Build an OT/ICS network the way the Purdue model intends — six levels plus an IT/OT DMZ — then draw the conduits between zones and let the lab grade your segmentation against ISA/IEC 62443. It rewards a real DMZ that brokers every IT↔OT flow, default-deny between non-adjacent levels, a replicated historian, and no flat path from the enterprise to the plant floor. Everything runs in your browser; nothing you build is uploaded.
A
100/100
Well segmented
0
Critical
0
High
L5EnterpriseCorporate network & internet
The corporate/enterprise network and its internet and cloud connectivity: data centers, corporate AD, SaaS, VPN concentrators and the open internet. The most exposed tier in the whole architecture.
Site-level business IT: ERP, plant scheduling that feeds the business, email, file servers and engineering document stores. Standard enterprise IT lifecycle — patched, internet-adjacent, phished.
Protocols: HTTPS, SMTP, SMB, SQL, LDAP
No assets placed.
DMZIT/OT DMZThe broker between IT and OT broker zone
The demilitarized zone that terminates every IT↔OT flow. Replicated historians, patch/WSUS/AV staging, reverse proxies, jump hosts and remote-access brokers live here so that no session ever spans IT and OT in one hop.
Site-wide operations management (MOM/MES): production scheduling, batch management, the plant historian, OT Active Directory/domain services and OT patch/AV management. The top of the OT trust zone.
Protocols: OPC UA, SQL, MQTT, Historian APIs, HTTPS (internal)
No assets placed.
L2Supervisory ControlOperators watch and steer the cell
Area/cell supervisory systems: HMIs, SCADA servers, engineering workstations (EWS) and local alarm/historian collectors. This is where operators observe and issue setpoints for a line or unit.
The controllers that read Level 0 and drive it in real time: PLCs, RTUs, DCS controllers and safety instrumented systems (SIS). Deterministic, long-lived, and often unpatchable for years.
The physical equipment and instrumentation that does the work: sensors measuring the process and actuators acting on it. A compromise here has direct real-world, safety-of-life consequences.
Protocols: 4-20mA, HART, PROFIBUS-PA, Foundation Fieldbus, IO-Link
No assets placed.
Conduits (allowed flows)
Declare which zones may talk. Each is scored live against IEC 62443.
No conduits declared yet.
Zone map
Allowed Review Forbidden
Findings
No segmentation violations in the current design.
How the design is scored
The lab evaluates your zones and conduits against these ISA/IEC 62443 zone-and-conduit expectations.
criticalIEC 62443-3-3 SR 5.1 / zone-conduit
An IT/OT DMZ exists and brokers all IT↔OT traffic
Without a 3.5 DMZ, every IT↔OT flow is a direct conduit between a high-exposure zone and the process.
criticalIEC 62443 zone-conduit / Purdue hierarchy
No flat path from IT (L4/L5) to control/field (L0/L1)
A direct enterprise/business → controller path is the classic ransomware and remote-attacker route to physical impact.
highIEC 62443-3-3 SR 5.2
Default-deny between non-adjacent levels
Level-skipping conduits defeat the hierarchical containment the model exists to provide.
highIEC 62443 reference architecture
Historian data reaches IT via a DMZ replica, not the live plant historian
Exposing the live L3 historian to IT puts a production system one query away from the enterprise network.
highIEC 62443-3-3 SR 1.x / SR 2.x
No inbound interactive remote access (RDP/VNC/SSH/Telnet) into L0–L2
Interactive sessions into supervisory/control let an attacker operate the process by hand.
mediumIEC 62443-3-3 SR 1.5 / 4.1
No plaintext management protocols (Telnet/FTP/TFTP/HTTP/SNMPv1-2c) into OT
Plaintext credentials and config over the OT network are trivially sniffed or spoofed.
highIEC 62443 conduit restriction
Control-protocol writes (Modbus/DNP3/S7/EtherNet-IP) originate only inside the cell
A control write from outside the cell/area zone can change physical state from an untrusted origin.
highIEC 62443-3-3 SR 5.2 (least privilege)
No any/any allows across a zone boundary
An any-any conduit is the absence of segmentation dressed up as a rule.
highIEC 62443 / IEC 61511
Safety systems (SIS) are isolated from routine control conduits
A compromised basic-control path must not be able to reach the safety instrumented system.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout