Fortinet NSE 7 - OT Security 6.4

The two benefits of a Nozomi integration with FortiNAC are the importation and classification of hosts, and the consolidation of adapters for multi-adapter hosts. Importation and classification ensure that devices known to Nozomi can be easily imported and automatically classified within FortiNAC, enabling seamless management and security profiling. Adapter consolidation streamlines the management of hosts with multiple network adapters by consolidating them into a single device within FortiNAC, simplifying device management and monitoring.

A FortiGate device can use several criteria to match a firewall policy when processing traffic. These criteria include the services defined in the firewall policy, the source defined as internet services in the firewall policy, and the destination defined as internet services in the firewall policy. By evaluating these criteria, the device can determine the appropriate policy that should be applied to the specific traffic being processed.

Based on the exhibit, the log entry begins with 'PH_DEV_MON_NET_INTE_UTIL', which indicates a performance monitoring event. PAM (Pluggable Authentication Module) events are related to performance monitoring in systems. Therefore, this log is a sample of a PAM event type.

In an OT industrial control system (ICS), device identification typically requires solutions that specialize in network access control, security information, and event management, as well as network protection. FortiNAC is used for network access control, allowing it to identify devices on the network. FortiSIEM provides comprehensive security information and event management, which helps in identifying devices through their network activities. FortiGate, as a next-generation firewall, has extensive capabilities for identifying and managing devices on the network.Therefore, FortiNAC, FortiSIEM, and FortiGate are the three products suitable for device identification in an OT ICS environment.

There is no micro-segmentation in this topology because both PLCs are within the same VLAN (VLAN 1) and can communicate directly with each other without going through the firewall. Micro-segmentation would imply the use of separate segments or VLANs for different devices or groups of devices to enhance security by limiting communication paths. In the given topology, communication between the PLCs is unrestricted within the same VLAN.