Skip to main content
OT Atlas

Architecture

Designing a defensible OT network

Reference architecture guidance built for control systems — reliability, determinism and safety come before elegance.

Model

The Purdue model

Level-by-level breakdown of systems, communications, controls, common mistakes and monitoring.

Zones & conduits

Segmentation

How to split an OT estate into zones and conduits without breaking the process.

Access

Secure remote access

Vendor and engineer access patterns that do not create a straight path to a controller.

Layered cyber-physical architecture: Enterprise/Cloud at the top, Business Systems, Security/DMZ, Site Operations, Supervisory/Control, and Physical Process at the bottom, joined by protected conduits.
Zones stack by consequence from enterprise to physical process; conduits are the only allowed paths between them.

Principles

Architecture principles for cyber-physical systems

  • Design around consequence: the closer a zone is to the physical process, the fewer paths into it should exist.
  • IT and OT meet in exactly one place — an industrial DMZ where sessions and data flows terminate on both sides.
  • No industrial protocol should traverse the boundary untouched; broker, replicate or proxy instead.
  • Every conduit has a named purpose, a named owner, an explicit peer list and a review date.
  • Availability and safety constrain the control: a control that risks a trip is not a control, it is an incident waiting.
  • Assume field devices cannot defend themselves; the network and the engineering process are the control surface.

Why should I care?

Architecture is the highest-leverage OT control. Most industrial devices cannot be patched quickly or hardened deeply, so the network design, not the endpoint, is where the risk is actually reduced.