Purdue Is Like Communism: Nobody Has Managed It Without Cheating Yet

The line that started this post, from my business partner, about the Purdue model: it's like communism — the world hasn't seen it done without cheating yet. It SHOULD work. But c'mon.

He's right, and the reason is more interesting than "people are lazy."

What we are talking about

The Purdue Enterprise Reference Architecture came out of Purdue University in the early 1990s — Theodore Williams and an industry consortium. It describes manufacturing as a stack of levels. Level 0 is the physical process, the actual valves and motors. Level 1 is the controllers. Level 2 is supervisory control, the HMIs. Level 3 is site operations. Levels 4 and 5 are business systems and the enterprise. Practice later added Level 3.5, a DMZ between operations and the business network.

It is a genuinely good model. It gave a generation of engineers a shared vocabulary, it makes the blast radius of a compromise legible, and the core instinct — that the thing which can kill somebody should be several deliberate hops away from the thing that reads email — is correct.

I am not here to say Purdue is wrong. I am here to say that in twenty-five years of deployment, essentially nobody runs it as written, and the interesting question is why.

Every violation is load-bearing

The cheating is not sloppiness. In almost every case the violation exists because the business requires a data flow the model forbids.

The engineer's laptop. We published a post earlier today about four code-execution bugs in Rockwell Arena Simulation, and the whole argument was that the machine running Arena also tends to hold the PLC programming software, the HMI project files, the network diagrams, and the vendor VPN client. That single laptop bridges Level 2 and Level 4. It is not a mistake. You cannot ask an engineer to design a production line without touching both the design tools and the controllers. The model says two zones; reality says one person, one laptop, one badge.

Vendor remote access. The turbine OEM's warranty requires them to monitor the asset. So there is a remote-access tool reaching into Level 2, and that contract outranks your architecture diagram. Every plant has some version of this and most have several.

Data has to go up and commands have to come down. Purdue was designed when data flowed in one direction and analytics happened in a basement. Now the historian needs to reach the plant, MES writes setpoints, and predictive maintenance is a cloud service somebody bought because it demonstrably reduces downtime. Those flows are not security failures. They are the reason the plant is profitable.

IIoT skips the stack entirely. A vibration sensor with an LTE modem does not traverse levels. It is Level 0 talking directly to a vendor cloud over a carrier network, installed by the reliability team, and IT found out about it later. There is no level for that. The model has no vocabulary for a device that exits sideways.

Level 3.5 becomes swiss cheese. The DMZ starts as one firewall with a clean rule set. Three years later it is two hundred exceptions, half of them for vendors, documented in a spreadsheet maintained by somebody who has since retired. Nobody can safely remove a rule because nobody knows what it was for.

And nobody re-architects a plant built in 1987. Purdue implicitly assumes greenfield. Every real deployment is a retrofit onto a network that grew by accretion, one acquisition and one emergency at a time.

Here is the actual failure

Purdue is a reference architecture. It got adopted as a compliance one.

That distinction is where the damage happens. A reference architecture is a thinking tool — it helps you reason about where risk concentrates. The moment an auditor, a customer questionnaire, or a cyber-insurance form starts asking "are you Purdue-aligned?", the incentive stops being understand your plant and becomes produce a diagram that says yes.

So you get two architectures. The documented one, which is clean and hierarchical and passes the audit. And the real one, which has the engineer's dual-homed laptop and the OEM's remote session and the sensor with the LTE modem.

The real one is undocumented precisely because admitting it would fail the assessment.

That is worse than never having adopted the model. An organization that honestly says "we have a flat network and here are our three worst exposures" is in better shape than one whose diagram shows six clean levels and whose actual bridges are invisible to its own security team. Compliance pressure converted honest violations into hidden ones. You cannot put a control on a conduit you are pretending does not exist.

Which is why 62443 is the more honest frame

IEC 62443's zones-and-conduits model does not pretend the flows are absent. You define zones by risk, then you declare every conduit between them and defend it.

The difference is not academic. "This engineering workstation bridges the enterprise zone and the control zone; it is hardened, its Arena installation is on 17.00.01, simulation files from suppliers are scanned, and it cannot initiate outbound sessions to the internet" is a sentence you can audit, test, and improve.

"We are Purdue-aligned" is not a sentence. It is a wish with a diagram attached.

A declared conduit gets a control, a monitor, and an owner. A denied conduit gets nothing, and it is still there.

Meanwhile, the attackers are not even playing this game

Here is the part that should reframe the whole argument for anyone about to spend a quarter on segmentation.

We have been tracking CyberAv3ngers all year. They compromise internet-exposed water and energy controllers, and our own coverage summarized their method as reading the manual, not the zero-day — default credentials on devices that are simply reachable from the internet. In April, six US agencies published a joint advisory on IRGC-affiliated actors doing this, and the exposed population was in the thousands. When four agencies warned about exposed automatic tank gauges, we ran the hunt and found 5,573 sitting on the open internet.

None of that involves defeating a segmentation model. You do not need to traverse Level 4 to Level 1 when Level 1 has a public IP address.

And when Handala hit California Water Service, they took the billing database and a GPS server — not the water supply. The headlines reached for Iranian hackers in the drinking water. The accurate read was that they hit the business side, because the business side is where the reachable, monetizable, embarrassing data lives.

So the honest priority order is: first, nothing that controls a physical process should be directly reachable from the internet. That single control defeats the actual observed tradecraft of the actors we track. Segmentation architecture is the second problem, and it matters, but a beautiful Purdue diagram with a Shodan-visible PLC is a locked vault with the window open.

What I would actually do

Draw the real diagram. Not the one for the auditor. The one with the dual-homed laptops, the vendor tunnels, the cloud-connected sensors, and the two hundred DMZ exceptions. Do it without blame, because every single one of those was somebody solving a real problem. You cannot defend an estate you have agreed to misdescribe.

Convert each cheat into a declared conduit. Name it, give it an owner, put a control on it, monitor it. The goal is not zero conduits. It is zero undeclared conduits.

Get the physical-process layer off the internet first. Before the segmentation project, before the budget cycle. Shodan your own address space. This is the cheapest, highest-value hour available to an OT program.

Treat the engineering workstation as a control-system asset. If it has PLC programming software on it, it is not an office desktop, regardless of which cost center bought it or which network jack it uses.

Stop asking vendors whether they are Purdue-aligned. Ask which zones their product bridges and what the conduit looks like. The first question invites a wish. The second gets an answer you can verify.

The fair caveat

Purdue did not fail because it was wrong. It was written for a world where data flowed one direction, plants were built once, and nothing had a cellular modem. It has been asked to govern twenty-five years of change it was never designed for, and it survived that long because the core idea is sound.

The model is not the problem. Auditing a thinking tool as though it were a specification is the problem — that is what turned reasonable engineering compromises into secrets an organization keeps from itself.

We are 95 percent confident the next significant OT incident we cover involves an internet-reachable device or a dual-homed workstation rather than a defeated segmentation boundary, because that is what every case this year has looked like. The remaining five percent would be genuinely interesting: an actor who actually had to work their way down the levels. We have not seen one lately, and the reason is that nobody has made them.

Free IP, domain, hash, and malicious-package blocklists at analytics.dugganusa.com. If you run a plant and cannot afford a threat-intel contract, the feed costs nothing and always will.

---

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com