.

Inline blocking. A fail-closed security appliance in a control path is a process hazard in its own right. Availability of the control path frequently outweighs blocking capability.

Host isolation during incident response. Pulling a host may remove the operator's only means of seeing or controlling hazardous equipment. Containment options must be assessed for process consequence before they are executed.

What Actually Works

Segmentation, above all. Zones grouping assets with common security requirements, conduits governing traffic between them, and a real industrial DMZ. Cell-level microsegmentation prevents one infection becoming a plant-wide event, which is exactly how several widely reported outbreaks spread.

Controlling the engineering workstation. Remove internet and email access, apply application allowlisting, restrict and record interactive access, and monitor for engineering-tool activity from unexpected hosts, accounts, or times.

Secure remote access. Vendor access should be exceptional, not permanent: named accounts, multifactor authentication at a brokered jump host, least-privilege scope, session recording, and automatic expiry. Standing vendor VPN tunnels are a recurring root cause of OT intrusions.

Passive monitoring with protocol awareness. Protocol-aware inspection can distinguish a benign read from a logic download, a controller mode change, or a setpoint write, all of which look identical at the IP layer. Unauthorized logic downloads and mode changes are the highest-fidelity alerts available in OT.

Compensating controls for what cannot be fixed. When a controller cannot be patched for three years, reduce reachability with tightly allowlisted conduits, add targeted detection, restrict access, and document the risk acceptance with an owner and a review date.

Verified, offline backups of controller logic and configurations, restore-tested on a schedule. Recovery capability is the difference between hours and weeks of downtime.

Asset inventory that records process criticality, not just hostname and IP. Risk decisions depend on knowing what a device does to the process and how supportable it is.

Working With Operations

The most common failure in OT security programmes is organizational, not technical. Security teams that override operations lose access and cooperation, and the controls get quietly removed.

What works: propose passive, non-addressable collection; validate in a test cell first; route changes through management of change with an operations-approved rollback; and triage alerts jointly with people who understand the process. Every security change in OT is a process change, and the management-of-change review is what catches the unintended operational consequence before it happens.

Learning the Domain Properly

OT security is one of the few areas where demand consistently exceeds supply, partly because it requires both security and process knowledge. CyberCertPrep covers the industrial track with OT Security Fundamentals, ISA/IEC 62443, and CompTIA SecOT+ banks spanning ICS and SCADA architecture, industrial protocols, threat landscape, segmentation design, OT security operations, and safety-aligned incident response, with detailed explanations throughout.