CYBRARY Why a plant is cut into zones
A flat network means one stolen laptop password can reach a controller. Zones exist so it cannot.
By the end you can
- Say in one sentence what a zone is and what a conduit is.
- Place the Purdue levels in order from the physical process up to business IT.
- Explain why the boundary between office IT and the plant is the one that matters most.
The idea in plain words
A zone is a group of equipment that is trusted to talk freely with itself because it does the same job and carries the same risk. A conduit is the only permitted way traffic crosses from one zone into another — a firewall pair, a jump host, a one-way data feed.
The point is not to stop an intruder getting in. It is to make sure that getting into the office network does not hand anybody a path to a machine that moves something heavy.
- Anything inside a zone can reach anything else inside it — so keep the zone small.
- Anything crossing zones goes through a conduit you chose, watched and can switch off.
- If you cannot name the conduit, the two zones are really one zone.
The levels, bottom to top
Control engineers stack a plant into reference levels (the Purdue model). Level 0 is the metal that moves; level 4 is the corporate network with mail in it. The DMZ at 3.5 is the brokered gap between them.
| Level | What lives there |
|---|---|
| L0 — Process | Sensors, valves and drives — the physical plant itself. |
| L1 — Basic control | PLCs and safety controllers running the logic. |
| L2 — Supervisory | HMIs, SCADA servers and engineering workstations. |
| L3 — Site operations | Historians, batch records and plant applications. |
| L3.5 — Industrial DMZ | The brokered boundary: jump hosts, replicated historian, patch staging. |
| L4 — Enterprise | Business IT — mail, ERP, the corporate directory. |
The zones on the Forge range
The plant floor range is built to those levels. These are the zones you can open.
| Zone | What it holds |
|---|---|
| Safety instrumented system (L0/L1, target SL3) | Safety controller and its interlocks, on its own conduit and never routed. |
| Line control zone (L1/L2, target SL3) | PLC-201 and PLC-204, HMI-110, the serial gateway GW-260. |
| Site operations zone (L3, target SL2) | HIST-320 process historian, batch records, the engineering workstation. |
| Industrial DMZ (L3.5, target SL2) | Replicated historian, jump host, patch staging — the only way in from business IT. |
| Enterprise zone (L4, target SL1) | Corporate IT. Treated as untrusted by everything below it. |
Check yourself
Two machines sit in different zones but nothing filters between them. What is true?
Which boundary usually matters most in an industrial breach?