I85PREP
⌘ K
Fortinet OT Security Architect study materials
Fortinet OT Security Architect study resources

Fortinet OT Security Architect: OT Security Fundamentals and Architecture

Fortinet OT Security Architect · Work through your exam, one topic at a time.

All guide sections

OT Security Fundamentals and Architecture

The OT Security Fundamentals and Architecture domain tests whether you can speak both languages an OT engagement requires: the plant engineer's Purdue and IEC 62443 vocabulary, and Fortinet's product vocabulary. Expect items that ask you to place a control at the right layer, justify a zone boundary, or choose the Fortinet component that delivers visibility without touching production traffic.

Reference models you must be able to apply

  • Purdue Enterprise Reference Model: Level 0 process/physical, Level 1 basic control (PLCs, RTUs, safety instrumented systems), Level 2 supervisory (HMIs, SCADA servers, engineering workstations), Level 3 site operations (historians, MES, patch and AV servers), Level 3.5 DMZ, Levels 4-5 enterprise and cloud.
  • IEC 62443: zones (assets sharing common security requirements) and conduits (the controlled path between zones), plus target Security Levels SL1-SL4. IEC 62443 is the certifiable standard; Purdue is a topology reference. Many exam items hinge on that distinction.
  • Segmentation is the primary control. The "air gap" is a myth once you account for remote vendor support, USB media, wireless links and historian replication.

Why OT changes the security calculus

Availability and safety outrank confidentiality; many protocols are deterministic and unauthenticated (Modbus/TCP, DNP3, IEC 60870-5-104, PROFINET, EtherNet/IP); assets live 15-25 years and are often unpatchable, so detection and compensating controls carry more weight than patch cadence.

Where Fortinet fits

Fortinet's OT Security Fabric reuses the FortiOS/FortiGate platform, hardened appliances (FortiGate Rugged, FortiSwitch Rugged, FortiAP), and the FortiGate OT Security Service subscription, which adds industrial protocol decoders, asset identification and vulnerability detection. The recurring pattern is: see first (passive or mirrored traffic), segment second (conduits enforced by policy), then protect and manage centrally with FortiManager and FortiAnalyzer.

Worked example

An HMI at Level 2 must read tag data from a PLC at Level 1, and nothing else may cross. Reasoning: the two assets sit in different zones, so the crossing point is a conduit by definition. Implement it on a FortiGate in transparent (virtual wire pair) mode so no IP re-addressing is needed; enable the OT Security Service on that policy to fingerprint both endpoints; permit only TCP/502 in the HMI-to-PLC direction; log all denies. Do not start in blocking IPS mode, because you have no baseline yet of legitimate function codes.

Traps that cost marks

Equating Purdue levels with IEC 62443 zones and Security Levels; treating the OT Security Service as a substitute for segmentation; inserting an inline device where a SPAN port would do; forgetting that the Level 3.5 DMZ exists so that IT-to-OT sessions terminate rather than traverse.