OT/ICS Security Architecture for Indian Manufacturing — FortiGate Rugged + Purdue Model Design Guide

Manufacturing is the #1 target for OT ransomware — accounting for over 50% of all industrial ransomware victims globally. The Dragos 2025 OT Cybersecurity Year in Review reported an 87% surge in ransomware targeting industrial organisations, with 80 active threat groups (up 60% from 2023). In India, 60% of manufacturers use IIoT devices, yet only 25% have robust OT security (IDC 2024). This guide walks through the Purdue Reference Architecture for securing OT networks, maps Fortinet products to each level, and provides the technical design blueprint for Indian manufacturing enterprises.

The OT Threat Landscape: Why This Matters Now

The pattern is clear: attackers are moving from IT to OT. A ransomware infection that starts with a phishing email in the corporate network crosses into the plant floor through flat, unsegmented networks. Once inside the OT environment, it reaches PLCs, HMIs, and historians — and 75% of the time, it disrupts operations to some degree. The fix isn't just endpoint security. It's network architecture — segmentation, zone enforcement, and protocol-aware inspection at every boundary.

The Purdue Model — Level by Level

The Purdue Enterprise Reference Architecture (PERA) is the foundational framework for OT network segmentation, referenced by IEC 62443, NIST SP 800-82, and every major industrial cybersecurity standard. It divides the network into 6 levels (0–5) with a critical DMZ between IT and OT:

The IDMZ (Level 3.5) is the most critical boundary. This is where IT meets OT. No direct traffic should flow between Level 4 (ERP/email) and Level 3 (historians/MES). All data exchange happens through the IDMZ via controlled, inspected paths — typically jump servers, data diodes, or database replication.

FortiGate Rugged — Built for the Plant Floor

Standard enterprise firewalls fail in OT environments — they can't handle extreme temperatures, vibration, dust, or electromagnetic interference. The FortiGate Rugged series is purpose-built for industrial deployment with the same FortiOS and FortiGuard services as campus FortiGates, but in a hardened form factor.

Sources: FortiGate Rugged Series Datasheet, AVFirewalls FGR-70G

Key OT features: OT-focused dashboard, OT vulnerability correlation, virtual patching via OT IPS signatures, industrial protocol deep packet inspection (Modbus TCP/IP, DNP3, OPC, BACnet, S7, EtherNet/IP), and hardware bypass pair ensuring network continuity even if the firewall fails.

FortiGuard OT Security Service — Virtual Patching for SCADA

You can't patch a running PLC during production. The FortiGuard OT Security Service solves this with virtual patching — deploying IPS signatures that block exploitation of known vulnerabilities in industrial devices without touching the device firmware. When a vendor releases a patch, FortiGuard develops and deploys the corresponding OT IPS signature in near real-time.

• Passive deep packet inspection (DPI) of industrial traffic — no disruption to process control
• OT protocol awareness — understands Modbus RTU/TCP, DNP3, OPC, BACnet, S7COMM, EtherNet/IP, IEC 104 at the application layer
• Virtual patching — immediate protection for unpatched PLCs, RTUs, HMIs, and SCADA servers
• OT vulnerability correlation — maps discovered devices to known CVEs and prioritises remediation
• Developed in collaboration with automation vendors (Siemens, Schneider, Rockwell, ABB)

The Full Fortinet OT Security Stack

Reference Architecture: Fortinet at Every Purdue Boundary

Key design principle: No traffic crosses a Purdue level boundary without passing through a FortiGate with OT IPS inspection enabled. The IDMZ (Level 3.5) uses a dedicated FortiGate pair — one facing IT (Level 4), one facing OT (Level 3) — with only controlled data flows between them (historian replication, patch downloads, antivirus updates).

India Context: NCIIPC, CERT-In, and Sector CSIRTs

India's critical infrastructure is regulated by a layered cybersecurity framework:

• NCIIPC (National Critical Information Infrastructure Protection Centre) — provides threat intelligence, situational awareness, and advisories to organisations with Critical Information Infrastructures (CIIs) including power, oil & gas, telecom, banking, and transport
• CERT-In — 6-hour incident reporting mandate. Over 9,700 cybersecurity audits conducted in 2024–25. New 2025 audit guidelines place unprecedented accountability on critical infrastructure operators
• Sector CSIRTs — CSIRT-Fin (finance) and CSIRT-Power (power sector) are operational for sector-specific coordination
• Key Indian OT sectors: power generation (NTPC, NHPC, state DISCOMs), oil & gas (IOCL, BPCL, HPCL), pharmaceuticals, automotive, steel, cement, smart manufacturing (IIoT)

With 60% of Indian manufacturers deploying IIoT devices but only 25% having adequate OT security, the gap between digitisation and protection is dangerously wide. Purdue model segmentation with Fortinet's OT stack closes this gap without requiring a forklift upgrade of existing industrial systems.

How Ogma Deploys OT Security

Ogma is an authorised Fortinet partner with experience deploying OT security for Indian manufacturing, power, and pharma enterprises. Our approach:

• OT Network Assessment — passive discovery of all OT assets using FortiNAC + network traffic analysis. No active scanning that could disrupt PLCs. Purdue level mapping of your current architecture.
• Segmentation Design — zone-based architecture mapped to Purdue levels with FortiGate Rugged at each boundary. IEC 62443 zones and conduits design.
• FortiGate Rugged Deployment — DIN-rail installation in switch cabinets, OT IPS policy configuration, virtual patching for unpatched PLCs/HMIs, bypass pair configuration for fail-open safety.
• OT SOC Integration — FortiSIEM or FortiAnalyzer deployment with OT-specific correlation rules. Managed SOC service with OT protocol awareness.
• FortiDeceptor — OT honeypot deployment emulating your actual PLC models (Siemens, Rockwell, ABB) to detect lateral movement before it reaches real controllers.
• Compliance Reporting — IEC 62443, NCIIPC, and CERT-In audit-ready documentation and dashboards.

Email [email protected] or contact Ogma for an OT security assessment. We'll map your Purdue levels, identify segmentation gaps, and recommend a deployment plan — without disrupting your production line.