Fortinet OT Security Architect flashcards
Fortinet OT Security Architect · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Purdue Level 3.5
- The industrial DMZ between operations (level 3) and enterprise IT (level 4). It terminates IT-OT sessions using proxies, jump hosts, or data diodes so no direct path exists into control networks.
- IEC 62443 Zone
- A grouping of OT assets that share common security requirements and trust level. Communication between zones is only allowed through controlled conduits, which are monitored and policy-enforced.
- IEC 62443 Conduit
- The sole permitted communication path between two zones. It must be controlled, restricted to required protocols and function codes, and logged so unauthorized traffic is detected and blocked.
- OT Priority Order (SIC)
- Safety first, then availability, integrity, and confidentiality. Unlike IT's CIA order, OT design rejects controls that risk process availability or personnel safety, even if they improve confidentiality.
- Unauthenticated OT Protocols
- Modbus/TCP, DNP3, IEC 60870-5-104, and EtherNet/IP carry no native authentication or encryption. Identity and policy enforcement must therefore be provided by the network fabric, not the endpoint.
- Security Level SL3
- An IEC 62443 target level meaning the system resists attackers with moderate resources and OT-specific knowledge. SL4 addresses nation-state-level adversaries with extended resources.
- Transparent Mode FortiGate
- A virtual-wire deployment that forwards traffic without IP reconfiguration. It is preferred in OT because insertion requires no routing change and policy drops do not break network addressing.
- Industrial Protocol Signatures
- FortiGate profiles that inspect Modbus, DNP3, IEC 104, and similar protocols at function-code and register level. They allowlist expected operations and block unknown function codes in block mode.
- FortiDeceptor in OT
- A deception platform deploying decoys that imitate HMI, PLC, and historian assets. Any interaction is high-fidelity because legitimate OT traffic never contacts these decoy addresses.
- FortiNAC Quarantine VLAN
- A registration network where FortiNAC places unknown or non-compliant OT devices. It isolates the device without altering PLC configuration, allowing profiling before production access is granted.
- FGCP HA in OT
- FortiGate clustering for inline redundancy. Failover must be tested against the live process because gratuitous ARP and session resync can interrupt long-lived control sessions.
- FortiManager Metadata Variables
- Per-device variables such as site, zone, and criticality that populate a shared policy package. They let one package provision consistent OT policy across many sites.
- Passive OT Monitoring
- Observing mirrored traffic instead of scanning. It is mandatory where active probing risks crashing level 0-2 devices, and it feeds FortiAnalyzer or FortiSIEM for anomaly detection.
- Conduit Deny Baseline
- Logging every denied flow on an OT conduit and every allowed industrial function code. Deviations from the expected function-code baseline become high-value detection alerts.
- PLC Program Download Alert
- A detection for controller logic upload or download events. These indicate engineering changes and are among the strongest indicators of unauthorized manipulation in an OT network.
- MITRE ATT&CK for ICS
- A knowledge base of adversary tactics against industrial control systems, including Inhibit Response Function and Impact. OT alerts are mapped to it for consistent triage context.
- OT Log Retention
- OT logs are typically retained twelve months or longer, exceeding common IT retention. The longer window supports incident reconstruction and regulatory audit of control-network events.
- Containment Versus Shutdown
- In OT incident response, isolating a zone through policy is preferred over powering off a controller. Unexpected loss of a PLC can create a physical safety hazard.
- Pre-Change Config Backup
- Capturing a FortiGate configuration file or FortiManager revision before any OT change. Change windows are scheduled and a tested rollback must exist before modification begins.
- Protocol Profile Block Mode
- A FortiGate industrial profile setting that drops function codes not on the allowlist. Premature use blocks legitimate traffic; learn in monitor mode first, then enable blocking.
- OT Session Timers
- TCP and idle timeouts must exceed the polling interval of HMIs and SCADA masters. Default IT timers are often shorter than OT poll cycles and cause intermittent session drops.
- Diagnose Debug Flow
- A FortiGate command that traces a packet through policy lookup and shows the drop reason. It distinguishes firewall policy denial from endpoint or routing failure.
- HA Firmware Upgrade Order
- Upgrade the secondary unit, fail over, validate conduit traffic, then upgrade the primary. Never upgrade both cluster members simultaneously in a live plant.
- OT Management Zone
- A dedicated segment for administering OT firewalls, protected by MFA and role-based admin profiles. Direct management from level 4 or the Internet violates conduit design.
- Security Fabric Connectors
- FortiGate integrations that push logs and asset data to FortiSIEM, FortiAnalyzer, FortiManager, and FortiNAC. They tie OT telemetry into a single correlated view.
- Syslog Export to SIEM
- FortiGate forwards OT logs to third-party SIEMs using RFC 5424 syslog or CEF/LEEF formatting for platforms such as ArcSight and QRadar.
- FortiNAC with FortiGate
- FortiNAC acts as the decision point and FortiGate as the enforcement point. FortiNAC signals via RADIUS change of authorization, and FortiGate applies dynamic address group policy.
- IPS Monitor Mode First
- New IPS signatures are applied in monitor mode before blocking. In OT, a false positive can drop control traffic and disrupt the process, so validation precedes enforcement.
- FortiGate REST API
- A programmatic interface for automated provisioning and monitoring. Access uses least-privilege admin profiles scoped to the OT policy package, never a super-admin token.
- NetFlow Versus Protocol Logs
- NetFlow reveals flow volume and endpoints but not industrial function codes. Pair it with protocol-aware logs to see what operations were attempted on the control network.
- FortiEDR on Level 3
- Endpoint protection deployed on engineering workstations and historians. Level 0-2 devices generally cannot host agents, so network segmentation remains their only control.
- STIX/TAXII Feeds
- Threat-intelligence feeds that update FortiGate ISDB and IPS signatures. In OT they are validated in monitor mode because blocking on unverified indicators risks control traffic.