Enterprise / Business: where intrusions begin
Enterprise IT · Purdue L5 - L4
Email, business apps, internet-facing edge. Initial access lands here: phishing, vulnerable edge devices, and PRC pre-positioning (Volt Typhoon).
⛔ Level 3.5: IT/OT DMZ + data diode · THE HARD LINE
One-way data out of OT, no path in. Enforced deterministically at the environment layer, never by trusting a model or a credential.
OT / Control network: safety & availability lead
Operations & Supervisory · L3
SCADA servers, historians, site operations: monitoring and control aggregation.
Control / HMI · L2
Human-machine interfaces and engineering workstations, where setpoints are changed.
Controllers · L1
PLCs and RTUs executing the control logic: the layer manipulated in CISA advisory AA26-097A.
Process & Safety · L0 + SIS
Sensors, actuators, and the Safety Instrumented System. Failure here is physical and irreversible: a flood, a blackout, a contaminant strike.
↻ Zero Trust applied to OT
1
Assume breach
Design controls as if an adversary already has a foothold in the OT network.
2
Identity & context, not location
Validate every access request on identity, context, and risk, not on where it sits in the network.
3
Dynamic segmentation
Treat segmentation as an enforceable, evolving policy, not a one-time architectural decision.
4
Continuous evaluation
Verify continuously and re-authorize; never trust-once-and-forget.
5
AI agents stay read-only
Agents observe, correlate, and advise, never in the safety loop, never actively scanning a fragile PLC.
Honest caveat: CISA states blanket IT-style zero trust on OT is "neither reasonable nor feasible." Safety and availability lead: the Purdue boundary, passive monitoring, and bounded autonomy still hold.