Chapter 16 — Security architecture
Lesson map
Lesson 16 published. Map, example, EX046.
flowchart TD
N0["Learning outcomes"]
N1["16.1 Purdue levels as a starting map"]
N2["16.2 The industrial DMZ"]
N3["16.3 Security levels"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX046"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 Purdue levels as a starting map"]
N2["16.2 The industrial DMZ"]
N3["16.3 Security levels"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX046"]
[Learning outcomes]
|
v
[16.1 Purdue levels as a starting map]
|
v
[16.2 The industrial DMZ]
|
v
[16.3 Security levels]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX046]
Learning outcomes
You will (1) place LDHP assets in the Purdue reference levels; (2) design a DMZ between enterprise and control zones; (3) assign target security levels to zones using IEC 62443-3-2 concepts; and (4) explain defence in depth without claiming that any single layer is sufficient.
16.1 Purdue levels as a starting map
The Purdue model numbers levels from the physical process (0) through sensors and actuators (1), supervisory control (2), site operations (3) up to enterprise (4–5). It is old and imperfect — cloud services and IIoT gateways blur the levels — but it gives a shared vocabulary. At LDHP, transmitters and the boiler are level 0–1, PLC-H and SIS-H level 1, SCADA and HMI level 2, HIST-1 level 3, and billing and e-mail level 4.
The map's value is in where LDHP's devices do not fit: the meter gateways and the billing cloud sit outside the levels, and SIS-H shares level 1 with PLC-H while needing to stay independent of it.
16.2 The industrial DMZ
Between levels 3 and 4 sits a demilitarised zone holding systems both sides need: a historian replica, a patch server, a jump host for remote access. The rule is that no session crosses the DMZ end to end; enterprise users connect to DMZ services, and control-zone systems push or are pulled by DMZ services. NIST SP 800-82r3 describes this pattern in its discussion of defence-in-depth architecture.
At LDHP the DMZ would hold the historian replica that billing and analytics read, the patch server for HMI-1 and the jump host that vendor sessions reach before any control-zone system.
16.3 Security levels
IEC 62443 defines security levels SL 1–4 by the attacker a zone must resist, from casual or coincidental violation (SL 1) up to sophisticated means with extended resources (SL 4). Risk assessment sets a target level (SL-T) per zone; components then need capabilities (SL-C) that, with compensating measures, achieve it (SL-A).
Maya's proposal sets SL-T 3 for the boiler control zone because its compromise can cut heat to thousands of homes, SL-T 2 for the meter zone, and no routable conduits at all for SIS-H. PLC-H's own SL-C is low, since it cannot authenticate Modbus clients, so reaching SL-A 3 depends on the compensating controls around it.
Worked example (synthetic LDHP)
Maya proposes SL-T 3 for the boiler control zone (PLC-H, HMI-1), SL-T 2 for the IoT meter zone, and keeps SIS-H as its own zone with no routable conduits at all. Rationale: control-zone compromise can cause loss of heat to thousands of homes; meter compromise mainly affects billing and privacy; the SIS must remain independent of both.
Synthetic case — Lakeside District Heating Plant. Security-level choices here illustrate reasoning; a real assessment follows IEC 62443-3-2's documented process.
Errors and limits
A DMZ with a firewall rule "any → any" between its halves is a diagram, not a control. Purdue levels do not dictate trust; an IIoT sensor may talk directly to a cloud service and must be zoned on its own merits.
Exercises
- EX046 — Placing the meter gateway. Where would you place LDHP's IoT meter gateway in or around the Purdue model, and why does it not fit neatly? Rubric: 3 = own zone (often beside level 3/DMZ) because it bridges field devices and a cloud service; 2 = level without reason; 1 = level 1 inside control zone; 0 = none.
- EX047 — A DMZ rule set. Write two firewall rules that let enterprise users see historian data without reaching HIST-1. Rubric: 3 = HIST-1 → DMZ replica (push) and Enterprise → replica (read), no Enterprise → HIST-1; 2 = one; 1 = direct rule; 0 = none.
- EX048 — Justifying SL-T 3. In two sentences, justify SL-T 3 for the boiler control zone. Rubric: 3 = consequence severity and plausible skilled attacker; 2 = one; 1 = "it is important"; 0 = none.
Synthesis
Architecture is the art of deciding which sessions may exist; zones, conduits, a real DMZ and security levels make those decisions explicit and testable.
Continue studying — chapter 16 of 40
← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →