purdue-model-zone-conduit-auditlisted

## When to Use - Validating zone definitions before a remediation program. - Reviewing segmentation after a network change. - Auditing conduit protocols against the approved list. - Pre-purchase review of a proposed L3.5 DMZ design. ## Prerequisites - Zone map and conduit list from the site, or from `iec-62443-gap-assessment`. - Network diagrams at L0 through L4. - Flow data: `flows.csv` from `passive-ot-network-discovery`. - Firewall and switch configs that enforce the boundaries. - Credentials: none. - Authorization: site security manager sign-off. - Upstream skills: `passive-ot-network-discovery` for flow data. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Document and flow analysis. Sends no packets. Safe to run during normal operations. ## Workflow 1. Load the zone map, diagram set, and `flows.csv`. 2. For each zone record: name, level (L0 through L4, L3.5), membership list, and the enforcement device for its boundary. 3. For each conduit record: endpoints, protocols, and purpose. 4. Decision point: a flow in `flows.csv` that matches no zone or conduit record is an undocumented conduit. It is a finding. 5. Check Purdue level separation: - No flow from L0 or L1 directly to L4. - No L3.5 to L1 conduit except through gateway devices. - The DMZ is the only path between L3 and L4. Each violation is a finding with the flow pair as evidence. 6. Check conduit protocol scope. A conduit carrying protocol