Transcript
Depending on the framework you choose, Purdue, NIST, CSF, 62443, NIS2, or something else, you will need to implement device and application controls at various points within that framework. I'm Matt Bullock, Technical Marketing Engineer at Fortinet. Today we'll use our simulated OT environment to look at providing application controls and virtual patching using the OT Security Service on FortiGate firewalls in a Cyber Physical System, or CPS. We'll be simulating a large number of devices from various vendors and generations, some of which contain vulnerabilities for us to discover and mitigate. We started simulating more devices here, so if we refresh the asset identity list, we'll see quite a few more assets pop up. Let's take a look at the OT view now. Here we can see those same devices arranged in the Purdue model. Based already on what we know about the type of device and the interfaces that we're seeing those devices on. This is a pretty good guess by the CPS, but you can always rearrange devices if this doesn't exactly match your environment. We know that we have vulnerable devices in our environment, but we can't always patch those devices right away, especially in a production system. So let's enable virtual patching so that the CPS can provide a patch to block traffic to a vulnerable system that would match a known exploit. By default, we have a single virtual patching rule that patches any discovered vulnerabilities of any security level. We can configure this rule to only patch specific vulnerability levels, or to allow vulnerabilities so that they're logged and we can manually take action. Let's head back over to our firewall policies and look at the policies between our monitoring and operations networks. We'll turn on the same application control default profile and SSL certificate inspection we used earlier. As we discover more and more devices, we'll be discovering more vulnerabilities. Because we care about protecting those vulnerable assets from outside of the ICS environment, we'll be applying the virtual patch profile between HQ or the IT environment, and our various protected networks starting with the control network. This is where we activate the default virtual patching profile. All right, we've had some time to learn more details about the devices in the environment. So let's go back to the Asset Identity Center to find some vulnerable devices. It looks like we have several vulnerable devices now. Some aren't so bad with a single low severity vulnerability, while others have a whole stack of high priority vulnerabilities. We're getting all of this information from the detection tools the CPS has at its disposal with continuous updates from FortiGuard labs on the latest vulnerabilities discovered in the wild. There are enough vulnerabilities in our environment that we should start to see some virtual patches being applied. Let's look at our security events logs and filter them for virtual patching messages. Here it looks like we have a patch applied already against the Advantech device we just saw. Here we're dropping only the traffic that matches the attack profile. This could be a specific URL, a data pattern, a port number, or anything else that is identified in this CVE. FortiGuard also maintains our database of OT threats, protocols, and device definitions, as well as virtual patching signatures. We currently have over 1,300 virtual patching signatures for known OT vulnerabilities. You can view the currently installed list of signatures directly from the FortiGate, and we can search for a specific vendor, OS type, name, or well-known CVE. Similarly, our application signatures are continuously updated by FortiGuard. We currently have around 9,000 application signatures that a FortiGate can detect and take action on. Over 3,000 of those signatures are specific to OT environments. Looking at something as universal as SIP, you can see that we can get very granular in our definitions and can differentiate between different types of SIP commands or messages. Let's create a new application rule using some of these signatures. Our new application sensor monitors most application signatures by default, but doesn't take any action on them. Let's create an override for an application that we do care about. We're going to get very specific with a Modbus read command. When we select this application, there's more that we can configure. In this case, we're not just taking action on Modbus, or even Modbus read messages. We're getting more granular in controlling specific Modbus unit and address values in a Modbus read message. We'll give this some ranges that make sense in our environment, and we'll also give it some ranges that make sense in our environment. Now that we have our application rule, we can apply that rule to any of our firewall policies to control this traffic in our environment. The OT Security Service with continuous vigilance from FortiGuard Labs adds impressive levels of visibility and control to industrial control systems. This platform approach can be applied to any of our firewall policies. Let's take a look at some of the features of FortiGuard Labs. Let's take a look at some of the features of FortiGuard Labs. This platform approach gives you a consistent level of capability and management across both IT and OT environments, delivering robust security that is consistent, easy to implement, and continuously evolving along with the threat landscape in your environment. Thanks for watching.
