Securing OT Cyber Risk with the Fortinet OT Security Platform

OT cybersecurity risk provides unique challenges based on OT use cases, devices and threat vectors. The OT Security Platform provides the basic solutions of visibility and segmentation to advanced OT SecOps. Rich Springer, Fortinet’s Senior Director of Product Marketing for OT, presented the OT Security Platform at Security Field Day 16. He described it as an extension of the Fortinet Security Fabric into operational technology.

Springer explained why OT needs its own approach. Some PLCs have run for 20 to 40 years, may never get patches, and sit behind maintenance windows months apart. The air gap is a myth, and remote access by OEMs and contractors over always-on VPNs is the leading attack vector. Manufacturing has been the top target for five years running because ransomware crews can monetize production loss. Meanwhile, nation-state attacks such as those on US water utilities are designed to demonstrate capability. The platform starts with FortiGate for segmentation and visibility and extends through FortiLink to FortiSwitch for micro-segmentation. It also includes rugged, fanless hardware for harsh sites. Springer said FortiOS recently earned IEC 62443 certification at security level four, which he said no other vendor holds. Fortinet’s OT security service understands about 150 industrial protocols and adds OT-specific IPS rules and automated virtual patching. Operators can run the virtual patching in learn mode to confirm there are no false positives before enforcing it. FortiAnalyzer includes NERC CIP reporting templates and a Purdue model view of the OT network. FortiSOAR includes playbooks mapped to MITRE ATT&CK for ICS, and FortiPAM provides browser-based remote access for third parties. FortiDeceptor can mimic OT devices and their protocols to lure attackers.

Springer said OT risk has moved into the C-suite and usually lands on the CISO, and that pressure is speeding customers toward OT SecOps. Most customers are still working on segmentation and visibility. Many joint IT/OT SOCs drop OT alerts because their analysts don’t know how to handle them. Fortinet is building an OT cybersecurity data lake so AI tools can support OT SOC work. The platform can also run on its own without the IT fabric. Springer closed by warning that the OT market is crowded with niche, standalone vendors, and each one adds another console and another operator. In his view, securing OT will ultimately depend on integrated tools and on people who can work across both IT and OT.