Fortinet Document Library

Version:

Version:


Table of Contents

Download PDF
Copy Link

Security rating

Security audit checks are updated to match evolving vulnerability exploits and attacks. The security fabric rating service helps the security and network teams keep up with changing compliance and regulatory standards by identifying opportunities to improve the system configuration and automate processes. The security rating applies to all devices in your Security Fabric, and uses real-time monitoring to analyze your Security Fabric deployment, identify potential vulnerabilities, highlight best practices that can be used to improve the security and performance of your network, and calculate Security Fabric scores.

The security rating gives grades in the following sections:

  • Fabric Security Hardening

  • Audit Logging & Monitoring

  • Threat & Vulnerability Management

  • Network Design & Policies

  • Endpoint Management

  • Firmware & Subscriptions

  • Performance Optimization

The rating also adds consideration for industry standards, such as NIST, PCI DSS compliance, GDPR, and CIS.

Enabling the Security Fabric and rating service allows you to easily identify key deficiencies, take action based on automated recommendations, secure your entire fabric, and passively monitor based on your Security Fabric scores.

The following table lists the security rating tests that are included with FortiOS and do not require a license. The table is grouped by the Score Care category (for example, Security Posture, Fabric Coverage and Optimization) and sorted by the FSBP ID.

Score Card Category

FSBP ID

Name

Description

Category

Security Posture AL02.1 Centralized Logging & Reporting Logging and reporting should be done in a centralized place. Audit Logging & Monitoring
  EM01.1 Endpoint Registration Interfaces which are classified as "LAN" and are used by a policy should have Security Fabric Connection enabled. Endpoint Management
  EM01.2 FortiClient Vulnerabilities All registered FortiClient devices should have no critical vulnerabilities. Endpoint Management
  ND02.4 FortiAP UTM SSID Compatibility (blank) Network Design & Policies
  ND04.1 LAN Segment Servers Servers should be placed behind interfaces classified as "DMZ". Network Design & Policies
  ND05.2 VLAN Management Non-FortiLink interfaces should not have multiple VLANs configured on them. Network Design & Policies
  ND07.1 Device Discovery Interfaces which are classified as "LAN" or "DMZ" and are used by a policy should have device detection enabled. Network Design & Policies
  ND08.1 Interface Classification All interfaces used by a policy should be classified as either 'LAN', 'WAN', or 'DMZ'. Network Design & Policies
  ND09.1 Detect Botnet Connections Policies should block or monitor outgoing connections to botnet sites. Network Design & Policies
  ND10.1 Explicit Interface Policies Polices that allow traffic should not be using the "any" interface. Network Design & Policies
  SH01.1 Unsecure Protocol - Telnet Interfaces currently in use should not allow TELNET administrative access. Fabric Security Hardening
  SH01.11 Unsecure Protocol - TFTP (blank) Fabric Security Hardening
  SH01.2 Unsecure Protocol - HTTP Interfaces currently in use should not allow HTTP administrative access. Fabric Security Hardening
  SH03.1 Valid HTTPS Certificate - Administrative GUI The administrative GUI should be using a valid and secure certificate. Fabric Security Hardening
  SH04.1 Valid HTTPS Certificate - SSL-VPN SSL-VPN should be using a valid and secure certificate. Fabric Security Hardening
  SH05.1 Admin Password Policy A password policy should be set up for system administrators. Fabric Security Hardening
  SH09.7 LDAP Server Identity Check Verify that server-identity-check is enabled for LDAP Servers to ensure certificate validation takes place. While this is the default option in a clean install, it may not be set if upgrading from older releases. Fabric Security Hardening
  SH09.8 Disable Username Sensitivity Check Verify that username case sensitivity is disabled for remote LDAP users. This option is provided only for legacy compatibility reasons. If enabled, it can lead to the bypass of two-factor authentication. Fabric Security Hardening
  SH20.1 DNS Helper (blank) Fabric Security Hardening
Fabric Coverage AL02.2 FortiAnalyzer All FortiGates in the Security Fabric can connect to and authenticate with their configured FortiAnalyzer. Audit Logging & Monitoring
  FS01.1 Compatible Firmware All devices in the Security Fabric should have compatible firmware versions. Firmware & Subscriptions
  FS01.2 FortiAP Firmware Versions All FortiAPs should be running the latest firmware. Firmware & Subscriptions
  FS01.3 FortiSwitch Firmware Versions All FortiSwitches should be running the latest firmware. Firmware & Subscriptions
  FS02.1 FortiCare Support Appropriate devices should be registered with FortiCare and have valid support coverage. Firmware & Subscriptions
  FS02.10 Firmware & General Updates Firmware & General Updates subscription should be valid. Firmware & Subscriptions
  FS02.11 Indicators of Compromise For compromised hosts support the IoC subscription should be valid. Firmware & Subscriptions
  FS02.2 IPS IPS subscription should be valid. Firmware & Subscriptions
  FS02.3 AntiVirus AntiVirus subscription should be valid. Firmware & Subscriptions
  FS02.5 Web Filtering Web Filtering subscription should be valid. Firmware & Subscriptions
  FS02.6 Anti-Spam Anti-Spam subscription should be valid. Firmware & Subscriptions
  FS02.8 Industrial DB Industrial DB subscription should be valid. Firmware & Subscriptions
  FS02.9 Outbreak Prevention Outbreak Prevention subscription should be valid. Firmware & Subscriptions
  FS03.1 Security Rating Security Rating subscription should be valid. Firmware & Subscriptions
  FS05.1 Activate FortiCloud Services (blank) Firmware & Subscriptions
  ND01.1 Unauthorized FortiSwitches All discovered FortiSwitches should be authorized or disabled. Network Design & Policies
  ND01.2 Unauthorized FortiAPs All discovered FortiAPs should be authorized or disabled. Network Design & Policies
  ND06.1 Third Party Router & NAT Devices No third party router or NAT devices should be detected in the network. Network Design & Policies
  TV01.1 Advanced Threat Protection Suspicious files should be submitted to FortiSandbox Appliance/FortiSandbox Cloud for inspection. Threat & Vulnerability Management
  TV01.2 FortiSandbox All FortiGates in the Security Fabric can connect to their configured FortiSandbox. Threat & Vulnerability Management
Optimization ND03.1 Unused Policies All policies should be used. Network Design & Policies
  PO01.10 Policy Inspection Mode Policies should not combine proxy and flow inspection modes. Performance Optimization
  PO04.1 Managed Switch Capacity Exceeded on FortiGate Number of managed FortiSwitch should not exceed 80% of the FortiGate's maximum capacity (table size). We suggest upgrading (or adding more FortiGate if the model already has maximum table size) when the threshold is reached. Performance Optimization
  PO04.2 Redundant FortiLinks Should have redundant FortiLink between FortiGate and FortiSwitch. We suggest adding FortiLink if there is only 1 FortiLink. Switches not directly connected to FGT are exempt. Performance Optimization
  PO04.3 Enable MC-LAG Detect switch peer candidates that can form a tier-1 MC-LAG. Performance Optimization
  PO04.4 Redundant ISL Should have redundant inter-switch links between FortiSwitches. Performance Optimization
  PO04.5 Enable STP Edge ports should have STP enabled once network topology is stable. Performance Optimization
  PO04.6 Lockdown LLDP Profile Edge ports should have LLDP profile locked down to avoid accidental growth in network topology. Performance Optimization

