Fortinet OT Security Architect study plan
Fortinet OT Security Architect · Give each week a clear focus.
8 weeks · About 6 hours per week
OT Security Fundamentals and Architecture
Map the Purdue Model levels against a real or hypothetical plant and label where IT/OT boundaries, DMZs, and conduits fall
Define the CIA-to-IAC shift in OT (availability first) and explain it in writing with two concrete plant examples
Differentiate IT and OT threat models by listing attacker goals, typical entry points, and blast-radius constraints for each
Identify the major OT protocols (Modbus, DNP3, OPC UA, PROFINET, EtherNet/IP) and note which are cleartext or unauthenticated
Your checkpoint
A one-page Purdue-model diagram of a sample plant with every zone, conduit, and IT/OT boundary annotated and a 300-word note on availability-first design
OT Security Fundamentals and Architecture & OT Security Design and Deployment
Translate zone-and-conduit concepts from IEC 62443 into a segmentation design for the sample plant
Select FortiGate models and placement points for IT/OT demarcation, plant core, and cell-level enforcement
Decide where transparent-mode versus routed-mode inspection fits and justify each choice
Draft the security-control mapping for each conduit (firewall, IPS, application control, industrial signatures)
Your checkpoint
A segmentation design sheet listing each zone, the FortiGate model and mode at each boundary, and the control set applied per conduit
OT Security Design and Deployment
Configure virtual domains or policy blocks to separate IT, DMZ, and OT traffic in a lab topology
Enable and tune industrial protocol signatures and application control for at least two OT protocols
Build a transparent-mode inline deployment for a legacy PLC segment that cannot be re-addressed
Design high-availability pairing and fail-open/fail-closed behavior for each OT boundary
Your checkpoint
A working lab configuration export plus a 400-word deployment note covering HA mode, failure behavior, and signature tuning rationale
OT Security Design and Deployment & OT Security Operations and Monitoring
Define what to log from OT firewalls and how to forward it to a central collector without saturating plant links
Configure log aggregation and retention that satisfies incident review without flooding storage
Draft the baseline traffic profile for the sample plant (allowed flows, expected protocols, normal volumes)
Set alert thresholds for policy violations and new-device appearances on OT segments
Your checkpoint
A logging and monitoring plan with collection points, retention periods, and a first-draft baseline flow table for the sample plant
OT Security Operations and Monitoring
Configure FortiAnalyzer or equivalent dashboards that surface OT-specific events rather than generic IT noise
Build detection logic for unauthorized protocol use, unexpected engineering-workstation access, and scans against PLCs
Write an OT incident-response runbook covering containment without halting production
Practice triaging three synthetic OT alerts and record the decision path for each
Your checkpoint
An OT incident-response runbook plus a triage log of three simulated alerts with verdicts and escalation decisions
OT Security Administration and Troubleshooting
Administer role separation so plant engineers and security staff have least-privilege access to FortiGate and FortiManager
Diagnose a broken conduit using packet capture, session tables, and policy hit counters
Troubleshoot a transparent-mode deployment where traffic silently bypasses inspection
Document a change-control workflow for firewall policy edits in an OT environment
Your checkpoint
A troubleshooting playbook with five diagnostic scenarios, the exact commands or GUI paths used, and expected outputs
OT Security Integration and Ecosystem
Integrate FortiGate telemetry with a SIEM and validate that OT events arrive with usable context
Connect FortiManager or FortiAnalyzer to the plant's asset inventory or passive-discovery source
Explain how FortiEDR or endpoint controls are constrained on OT hosts and where they are inappropriate
Map how the Fortinet fabric shares threat intelligence across IT and OT enforcement points
Your checkpoint
An integration diagram showing data flows from OT sensors and firewalls into SIEM, asset inventory, and management plane, with a validation checklist
OT Security Fundamentals and Architecture & OT Security Design and Deployment & OT Security Operations and Monitoring & OT Security Administration and Troubleshooting & OT Security Integration and Ecosystem
Rehearse scenario-based questions that combine segmentation design with incident response
Review weak areas flagged in weeks 1 through 7 and close the top three gaps
Practice explaining architecture decisions aloud within a two-minute limit per scenario
Confirm command of key standards references (IEC 62443 zones and conduits, Purdue levels) without notes
Your checkpoint
A scored practice exam attempt with a written remediation list for every missed domain, plus a one-page architecture summary produced from memory
Milestones
Week 2: Can draw the sample plant's zones and conduits from memory and justify each FortiGate placement without notes
Week 4: Lab topology passes traffic across all three zones with industrial signatures active, HA configured, and logs reaching the collector
Week 6: Diagnose all five troubleshooting scenarios correctly and explain the root cause of each in under five minutes
Week 8: Score at or above 80 percent on a full-length practice attempt with no domain below 70 percent