CompTIA SecurityX (CAS-005)Security EngineeringEasy
A large manufacturing company is integrating its operational technology (OT) network with its enterprise IT network for centralized monitoring and data analytics. The security team needs to ensure that data can flow unidirectionally from the OT network to the IT network, preventing any potential inbound threats from the IT network impacting critical production systems. Which of the following specialized systems should be implemented?
- AData Diode
- BIntrusion Prevention System (IPS)
- CDemilitarized Zone (DMZ)
- DSecurity Information and Event Management (SIEM)
Show answer & explanationAnswer & explanation
Correct answer: A. Data Diode
A data diode (also known as a unidirectional gateway) is a hardware device that enforces one-way data flow, making it ideal for scenarios where data needs to be securely transferred from a highly secure network (like OT) to a less secure network (like IT) without any possibility of reverse communication or attack.
Why the other options are wrong
- B. An IPS monitors for and blocks malicious activity, but it allows bidirectional traffic and cannot guarantee strict unidirectional flow.
- C. A DMZ is a buffer network between internal and external networks, but it still allows bidirectional traffic, albeit with filtering.
- D. A SIEM aggregates and analyzes security logs, but it does not control network traffic flow.
Data Diode
A data diode is a hardware device that ensures data can only flow in one direction, preventing any return path.
- Enforces unidirectional data flow physically.
- Used for high-security environments like ICS/SCADA and critical infrastructure.
- Provides absolute segmentation between networks.
Memory trick: OT data flows out, never back in, like a one-way street.