Architecture
Designing a defensible OT network
Reference architecture guidance built for control systems — reliability, determinism and safety come before elegance.
Model
The Purdue model
Level-by-level breakdown of systems, communications, controls, common mistakes and monitoring.
Zones & conduits
Segmentation
How to split an OT estate into zones and conduits without breaking the process.
Access
Secure remote access
Vendor and engineer access patterns that do not create a straight path to a controller.
Principles
Architecture principles for cyber-physical systems
- Design around consequence: the closer a zone is to the physical process, the fewer paths into it should exist.
- IT and OT meet in exactly one place — an industrial DMZ where sessions and data flows terminate on both sides.
- No industrial protocol should traverse the boundary untouched; broker, replicate or proxy instead.
- Every conduit has a named purpose, a named owner, an explicit peer list and a review date.
- Availability and safety constrain the control: a control that risks a trip is not a control, it is an incident waiting.
- Assume field devices cannot defend themselves; the network and the engineering process are the control surface.
Why should I care?
Architecture is the highest-leverage OT control. Most industrial devices cannot be patched quickly or hardened deeply, so the network design, not the endpoint, is where the risk is actually reduced.