Mike Holcomb’s Post

What the heck is... the Purdue Model in ICS/OT cyber security? The Purdue Model is often where cyber security starts at an ICS/OT site. The model was designed as a structured and layered approach to describing how OT interacts with IT - which can then in turn be used as a starter for cyber security. It focuses on functional segmentation, very much like network segmentation works in IT networks, as the primary way for breaking up the ICS/OT environment into logical levels. Between some, if not all, of these levels, the asset owners and operators can place firewalls to restrict which traffic is allowed to flow in and out of each level. By restricting network traffic, we can make the environment much more challenging, though not impossible, for cyber attackers to move through. The more difficult we make life on the attackers in the ICS/OT network, the more opportunity we have to be able to detect their activity and respond appropriately. The Purdue Model separates the ICS/OT network into seven levels (starting from the top): Level 4 & 5: IT Enterprise Network The top two levels represent the IT network. While there can be some technical differences between the two, these are almost always treated as a single level. Level 3.5: OT/IT DMZ Like a traditional IT DMZ that many might be familiar with, this level acts as a secure border between the OT and the IT networks. Level 3: Site Operations In larger environments, you could have multiple areas under supervisory control (see Level 2). When multiple systems of systems exist within the entire site, all roll up to be monitored and controlled as a single entity. This level can also be responsible for collecting all of the relevant process data within the site to provide to the business in the IT network. Level 2: Supervisory Control This level allows those responsible for operating and maintaining a portion of the facility, such as a particular process, to monitor how the control systems are running in that particular section and to make adjustments as necessary. Level 1: Basic Control This is where we see the control systems which act as a gateway or translator between the digital and physical worlds. For example, here is where we have the Programmable Logic Controller (PLC) that has a network connection to receive instructions and at the same time is hardwired into the physical equipment such as a combustion chamber. Level 0: Process At the lowest level, this is where field devices and equipment implement the processes which control physical activity in the real world. For example, in a power plant, this is where we would ignite a combustion chamber, to spin a turbine and in turn spin a generator. Thank you for reading! __________________________________________ Interested in learning more about industrial (ICS/OT) cyber security? Join 2,100+ subscribers of my weekly newsletter - Guarding the Gears! Sign up today at https://lnkd.in/gsYk_gtv! Thank you to all that have already signed up!

What the heck is... the Purdue Model in ICS/OT cyber security? The Purdue Model is often where cyber security starts at an ICS/OT site. The model was designed as a structured and layered approach to describing how OT interacts with IT - which can then in turn be used as a starter for cyber security. It focuses on functional segmentation, very much like network segmentation works in IT networks, as the primary way for breaking up the ICS/OT environment into logical levels. Between some, if not all, of these levels, the asset owners and operators can place firewalls to restrict which traffic is allowed to flow in and out of each level. By restricting network traffic, we can make the environment much more challenging, though not impossible, for cyber attackers to move through. The more difficult we make life on the attackers in the ICS/OT network, the more opportunity we have to be able to detect their activity and respond appropriately. The Purdue Model separates the ICS/OT network into seven levels (starting from the top): Level 4 & 5: IT Enterprise Network The top two levels represent the IT network. While there can be some technical differences between the two, these are almost always treated as a single level. Level 3.5: OT/IT DMZ Like a traditional IT DMZ that many might be familiar with, this level acts as a secure border between the OT and the IT networks. Level 3: Site Operations In larger environments, you could have multiple areas under supervisory control (see Level 2). When multiple systems of systems exist within the entire site, all roll up to be monitored and controlled as a single entity. This level can also be responsible for collecting all of the relevant process data within the site to provide to the business in the IT network. Level 2: Supervisory Control This level allows those responsible for operating and maintaining a portion of the facility, such as a particular process, to monitor how the control systems are running in that particular section and to make adjustments as necessary. Level 1: Basic Control This is where we see the control systems which act as a gateway or translator between the digital and physical worlds. For example, here is where we have the Programmable Logic Controller (PLC) that has a network connection to receive instructions and at the same time is hardwired into the physical equipment such as a combustion chamber. Level 0: Process At the lowest level, this is where field devices and equipment implement the processes which control physical activity in the real world. For example, in a power plant, this is where we would ignite a combustion chamber, to spin a turbine and in turn spin a generator. Any other thoughts on what the Purdue Model includes or offers from a cyber security perspective? #CyberSecurity #Power #Safety #Petrochemical #Refinery #Cyber #UtilsSec #ICSSecurity #OTSecurity #Technology #Engineering #Rail

What the heck is... the Purdue Model in ICS/OT cyber security? The Purdue Model is often where cyber security starts at an ICS/OT site. The model was designed as a structured and layered approach to describing how OT interacts with IT - which can then in turn be used as a starter for cyber security. It focuses on functional segmentation, very much like network segmentation works in IT networks, as the primary way for breaking up the ICS/OT environment into logical levels. Between some, if not all, of these levels, the asset owners and operators can place firewalls to restrict which traffic is allowed to flow in and out of each level. By restricting network traffic, we can make the environment much more challenging, though not impossible, for cyber attackers to move through. The more difficult we make life on the attackers in the ICS/OT network, the more opportunity we have to be able to detect their activity and respond appropriately. The Purdue Model separates the ICS/OT network into seven levels (starting from the top): Level 4 & 5: IT Enterprise Network The top two levels represent the IT network. While there can be some technical differences between the two, these are almost always treated as a single level. Level 3.5: OT/IT DMZ Like a traditional IT DMZ that many might be familiar with, this level acts as a secure border between the OT and the IT networks. Level 3: Site Operations In larger environments, you could have multiple areas under supervisory control (see Level 2). When multiple systems of systems exist within the entire site, all roll up to be monitored and controlled as a single entity. This level can also be responsible for collecting all of the relevant process data within the site to provide to the business in the IT network. Level 2: Supervisory Control This level allows those responsible for operating and maintaining a portion of the facility, such as a particular process, to monitor how the control systems are running in that particular section and to make adjustments as necessary. Level 1: Basic Control This is where we see the control systems which act as a gateway or translator between the digital and physical worlds. For example, here is where we have the Programmable Logic Controller (PLC) that has a network connection to receive instructions and at the same time is hardwired into the physical equipment such as a combustion chamber. Level 0: Process At the lowest level, this is where field devices and equipment implement the processes which control physical activity in the real world. For example, in a power plant, this is where we would ignite a combustion chamber, to spin a turbine and in turn spin a generator. Any other thoughts on what the Purdue Model includes or offers from a cyber security perspective? #CyberSecurity #Power #Safety #Petrochemical #Refinery #Cyber #UtilsSec #ICSSecurity #OTSecurity #Technology #Engineering #Rail