CompTIA SecurityX (CAS-005)Security EngineeringEasy
A critical infrastructure organization is integrating a new Industrial Control System (ICS) into its existing network. Due to the high sensitivity of the ICS environment, the security team needs to ensure that any data flowing from the IT network to the OT network is strictly one-way, preventing any potential back-channel communication or data exfiltration from the OT network. Which specialized security device is BEST suited for enforcing this unidirectional data flow?
- AIntrusion Detection System (IDS)
- BNext-Generation Firewall (NGFW)
- CData Diode (Unidirectional Gateway)
- DSecure Web Gateway (SWG)
Show answer & explanationAnswer & explanation
Correct answer: C. Data Diode (Unidirectional Gateway)
A data diode, also known as a unidirectional gateway, is a cybersecurity device that ensures data can only flow in one physical direction. This physically enforced one-way communication is ideal for protecting highly sensitive networks like ICS/OT from external threats and preventing data exfiltration.
Why the other options are wrong
- A. An IDS detects malicious activity but does not enforce one-way data flow or prevent back-channel communication.
- B. An NGFW provides advanced filtering and inspection but operates at higher layers and cannot physically guarantee unidirectional data flow.
- D. A Secure Web Gateway (SWG) filters web traffic for security, which is irrelevant for enforcing one-way communication between IT and OT networks.
Data Diode (Unidirectional Gateway)
A hardware device that permits data flow in only one physical direction, ensuring absolute isolation and preventing any return path or back-channel communication.
- Physically enforced one-way data flow
- Provides absolute isolation
- Prevents data exfiltration
- Common in ICS/OT and high-security networks
Memory trick: Data Diode: One-way street for critical data.