For more information about security ratings, and details about each of the checks that are performed, go to Security Best Practices & Security Rating Feature.

Security rating

Security audit checks are updated to match evolving vulnerability exploits and attacks. The security fabric rating service helps the security and network teams keep up with changing compliance and regulatory standards by identifying opportunities to improve the system configuration and automate processes. The security rating applies to all devices in your Security Fabric, and uses real-time monitoring to analyze your Security Fabric deployment, identify potential vulnerabilities, highlight best practices that can be used to improve the security and performance of your network, and calculate Security Fabric scores.

The security rating gives grades in the following sections:

  • Fabric Security Hardening

  • Audit Logging & Monitoring

  • Threat & Vulnerability Management

  • Network Design & Policies

  • Endpoint Management

  • Firmware & Subscriptions

  • Performance Optimization

The rating also adds consideration for industry standards, such as NIST, PCI DSS compliance, GDPR, and CIS.

Enabling the Security Fabric and rating service allows you to easily identify key deficiencies, take action based on automated recommendations, secure your entire fabric, and passively monitor based on your Security Fabric scores.

The following table lists the security rating tests that are included with FortiOS and do not require a license. The table is grouped by the Score Care category (for example, Security Posture, Fabric Coverage and Optimization) and sorted by the FSBP ID.

