Beyond Purdue: an alternative to the Purdue model

The Purdue model sorts a plant into levels by where devices sit on the network [27][25]. Beyond Purdue keeps what still works and changes the question: not where a device sits, but what it is allowed to do.

From Purdue levels to levels of authority

A level is not a network segment. A level is a grant of authority, and every level states who is allowed to vote on what. The simpler and more predictable a level, the more authority it holds: a relay and a copper wire hold absolute authority, a model with billions of parameters holds the least. The six levels are on Six levels of authority, and the laws they follow on The Laws of Authority.

What changes

• Levels stand on their own. They are not stacked; each stands around the data plane, and every level speaks to the others only through L2 Channels [26].
• Data lives in independent nodes. One tag, one node, with its own name: the L3 Data nodes.
• Data and commands never share a lane. Out channels carry data out, in channels carry commands in, each one way through a data diode.
• Protection stays hardwired. If every level above fails at the same moment, protection still acts.

Built for obsolescence

Because each level stands on its own, an obsolete part is replaced without touching the rest, and proven equipment that still works stays in place.

Built for the people inside it

Maintenance is part of operation, and people work inside the plant. Their safety is designed in from the start, not added later. The emergency stop stops a machine; only the lock keeps it stopped. The lock outranks the screen.

Sources

25. NIST SP 800-82r3, Guide to Operational Technology Security. https://csrc.nist.gov/pubs/sp/800/82/r3/final
26. IEC 62443-3-3, System security requirements and security levels. https://webstore.iec.ch/en/publication/7033
27. The Purdue Enterprise Reference Architecture (PERA). https://www.pera.net/