OT Security Design and Deployment
This domain tests deployment mechanics: which FortiGate mode fits a given plant constraint, how policy is written for industrial protocols, and what must be true before you enforce rather than detect. Design questions usually describe a brownfield constraint (no re-addressing allowed, no downtime window, a safety loop that must not be touched) and ask for the correct insertion method.
Deployment modes and when each applies
- Transparent mode with a virtual wire pair: FortiGate bridges two interfaces, keeps existing IP addressing, and can sit inline as a bump-in-the-wire at a conduit. Default choice for brownfield segmentation.
- NAT/route mode: greenfield cells, new DMZs, or where the FortiGate is the gateway for a new subnet.
- One-arm sniffer: a single interface in sniffer mode fed by a SPAN/mirror port. Detection and asset discovery only; it blocks nothing.
- TAP-based monitoring: passive copy of traffic, appropriate where even a bridge is considered a risk.
Policy design rules
Write policy by asset pair, not by subnet: source PLC, destination historian, protocol and port. Use application control to constrain industrial protocol commands (for example permit read function codes while denying write function codes to a PLC from anything but the engineering workstation). Run IPS and OT signatures in monitor mode first, export logs, build the baseline, then move to block per rule. Deploy FortiSwitch with FortiLink where microsegmentation inside a cell is required, and FortiNAC where device profiling and onboarding visibility matter more than enforcement.
Worked example
A retrofit requires a conduit between a control zone and a site DMZ, and the plant refuses to re-address either side. Reasoning: transparent mode with a virtual wire pair preserves addressing and still applies UTM. The policy permits only the historian replication flow from the control-zone historian to the DMZ collector, enables the OT Security Service and IPS in monitor mode, and forwards logs to FortiAnalyzer. After two weeks of clean baseline, IPS flips to block for that rule only. High availability is deployed as an active-passive pair so a failed unit does not break the conduit.
Traps that cost marks
Enabling blocking IPS before baselining legitimate industrial traffic; forgetting that a sniffer interface cannot enforce policy; choosing NAT/route where re-addressing is contractually impossible; assuming the OT Security Service works without an active subscription and FortiGuard connectivity; ignoring that long-lived, low-rate OT sessions behave badly under aggressive timeouts.