Score Card Category

FSBP ID

Name

Description

Category

Security Posture AL02.1 Centralized Logging & Reporting Logging and reporting should be done in a centralized place. Audit Logging & Monitoring
  EM01.1 Endpoint Registration Interfaces which are classified as "LAN" and are used by a policy should have Security Fabric Connection enabled. Endpoint Management
  EM01.2 FortiClient Vulnerabilities All registered FortiClient devices should have no critical vulnerabilities. Endpoint Management
  ND02.4 FortiAP UTM SSID Compatibility (blank) Network Design & Policies
  ND04.1 LAN Segment Servers Servers should be placed behind interfaces classified as "DMZ". Network Design & Policies
  ND05.2 VLAN Management Non-FortiLink interfaces should not have multiple VLANs configured on them. Network Design & Policies
  ND07.1 Device Discovery Interfaces which are classified as "LAN" or "DMZ" and are used by a policy should have device detection enabled. Network Design & Policies
  ND08.1 Interface Classification All interfaces used by a policy should be classified as either 'LAN', 'WAN', or 'DMZ'. Network Design & Policies
  ND09.1 Detect Botnet Connections Policies should block or monitor outgoing connections to botnet sites. Network Design & Policies
  ND10.1 Explicit Interface Policies Polices that allow traffic should not be using the "any" interface. Network Design & Policies
  SH01.1 Unsecure Protocol - Telnet Interfaces currently in use should not allow TELNET administrative access. Fabric Security Hardening
  SH01.11 Unsecure Protocol - TFTP (blank) Fabric Security Hardening
  SH01.2 Unsecure Protocol - HTTP Interfaces currently in use should not allow HTTP administrative access. Fabric Security Hardening
  SH03.1 Valid HTTPS Certificate - Administrative GUI The administrative GUI should be using a valid and secure certificate. Fabric Security Hardening
  SH04.1 Valid HTTPS Certificate - SSL-VPN SSL-VPN should be using a valid and secure certificate. Fabric Security Hardening
  SH05.1 Admin Password Policy A password policy should be set up for system administrators. Fabric Security Hardening
  SH09.7 LDAP Server Identity Check Verify that server-identity-check is enabled for LDAP Servers to ensure certificate validation takes place. While this is the default option in a clean install, it may not be set if upgrading from older releases. Fabric Security Hardening
  SH09.8 Disable Username Sensitivity Check Verify that username case sensitivity is disabled for remote LDAP users. This option is provided only for legacy compatibility reasons. If enabled, it can lead to the bypass of two-factor authentication. Fabric Security Hardening
  SH20.1 DNS Helper (blank) Fabric Security Hardening
Fabric Coverage AL02.2 FortiAnalyzer All FortiGates in the Security Fabric can connect to and authenticate with their configured FortiAnalyzer. Audit Logging & Monitoring
  FS01.1 Compatible Firmware All devices in the Security Fabric should have compatible firmware versions. Firmware & Subscriptions
  FS01.2 FortiAP Firmware Versions All FortiAPs should be running the latest firmware. Firmware & Subscriptions
  FS01.3 FortiSwitch Firmware Versions All FortiSwitches should be running the latest firmware. Firmware & Subscriptions
  FS02.1 FortiCare Support Appropriate devices should be registered with FortiCare and have valid support coverage. Firmware & Subscriptions
  FS02.10 Firmware & General Updates Firmware & General Updates subscription should be valid. Firmware & Subscriptions
  FS02.11 Indicators of Compromise For compromised hosts support the IoC subscription should be valid. Firmware & Subscriptions
  FS02.2 IPS IPS subscription should be valid. Firmware & Subscriptions
  FS02.3 AntiVirus AntiVirus subscription should be valid. Firmware & Subscriptions
  FS02.5 Web Filtering Web Filtering subscription should be valid. Firmware & Subscriptions
  FS02.6 Anti-Spam Anti-Spam subscription should be valid. Firmware & Subscriptions
  FS02.8 Industrial DB Industrial DB subscription should be valid. Firmware & Subscriptions
  FS02.9 Outbreak Prevention Outbreak Prevention subscription should be valid. Firmware & Subscriptions
  FS03.1 Security Rating Security Rating subscription should be valid. Firmware & Subscriptions
  FS05.1 Activate FortiCloud Services (blank) Firmware & Subscriptions
  ND01.1 Unauthorized FortiSwitches All discovered FortiSwitches should be authorized or disabled. Network Design & Policies
  ND01.2 Unauthorized FortiAPs All discovered FortiAPs should be authorized or disabled. Network Design & Policies
  ND06.1 Third Party Router & NAT Devices No third party router or NAT devices should be detected in the network. Network Design & Policies
  TV01.1 Advanced Threat Protection Suspicious files should be submitted to FortiSandbox Appliance/FortiSandbox Cloud for inspection. Threat & Vulnerability Management
  TV01.2 FortiSandbox All FortiGates in the Security Fabric can connect to their configured FortiSandbox. Threat & Vulnerability Management
Optimization ND03.1 Unused Policies All policies should be used. Network Design & Policies
  PO01.10 Policy Inspection Mode Policies should not combine proxy and flow inspection modes. Performance Optimization
  PO04.1 Managed Switch Capacity Exceeded on FortiGate Number of managed FortiSwitch should not exceed 80% of the FortiGate's maximum capacity (table size). We suggest upgrading (or adding more FortiGate if the model already has maximum table size) when the threshold is reached. Performance Optimization
  PO04.2 Redundant FortiLinks Should have redundant FortiLink between FortiGate and FortiSwitch. We suggest adding FortiLink if there is only 1 FortiLink. Switches not directly connected to FGT are exempt. Performance Optimization
  PO04.3 Enable MC-LAG Detect switch peer candidates that can form a tier-1 MC-LAG. Performance Optimization
  PO04.4 Redundant ISL Should have redundant inter-switch links between FortiSwitches. Performance Optimization
  PO04.5 Enable STP Edge ports should have STP enabled once network topology is stable. Performance Optimization
  PO04.6 Lockdown LLDP Profile Edge ports should have LLDP profile locked down to avoid accidental growth in network topology. Performance Optimization

For more information about security ratings, and details about each of the checks that are performed, go to Security Best Practices & Security Rating Feature.