I85PREP
⌘ K
Fortinet FCSS SOC study materials
Fortinet FCSS SOC study resources

Fortinet FCSS SOC: Operational Technology: Segmentation, Visibility, and Availability-First Security

Fortinet FCSS SOC · Work through your exam, one topic at a time.

All guide sections

Operational Technology: Segmentation, Visibility, and Availability-First Security

What this domain tests

Operational Technology tests security for industrial control systems using Fortinet rugged platforms, segmentation, passive visibility, and OT-aware monitoring. Expect Purdue-model and IEC 62443 questions, plus scenarios where availability and safety outrank confidentiality and where active IT scanning is unacceptable.

Core rules and concepts

  • The Purdue model separates Level 0 process, Level 1 controllers, Level 2 supervisory systems, Level 3 site operations, Level 3.5 DMZ, and Levels 4-5 enterprise and cloud. IEC 62443 organizes assets into zones and controls traffic between them with conduits.
  • Segmentation is enforced with FortiGate Rugged firewalls, FortiSwitch Rugged, and OT-aware policies. Allow only required industrial protocols and directions; deny by default.
  • FortiNAC provides asset visibility and profiling; FortiSIEM with OT analytics consumes logs and mirrored traffic. Passive discovery or SPAN monitoring is preferred over active scanning on live control networks.
  • Availability and safety take precedence. A block that stops a production line or safety system can be worse than the threat. Change windows, engineering approval, and rollback plans matter.
  • FortiGuard OT security services and IPS signatures add protocol-aware detection. Patching may be impossible on legacy devices, so compensating controls and segmentation carry more weight.

Worked example

Level 2 HMIs need to reach a Level 3 historian. Reasoning: place a FortiGate Rugged between the zones as the conduit. Permit only the required sources, destinations, and industrial services, such as Modbus TCP 502 or OPC UA 4840, in the required direction; deny all else and log denies. Send FortiGate logs and a SPAN copy of zone traffic to FortiSIEM for passive detection. Use FortiNAC to profile the PLCs and HMIs without active scanning. Do not run an aggressive vulnerability scan during production, and do not block the safety system to satisfy a generic IT policy. The mark comes from least-privilege conduits, passive monitoring, and availability-first reasoning.

Traps that cost marks

  • Applying IT scanning and patching assumptions to live OT networks.
  • Blocking safety or control traffic to satisfy a generic deny rule.
  • Assuming an air gap when maintenance laptops, vendor links, or USB media cross zones.
  • Treating Purdue levels as strict physical boundaries instead of logical segmentation guidance.