CompTIA SecurityX (CAS-005)Security EngineeringMedium
A critical infrastructure organization is implementing a new Industrial Control System (ICS) in a highly sensitive environment. Due to the severe consequences of a cyber-physical attack, the security team requires an absolute guarantee that no data can flow from the less trusted business network into the highly trusted ICS network, even in the event of a sophisticated compromise. Which specialized system BEST provides this unidirectional data flow enforcement?
- AIntrusion Prevention System (IPS)
- BData Diode
- CApplication Whitelisting
- DFirewall with strict ACLs
Show answer & explanationAnswer & explanation
Correct answer: B. Data Diode
A data diode, or unidirectional gateway, is a hardware-based device that physically enforces data flow in only one direction. This makes it impossible for data, including malicious commands or exfiltration attempts, to travel from a less trusted network to a more trusted one, offering the highest assurance for critical infrastructure.
Why the other options are wrong
- A. An IPS detects and prevents known threats but is not designed to physically enforce unidirectional data flow and can be bypassed by unknown or zero-day exploits.
- C. Application whitelisting controls what applications can run on a system but does not enforce network traffic directionality.
- D. Firewalls, while providing access control, are software-based and can potentially be misconfigured or bypassed by sophisticated attacks.
Data Diode (Unidirectional Gateway)
A hardware device that physically allows data to flow in only one direction, providing absolute assurance against reverse data flow in critical networks.
- Hardware-enforced unidirectional data flow
- Used in highly sensitive environments (e.g., ICS, nuclear)
- Prevents data exfiltration and ingress of malicious commands
Memory trick: A Data Diode only goes one way, protecting critical data every day.