I85PREP
⌘ K
Fortinet FCX study materials
Fortinet FCX study resources

Fortinet FCX: Operational Technology Security

Fortinet FCX · Work through your exam, one topic at a time.

All guide sections

Operational Technology Security

OT Security tests protecting industrial control systems where availability and safety outrank confidentiality. You need the reference models (Purdue, IEC 62443), the protocol and port vocabulary, and the Fortinet components used at plant boundaries: FortiGate Rugged, FortiSwitch Rugged, FortiAP, FortiDeceptor, FortiNDR and OT signature coverage feeding FortiAnalyzer and FortiSIEM.

Reference models and constraints

  • Purdue levels run from L0 process through L1 controllers, L2 supervisory control, L3 site operations, the L3.5 DMZ, L4 enterprise and L5 external. Conduits should cross only at the DMZ; direct L4-to-L2 paths are a finding.
  • IEC 62443 defines zones, conduits and security levels SL1–SL4; design is defence in depth with explicitly permitted protocol flows.
  • Controllers are fragile: no active scanning, no aggressive patching, and change windows agreed with production. Segmentation, protocol whitelisting and IPS virtual patching replace endpoint agents.

Fortinet components

  • FortiGate Rugged appliances (fanless, wide temperature, DIN rail, dual power input) sit at the cell/area boundary; FortiSwitch Rugged and plant FortiAP extend the same FortiLink fabric.
  • Enforcement is policy plus IPS: permit only the required protocol and port, then filter function codes. Typical ports: Modbus/TCP 502, DNP3 20000, IEC 60870-5-104 2404, IEC 61850 MMS 102, OPC UA 4840, EtherNet/IP 44818, BACnet 47808.
  • FortiGuard OT/ICS signatures identify protocol commands, so a rule can allow polling reads while denying writes from the enterprise side.
  • FortiDeceptor plants decoy PLCs and HMIs; FortiNDR gives passive asset discovery and anomaly detection without touching controllers.

Worked example

A cell has PLCs at L2 and SCADA/HMI at L3, with the historian in the L3.5 DMZ. The Rugged FortiGate policy permits HMI-to-PLC Modbus/TCP 502 inbound and denies everything else, with an IPS profile that alerts on unexpected write function codes for the first month. Engineering workstations reach PLCs only from a jump host in L3 with MFA. Enterprise users reach the historian in the DMZ, never the PLCs. After the baseline is clean, the write-function rule moves to block - availability first, enforcement second.

Traps that cost marks

Blocking write function codes that SCADA legitimately needs and stopping production; running active vulnerability scans against PLCs; treating the engineering laptop as trusted; confusing DNP3 and Modbus ports; enabling IPS blocking without a monitoring baseline; forgetting plant wireless as an attack path.