Fortinet OT Security Architect key terms

A hierarchical reference model that layers industrial control systems from physical process (Level 0) up through enterprise IT (Level 5). It guides zone placement, conduit design, and where security controls such as firewalls are inserted.

The international standard series for industrial automation and control system security. It defines security levels, foundational requirements, zones and conduits, and requirements for asset owners, integrators, and product suppliers.

An IEC 62443 structuring approach in which assets sharing risk and security requirements are grouped into zones, and all permitted communication between zones flows through controlled conduits such as firewalls or data diodes.

An IEC 62443 measure of how well a system resists a defined threat category, ranging from SL1 against casual attack to SL4 against nation-state capability. Targets are set per zone and verified during design.

A buffer network between OT and enterprise IT where shared services such as historians, patch repositories, and jump hosts reside. Direct traffic between the two environments is terminated here rather than passed through.

Layering independent controls so that failure of any single control does not expose the industrial process. Layers typically include segmentation, endpoint hardening, monitoring, physical security, and recovery planning.

A maintained record of controllers, HMIs, engineering workstations, network devices, and their firmware and protocols. Accurate inventory underpins segmentation design, vulnerability prioritization, and passive monitoring baselines.

Complete physical separation of networks with no electronic connection. It is increasingly replaced by controlled segmentation because maintenance laptops, removable media, and vendor remote access erode true isolation.

A hardware device enforcing one-way data flow, typically from OT outward to IT or cloud. It allows telemetry export while physically preventing inbound sessions into the control network.

A one-way transfer solution, often software plus hardware, that moves files or telemetry across a security boundary with no return path. Used where bidirectional firewall rules are unacceptable to process owners.

An alternative safeguard applied when a required control cannot be implemented on a legacy or unpatchable device. Examples include strict segmentation, virtual patching via IPS signatures, and enhanced monitoring.

Blocking exploitation of a known vulnerability using intrusion prevention signatures or access rules instead of modifying the vulnerable device. Common where PLCs or HMIs cannot be updated or rebooted.

Dividing an industrial network into smaller policy-enforced segments to limit lateral movement and blast radius. Effective designs respect control-loop traffic patterns and avoid breaking latency-sensitive or proprietary protocols.

Granular policy enforcement at the workload or device level, often using host agents or virtual switches. In OT it is applied sparingly because many controllers cannot host agents or tolerate policy churn.

A firewall hardened for plant environments, supporting OT protocol inspection, ruggedized hardware, and transparent bridging. It enforces conduits between control zones without requiring readdressing of existing assets.

A firewall deployment in which the device bridges traffic without an IP address on the monitored segment. It is preferred in OT because existing device addressing and routing remain unchanged during insertion.

Two interfaces bound together so traffic entering one must exit the other, with policy applied in between. This enables inline inspection at a span point without altering Layer 3 topology.

Examining payload contents against protocol-aware parsers rather than only headers. In OT it detects malformed function codes, unauthorized writes to setpoints, and commands inconsistent with the process.

Identifying device vendor, model, firmware, and role from protocol responses and traffic patterns. It supports asset discovery where active scanning is prohibited by fragile control equipment.

Observing mirrored network traffic without injecting packets, so discovery and threat detection do not disturb sensitive equipment. It is the default discovery method for live process networks.

Probing devices directly to enumerate services and vulnerabilities. It can crash or stall legacy controllers, so it is normally restricted to maintenance windows and non-production segments.

A switch port configured to mirror selected traffic to a monitoring device. Correct sizing and direction of mirror sessions determine whether OT sensors see complete conversations.

A passive hardware device that copies link traffic to a monitoring port without affecting forwarding. Preferred over SPAN where full fidelity or link redundancy is required.

Baselining normal command sequences and flagging deviations, such as unexpected firmware downloads or writes outside scheduled batches. It catches process-level misuse that signature matching misses.

A platform aggregating logs and alerts for correlation, retention, and investigation. OT events are forwarded here with context such as asset criticality and process area to support triage.

Sending device and firewall event records to a central collector over UDP or TCP. Reliable OT logging requires confirming source interfaces, severity filters, and time synchronization.

Aligning clocks across OT devices and collectors so event timestamps can be correlated. Many control devices lack reliable time sources, so a local stratum source is often deployed.

Two firewalls configured so one takes over if the other fails, preserving conduit availability. In OT, failover must be tested against process tolerances because session loss can halt production.

Triggering a cluster failover when a monitored interface loses link, rather than waiting for heartbeat loss. It shortens outage detection on critical upstream or downstream plant links.

Recording raw frames on an interface for forensic or troubleshooting analysis. On OT firewalls it verifies whether traffic is dropped by policy, inspection, or interface-level issues.

The configured period events are stored to satisfy investigation and regulatory needs. OT incidents often surface weeks after the triggering change, so retention must exceed typical detection latency.

Predefined response steps executed manually or automatically when an alert fires, such as isolating a compromised HMI. Automation in OT must include safeguards against disrupting active production.

Policy and technical enforcement governing USB drives and other portable storage on plant systems. It addresses a leading malware entry path where networks are otherwise well segmented.

Vendor and staff connectivity into OT brokered through authenticated, logged, session-recorded gateways rather than direct VPN tunnels. Access is time-bound and limited to specific assets and protocols.

An intermediary server in a controlled zone through which administrators reach OT devices. It centralizes credentials, logging, and session recording while preventing direct workstation-to-controller paths.

A model that authenticates and authorizes every session regardless of network location. Applied to OT it emphasizes identity-aware access to engineering functions while preserving deterministic control traffic.

Granting only the permissions required for a role, such as read-only historian access versus PLC program download. It reduces the impact of compromised accounts on control systems.

A structured evaluation of likelihood and consequence for identified threats against plant assets. In OT, consequence includes safety, environmental, and production impact, not only data loss.

Programmatic exchange between security platforms, such as pushing asset context to a firewall or pulling alerts into a ticketing system. It keeps OT policy and monitoring data synchronized.

Continuously updated indicators and context about adversaries and exploits. In OT it is filtered for relevance to industrial protocols and vendors before driving blocks or alerts.