2. Présentation Fortinet
Welcome
Présentation Fortinet
8:00 – 8:30 Café
8:30 – 9:05 Présentation 1 – Fabric Security
9:05 – 9:20 pause
9:20 – 10:00 Présentation 2 Ransomware Protection
Wrap up

3. Fortinet Security Fabric
Jonathan Rod
Systems engineer, CISSP

4. Current strategies original marketing
=> What do we have strategies on firewalling today ?
Some strategies rely on marketing or trying to make the box easier to sell. Nice GUI, nice reports, brilliant features. Marketing can do marvelous things ;-)
Others go for more features or advanced features but they narrow the target.

5. What is the “Fortinet Security Fabric” ?
Secure Access
Network Security
Application Security
Cloud
Security
Client Security
Mail Server AV
WAF AS
Wifi
EndPpoint
MGMT
It is a strategy, a vision. Some may say it is pure marketing but it is not.
Technically it is a collaboration of products which provides more features for the customer.
It is also a collaboration between sales and technical presales to make projects bigger and providing more security
Here are the examples for the collaboration between the products.
The concept is quite effective as we currently get great wins against competition (+provide examples). The idea is to propose the best global security solution providing highly integrated products : easy to deploy, install, use and analyse. Customers are proposed a higher level of security for the same price.
Fortinet customers are more intended to purchase a Fortisandbox than other technologies. It integrates with fortimail, fortiweb, forticlient, … and any new future acquired device can take advantage of the sandbox.

6. Key Fabric Attributes Scalability Scalable Aware Secure Actionable
Open

7. Scalable from Access to Data Center, IoT to Cloud
hardware
Cloud
Networks come in all shapes and sizes and are never static during their lifetime.
Only Fortinet provides such a wide range of products: we provide products in several versions such as VMware, Cloud, hardware, etc, different sizes.
Fortinet is the only constructor which provides all home made products. It is really an advantage because there is no agreement with third parties which can be broken. We keep a hand on the technology to make sure it always integrates with others. Finally prices are much more aggressive making the global project fit the initial budget.
Fortinet wide range of products helps administrators to change their units and relocate them according to their needs

8. FortiGate Product Range
Personality, Performance and Scalability
CCFW
DCFW
ISFW
CFW/VMFW
NGFW / NGIPS
DEFW
UTM
Software & Services
Product Range
Entry Level
Mid Range
High End
Virtual Appliances
CPU
SoC NP CP
Multi Core
CPU NP CP
Multi Core
CPU
Multi Core
CPU
Chassis System
1 Gbps
10 Gbps
10 Gbps - 50 Gbps
50 Gbps - 1 Tbps
H/W Dependent
Series
Series
VM Series
Series
3000 Series
5000 Series
7000 Series
60-90 Series
30-50 Series
FortiGuard
Security Services
FortiOS
Operating System
FortiCare
Support Services

9. Key Fabric Attributes
Scalable
Aware
Secure
Actionable
Open

10. CTI: Cyber Threat Intelligence
SOC Feeds
CLOUD ANALYZERS
IOC SERVICES
Collect CTI from worldwide deployments
Analyze against worldwide or regional baselines
Identify targeted attacks or anomalies
IOC Discovery (FortiAnalyzer 5.4.1)
Reporting
Management Automation
Services for Enterprise & MSP SOC

11. FortiGuard Threat Intelligence Projects
CISCP & NCCIC
DHS: CISCP – On target for participation after we sign CRADA. Over 45 organizations and 13 ISACS.

12. Fortinet/NATO NCI Cyber Alliance

13. Collect, Gather, Analyze different information
Mail Server
SOC Feeds
CLOUD ANALYZERS
IOC SERVICES
Collect CTI from worldwide deployments
Analyze against worldwide or regional baselines
Identify targeted attacks or anomalies
IOC Discovery (FortiAnalyzer 5.4.1)
Reporting
Management Automation
Services for Enterprise & MSP SOC
All solutions spread over the network and building the fabric will bring information from different perspective.
Ex:
An infected PC connected to the LAN provides a rogue SSID. The attacker uses it to send an from the local device to the mail server with a zero day virus file as attachment. FortiAP detects the rogue AP, the firewall detects that a packet used the rogue AP to enter the network, the fortimail detects the mail is not legitimate and the sandbox detects the file is a 0-day virus. Fortiview gathers the information and makes it easier to analyze.
Fortiview on Fortisandbox and wifi clients (different graphics…)

14. Learning Mode
New learn mode helps admins to configure policy to simply monitor and analyze traffic. A report is available locally as well as the CTAP report.

