Security and audit

FireSight OT is built so that nothing on the plant floor accepts a connection from outside, and so that every access is limited, deliberate and recorded.

How the pieces trust each other

Outbound only. A Cloud Connector only ever connects out to the Hub. The site's firewall needs no inbound rules.
A certificate per device. Each connector makes its own key and gets a certificate from the Hub's own certificate authority when it enrolls. Every tunnel uses mutual TLS. Certificates renew automatically before they expire.
One-time enrollment codes that expire, with a check that the enrollment wasn't intercepted.
The site has the last word. A connector's local_allow list caps which machines the Hub may ask it to reach. The Hub can't widen it, and changes to the device's network from the Hub are off unless the site allows them.
Signed updates. Software updates are signed (Ed25519), and a connector refuses an update that isn't.
Granted access only. People see and reach only the resources granted to them. Even the full-network VPN is limited to granted networks.

Security settings

Under Security & settings, or fsot-hub policy set key=value. A connector can have its own overrides, but they can only make things stricter.

Setting	Meaning	Default
`min_tls`	TLS 1.3 only, or 1.2 and later with the cipher suites you choose (`cipher_suites`)	1.3
`require_totp`	Two-factor sign-in for everyone (vendors always need it)	off
`user_source_cidrs`	Networks people may sign in from	anywhere
`session_idle_min`	Sign out after this many idle minutes	30
`user_session_hours`	Longest sign-in	12
`max_conns_per_user`	Open tunnels per person	20
`cert_lifetime_days`, `rotate_before_days`	Device certificate lifetime, and when to renew	90, 30
`heartbeat_sec`	How often connectors check in	20
`enroll_code_hours`	How long an enrollment code works	72
`allow_static_forwards`, `allow_vpn`	Allow port forwards on the Hub, and the full-network VPN	off

Sign-in attempts are rate-limited, and the console is protected against cross-site request forgery.

We recommend turning require_totp on for every Hub, and setting user_source_cidrs where your people work from known networks.

Audit log

Every sign-in, session, grant, change, file transfer and remote command is in the Audit log, with who did it, from where, and their division or vendor. Search it in the console, or export it:

fsot-hub audit --action access --csv > access.csv
fsot-hub sessions                 # who is connected now
fsot-hub sessions kill ses_…      # end a session

If a device is lost or stolen

Open the connector on the Hub and choose Revoke. Its certificate stops working at once. To bring it (or a replacement) back, create a new enrollment code.

Reporting a security problem

Email support@firesightsystems.com with "Security" in the subject. Please don't include passwords, keys or enrollment codes.