The Purdue Enterprise Reference Architecture (PERA) splits an industrial network into numbered levels: Level 0 physical sensors/actuators, Level 1 PLC controllers, Level 2 SCADA/HMI, Level 3 site manufacturing operations, a Level 3.5 DMZ buffer zone, and Level 4–5 corporate IT and the internet. Each level may only exchange traffic with its immediate neighbour, and the DMZ is the sole checkpoint between the corporate world and the industrial world — nothing is allowed to jump straight from Level 4–5 to Level 0–3.
Toggle segmentation OFF to see a flat network instead, where every level can reach every other level directly. Then click "Simulate corporate phishing breach" to release a compromised packet from a corporate workstation:
- Segmentation ON — the packet is intercepted at the Level 3.5 DMZ gateway and never reaches the PLC.
- Segmentation OFF — with no DMZ checkpoint the packet travels straight down and compromises the Level 1 PLC.
Real-world relevance: this DMZ chokepoint is the standard defence recommended by IEC 62443 and NIST for critical infrastructure. It is the reason a phishing email that compromises an office PC does not, by itself, let an attacker manipulate a pump, valve or turbine — the two networks are architecturally decoupled, not just password-protected.