Fortinet and ORDR Solution Brief

Fortinet and ORDR Connected Device Visibility & Security Solution

Automated Visibility and Protection for ALL Connected Devices - from traditional servers, workstations and PCs to IoT, IoMT and OT devices

Executive Summary

Fortinet and ORDR have partnered to deliver an industry-leading IoT and unmanaged device security solution by integrating FortiGate next-generation firewall (NGFW), FortiManager automation-driven network management, and ORDR Systems Control Engine (SCE). The solution provides organizations with complete visibility of their network-connected devices, baselining of safe device behavior and the ability to protect critical IoT, OT and unmanaged devices with automated segmentation at the firewall. When combined with Fortinet FortiNAC, you have a comprehensive solution to secure both network access and local area network communications as well as all communications between security zones using FortiGate next-generation firewalls.

Challenge

The number of IoT and unmanaged devices connected to corporate networks, from conference TVs to business-critical infrastructure, has grown exponentially. Unfortunately, this brings with it a significant increase in attack surface since these devices often run legacy software without security agents. Without the means to be patched or to protect themselves against attack, IoT and unmanaged devices are extremely vulnerable and therefore lucrative targets. Organizations need to secure access to and from these devices to protect against direct attacks, lateral malware movement, and business interruption. This requires granular details of all devices, their risks, and their ongoing behavior, and then translating this knowledge into proper and automated security workflows. ORDR and Fortinet have teamed to deliver a solution that provides organizations with this ability to discover, assess, and use rich device context to power proactive device policies across the Fortinet fabric. FortiNAC administrators can use ORDR asset details and classifications to easily build dynamic business-driven rules, while firewall administrators can further reduce manual efforts and errors by pushing automated protection policies directly to FortiGate firewalls. ORDR's deep API integration scales from mid-sized businesses with individual FortiGates to complex enterprises leveraging extensive FortiManager and FortiGate deployments.

Joint Solution Benefits

The solution combines the ORDR Systems Control Engine with Fortinet FortiManager, FortiGate, and FortiNAC to deliver:

• Discover and inventory every connected network asset, including the massive volume of IoT and unmanaged devices
• Establish comprehensive security controls that restrict IoT devices to known-good network behaviors
• Manage firewall and NAC policies using business-relevant context such as device type, manufacturer, location, and function rather than IP addresses
• Automate updates of firewall groups and address info to ensure consistent policy enforcement regardless of device location, VLAN, or IP assignment, thus drastically reducing operational costs and downtime
• Protect critical devices with automated, zone-based segmentation and microsegmentation within zones

Joint Solution

ORDR and Fortinet have partnered to deliver an industry-leading security solution to address the challenge of widespread IoT and unmanaged device sprawl. The API integration of the ORDR Systems Control Engine (SCE) with FortiManager, FortiGate, and FortiNAC, enabled through Fortinet's Open Fabric Ecosystem, delivers the ability for customers to reduce the time and effort to create and maintain a proper asset inventory, determine asset communication patterns, and create effective, business-relevant firewall and NAC segmentation policies that automatically update as devices are added, moved, and changed.

IoT and unmanaged devices pose a unique and growing security challenge to organizations. By nature, a large majority of IoT devices run neither anti-malware nor patch management software and are thus an inherent risk to an organization. The only way to handle these devices is to proactively segment them from your critical assets.

Within minutes of a device appearing on an organization's network, ORDR automatically discovers, identifies, classifies, risk assesses, and groups it with peers. ORDR transmits this device context to FortiNAC to dramatically speed and simplify NAC policy creation. And, with just a few clicks, administrators can create business-relevant segmentation policies in FortiGate firewalls that ensure devices of a specific type and role only connect over approved communication channels with necessary destinations—all unique and custom to your organization.

Solution Architecture: Device Discovery to Policy Enforcement

ORDR's SCE Sensor passively monitors SPAN/TAP/NetFlow/IPFIX data from the core switch to classify devices such as medical devices, facilities systems, retail systems, and physical security cameras. ORDR SCE then sends device data and classification to FortiNAC, which enforces logical segmentation policy and quarantine/remediation actions down through the access switches and wireless LAN controller (WLC) to the end devices.

Joint Solution Integration

The Fortinet FortiGate, FortiManager, and FortiNAC integration with ORDR SCE allows customers to reduce the amount of time spent on establishing a proper asset inventory, establishing where those assets are communicating, and creating firewall and NAC segmentation policies. Further, the integration allows for automated segmentation and microsegmentation.

When a device changes physical location and its IP address changes, or similar devices are discovered, ORDR will automatically update the device membership in Fortinet solutions to reduce manual processes (for example, requiring devices of a specific type be assigned to a specific VLAN or subnet) and maintenance tasks (for example, costly and time-consuming change control windows to implement firewall policy changes based on IP address changes). Additionally, because ORDR transmits granular device details to FortiGate, FortiManager, and FortiNAC, administrators can further tune policies and make informed decisions about their network without deciphering IP and MAC addresses.

The FortiGate next-generation firewalls enhance ORDR's visibility into north-south and east-west communications by sending flow data to a centralized ORDR sensor. This extends the visibility in remote and lateral communications to improve visibility, enhance anomaly detection, and increase the efficacy of FortiGate zone-based segmentation and FortiNAC access control policies. FortiGate NGFWs can also reduce incident response efforts by informing ORDR when malicious traffic is dropped at the firewall. This closed-loop integration allows clearing of associated ORDR security incidents related to potentially malicious device communications to known-bad websites and destinations.

Network Segmentation Policies by Device Type

The ORDR SCE Sensor sends device classification data to FortiManager, which distributes device-specific policies to the Internet firewall, campus logical segment firewall, and data center firewall protecting each zone of the campus network:

Joint Use Cases