A handful of concepts sit behind almost every OT security programme and standard. Understanding them makes conversations with engineers, vendors and auditors much easier.
The Purdue model: levels of a control system
The Purdue reference model describes a plant in levels, from the physical process up to the business network:
- Level 0, process: sensors, actuators, breakers, valves, motors
- Level 1, basic control: PLCs, RTUs, protection relays and controllers
- Level 2, supervisory control: SCADA, HMIs, operator workstations
- Level 3, site operations: historians, engineering workstations, operations servers
- Industrial DMZ (often called level 3.5): the controlled boundary between OT and IT
- Levels 4–5, enterprise: business systems, email and the internet
Traffic should only move between levels through controlled points, and never directly from the internet or office network to control equipment.
Zones and conduits
IEC 62443 groups assets with the same security needs into zones and the connections between them into conduits. Protection is applied at the conduits: firewalls, authentication, encryption and monitoring. A good zone model is the foundation of every design, audit and change.
Security levels
Each zone and conduit gets a target security level from 1 to 4, describing how capable an attacker it must resist, from casual misuse (SL 1) to well-resourced, sophisticated attackers (SL 4). Design work then closes the gap between the target and what the system actually achieves.
Defence in depth
No single control is enough. OT security layers several: physical security, segmentation, access control, hardened devices, monitoring, backups and trained people. If one layer fails, the next one limits the damage.
Know what you have
You can't protect assets you don't know about. An accurate inventory of every controller, workstation, network device and software version is the starting point for risk assessment, patching and incident response.
Risk, not checklists
Standards describe what good looks like, but every site is different. A risk assessment, considering threats, vulnerabilities and the physical consequences of failure, decides which controls matter most and where to start.