CompTIA SecurityX (CAS-005)Security EngineeringEasy
A critical infrastructure organization is implementing a new Industrial Control System (ICS) that requires extreme isolation from external networks due to the severe consequences of a breach. Data from the ICS network must be sent to a corporate reporting network for analysis, but no data or commands can ever flow back into the ICS network. Which security device is BEST suited to enforce this unidirectional data flow?
- AIntrusion Prevention System (IPS)
- BFirewall
- CData Diode
- DProxy Server
Show answer & explanationAnswer & explanation
Correct answer: C. Data Diode
A data diode (or unidirectional gateway) is a hardware device that physically enforces one-way data flow, making it impossible for data to travel in the reverse direction, which is critical for highly secure ICS/OT environments requiring absolute isolation.
Why the other options are wrong
- A. An IPS detects and prevents intrusions but does not inherently enforce physical unidirectional data flow.
- B. A firewall can filter traffic but is software-dependent and can be misconfigured or exploited to allow bidirectional flow.
- D. A proxy server acts as an intermediary for requests from clients seeking resources from other servers and does not enforce unidirectional data flow.
Data Diode (Unidirectional Gateway)
A hardware device that permits data flow in only one direction, providing absolute network segmentation and preventing reverse data flow.
- Physical enforcement of one-way data flow
- Used for extreme network segmentation
- Common in ICS/OT and high-security environments
Memory trick: Diodes Direct Data, Dangerously One-Way.