Fortinet FCF cheat sheet

OSI layers map to security devices: L1 physical, L2 switching/MAC filtering, L3 routing/ACLs and IPsec, L4 stateful inspection and port-based policy, L7 application control, IPS, and web filtering.

TCP is connection-oriented with a three-way handshake (SYN, SYN-ACK, ACK) and per-flow state; UDP is connectionless and stateless, so UDP-based inspection relies on heuristics and timeouts rather than session state.

Stateful firewalls track a session table keyed on 5-tuple (source IP, destination IP, source port, destination port, protocol); return traffic is permitted by session match rather than a separate inbound rule.

NAT modes: source NAT (SNAT) hides internal addresses on egress; destination NAT (DNAT or virtual IP) publishes an internal server; port forwarding maps one external port to an internal host/port.

IPsec has two phases: IKE Phase 1 builds an ISAKMP/IKE SA (authentication, DH key exchange, encryption for the tunnel), Phase 2 builds IPsec SAs for ESP/AH; main mode hides identities, aggressive mode exposes them.

ESP provides confidentiality plus optional integrity/authentication; AH provides integrity and authentication only and does not encrypt, and AH is incompatible with NAT because it hashes the IP header.

Zone-based policy assigns interfaces to zones (for example trust, untrust, DMZ) and permits or denies inter-zone traffic; intra-zone traffic is a separate policy decision, not automatically allowed.

UTM/NGFW inspection order matters: firewall policy first, then security profiles (IPS, antivirus, application control, web filter) applied per policy; a profile only inspects traffic the policy accepts.

Segmentation limits lateral movement: VLANs separate broadcast domains at L2, VRFs and virtual domains separate routing tables, and a DMZ isolates internet-facing services from internal hosts.

SOC tiers: Tier 1 triages and closes false positives, Tier 2 investigates and contains, Tier 3 performs threat hunting and advanced response; escalation criteria are defined in runbooks.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned (post-incident review).

True positive, false positive, true negative, false negative: a false negative is a missed detection and is the costliest error class for security monitoring.

Detection sources include SIEM correlation, IDS/IPS alerts, EDR telemetry, firewall and proxy logs, DNS logs, authentication logs, and threat intelligence feeds.

Log retention and time synchronization: NTP-aligned timestamps are required to correlate events across devices; skewed clocks break timeline reconstruction.

Key operational metrics: MTTD (mean time to detect), MTTA (acknowledge), MTTR (respond/resolve), alert volume, and false-positive rate.

Vulnerability management cycle: asset inventory, scan, prioritize by severity and exploitability (for example CVSS plus known-exploited status), remediate or mitigate, then verify.

Change management requires documented request, risk assessment, approval, scheduled window, rollback plan, and post-change verification to avoid outages and audit findings.

Playbooks automate repeatable response (block IP, isolate host, disable account); SOAR orchestration reduces MTTR but requires human approval for destructive actions.

Shared responsibility: the provider secures the cloud (physical, hypervisor, managed service infrastructure); the customer secures in the cloud (identity, data, configurations, workloads).

Service models shift responsibility: IaaS leaves OS and above to the customer; PaaS leaves application and data; SaaS leaves mainly identity, data, and configuration to the customer.

Identity is the primary control plane: enforce least privilege, MFA on all privileged accounts, role-based access, and removal of long-lived access keys in favor of short-lived credentials.

Storage misconfiguration is a leading breach cause: public object buckets, disabled encryption, and overly permissive bucket policies must be audited continuously.

Network controls: security groups are stateful instance-level allow rules; network ACLs are stateless subnet-level rules evaluated in numbered order; both default-deny unless a rule permits.

Logging and monitoring: enable cloud audit/activity logs, flow logs, and configuration-change trails, and forward them to a central SIEM so account-level tampering cannot erase evidence.

Encryption: data at rest via provider-managed or customer-managed keys (CMK/HSM); data in transit via TLS; key custody and rotation determine the customer's residual risk.

CSPM and posture management continuously detect drift from baselines (public buckets, open management ports, unused credentials) and map findings to compliance frameworks.

Multi-tenancy and isolation rely on hypervisor and network virtualization; a customer cannot rely on physical separation, so logical controls and tenant boundaries must be verified.

CIA triad: confidentiality (encryption, access control), integrity (hashing, signatures), availability (redundancy, DDoS protection); a control usually serves one primary goal.

Authentication versus authorization versus accounting: prove identity, grant permissions, then record actions; MFA combines factors from knowledge, possession, and inherence categories.

Symmetric encryption (AES) is fast and used for bulk data; asymmetric (RSA, ECC) solves key exchange and signatures; TLS combines both, using asymmetric handshake then symmetric session keys.

Hashing (SHA-256) is one-way and used for integrity; salting defends stored password hashes against rainbow tables; HMAC adds a shared key for authenticity.

Common attack classes: phishing/social engineering, malware and ransomware, credential stuffing and password spraying, injection, XSS, CSRF, and man-in-the-middle.

Defense in depth layers preventive, detective, and corrective controls; no single control is assumed sufficient, and compensating controls cover gaps.

Zero trust replaces implicit network trust with explicit verification per request: authenticate and authorize every session based on identity, device posture, and context.

Risk = likelihood x impact; treatment options are mitigate, transfer, avoid, or accept; residual risk is what remains after controls are applied.

Least privilege and separation of duties limit blast radius; privileged access management and just-in-time elevation reduce standing administrative exposure.