Transcript
OT environments operate for years and sometimes grow organically as new devices are added to the network. That can introduce security risks when you have vulnerable or outdated components. Gaining visibility into the devices in your environment is something that we can tackle with a FortiGate firewall. FortiGates are the core of an OT protection platform, securing cyber-physical systems across the entire OT and into the IT environment. I'm Matt Bullock, Technical Marketing Engineer with Fortinet. Today we're going to look at a FortiGate firewall with the OT security service used as a CPS protection platform. We'll be using a large simulated environment full of industrial components at all levels of the Purdue model. These represent many types of devices from different vendors and generations. Some even include unpatched vulnerabilities. Let's see what we can discover. In our lab topology, we have a single FortiGate firewall paired with a FortiSwitch, which connects to our simulated OT environment with multiple VLANs representing different levels of the Purdue model. The switch is integrated and managed by the FortiGate using the FortiLink interface, letting the switch act as an extension of the firewall. The switch is online and we can see the VLANs deployed for process, control, monitoring, and operation. Taking a look at the port configuration, we see that we have connections to the lower levels in our environment through those VLANs. If we take a look at the FortiGate interfaces, we see those same VLANs on our FortiLink connection to the FortiSwitch. Let's take a closer look at the operations VLAN. Beyond the basic IP and DHCP configuration, you can see that we have device detection selected. This is the capability that allows the FortiGate to detect devices on this VLAN through a variety of mechanisms. Let's go back to our FortiLink interface and take a look at the process network to make sure we also have device detection enabled. That allows us to detect devices at both the process and operation levels of the Purdue model. If we jump over to our asset identity center, we'll see that we haven't detected anything beyond our FortiGate and FortiSwitch yet. And our Purdue model asset view is pretty empty. Let's enable some devices that we can detect. Let's look at new devices we're seeing. We're seeing a Windows device on the operation network. We're also seeing a new Schneider industrial device on the process network that we already know a lot about. At this stage, detection is based on MAC address, residual traffic like ARP and DHCP, as well as lookup queries to our FortiGuard database. We can switch back and forth between the asset identity list and OT views where the FortiGate is starting to map devices to the Purdue model. We can reassign devices later to match how our CPS environment is actually deployed. We're continuing to learn about more devices in the environment, but there's a lot of detail missing. The CPS will build a profile of devices it discovers using whatever information it can gather. Let's give it some more information in the form of application control signatures. Back in our firewall policies, we have a rule for traffic between our monitoring level and our out-of-band management server. We currently have no security profiles enabled here. Opening it up, we can enable a default application control profile that monitors all categories of applications, including OT-specific applications. We'll enable the same application inspection between our monitoring and control networks. Let's also enable SSL certificate inspection so we can analyze SSL security headers, and I'll go back and enable it on the first policy because I forgot to the first time. Let's head back over to the asset identity center and we'll see what we found. We've now filled in more detail about this device than we had before. Using application control, we now know about potential vulnerabilities. We can see that this hardware and software combination has a known command injection and a buffer error vulnerabilities. You can see the CVEs here and even get more information on each CVE by drilling down to these links. We started simulating more devices here, so if we refresh the asset identity list, we'll see quite a few more assets pop up. Here you can see we have a Windows CE device from Rockwell, along with another device from Rugged.com and a Windows CE device from Beckhoff. Let's take a look at the OT view now. Here we can see those same devices arranged in the Purdue model. Based already on what we know about the type of device and the interfaces that we're seeing those devices on. This is a pretty good guess by the CPS, but you can always rearrange devices if this doesn't exactly match your environment. As you can see, the asset identity capabilities of a FortiGate firewall are impressive. While there are many vendors that specialize in device discovery, FortiGates are unique in that they combine discovery with the leading industrial security appliance in the FortiGate firewall. Not only can you discover devices in your OT environment, but you can provide tight security controls and even virtual patching. But that's a subject for another video. Thanks for watching.