16. Key Fabric Attributes
Scalable
Aware
Secure
Actionable
Open

17. Enabling the Security Fabric : 1+1=3 more features !
standalone
Partner
FortiWeb
FortiMail
FortiClient
FortiGate
Advanced
Threat
Protection
1+1=3
When collaborating, the level of security gets much higher because the collaboration provides more features. For example, when in standalone mode, the fortisandbox emulates an environment and test a file. It generates an alert if a virus is discovered.
Now let's action the fabric with other products. When in combination with a forticlient or fortimail, more features are added. The virus is kept until a medication is provided to all equipments !!!
This is something you can not get if you use other third party products such as Fireye.

18. Unified Security Across all of the Network
FORTIMANAGER
FORTISIEM
Enabling the Security Fabric provides your network with more security features which you could not get with third party products.
You now have a full expert and dedicated product defending your network against all attacks.
Fortinet customers are more intended to purchase a Fortisandbox than other technologies because it is full integrated and easy to deploy, maintain, learn, and so on. It integrates with fortimail, fortiweb, forticlient, … and propose a solution with the highest level for security.
Security is unified with FortiSiem or forticloud or fortiManager which has no equivalent on the market (unified GUI, ability to configure the products...)

19. Key Fabric Attributes Access to Data Center, IoT to Cloud Scalable
Aware
Secure
Actionable
Open

20. Fabric Attribute 4: Actionable Threat Intelligence
Support Services
Migration to Cloud Based Systems
FortiCare
FortiGuard Plus
Security Reporting Service
Threat Detection Service
Access to FortiGuard Experts for Product and Threat Support
Portal Correlating Data From Across the Fabric with geography, industry and size specific intelligence
Local Threat Intelligence From FortiGuard Labs
Big Data Analytics of consolidated Logs for patterns of activity associated with advanced threats
IaaS
IoT
Mobile
The FortiGuard Premier Signature Service provides enhanced virus detection and threat analysis support to help mitigate breaking and advanced persistent threats. With the FortiGuard Premier Signature Service, you can submit requests for custom AV, IPS, or Application Control signatures on a 24x7 basis for prioritized support with guaranteed response times. Updated signatures are initially provided through Fortinet's support site and later included in FortiGuard distribution network's automatic updates.
With granularity of level 1, 2 or 3.
Access
WAN
Data Center
SaaS
PoS
Windows

21. Key Fabric Attributes Access to Data Center, IoT to Cloud Scalable
Aware
Secure
Actionable
Open

22. Multiple Levels of Fabric API’s for Partner Integration
Eco System Alliance Partners
SIEM
Management
Fortinet Security Fabric
Endpoint
SDN
No one company can do everything themselves. It takes an extensive eco-system of products and technologies to meet all of the challenges. And as the challenges grow and change so will the eco-system. This eco-system is enabled through the FSF and its series of APIs.
Virtual
Cloud

23. Ecosystem Integration Points
Cloud
SDN
Sandbox
Test/SSO
System Integrator
SIEM
Management
These are just some of the organizations that Fortinet works with to ensure that the FSF is robust to meet the challenges are customers are facing.
The extension of the Fabric into the Alliance system is very important. Customers have different infrastructure platforms and Security products which are an essential part of their defense capability.
We have developed a variety of API’s to allows Alliance partners to connect to the Fabric. The Integration Points include
Hypervisor
SDN Orchestration
Cloud
Sandbox
Logging
Policy Management
Once part of the Fabric Threat Information can be shared along with Mitigation instructions. Obviously the depth of integration will determine the capability.