ISC2 CISSP (Certified Information Systems Security Professional)Communication and Network SecurityHard
A security auditor is reviewing the network design for a new, highly sensitive processing facility. The facility requires absolute assurance that no data can ever flow from its operational technology (OT) network, which controls critical machinery, to the external corporate network, while still allowing the corporate network to receive status updates from the OT network. Which of the following secure communication devices would BEST enforce this one-way data flow?
- AData Diode
- BApplication Gateway
- CIntrusion Prevention System (IPS)
- DNext-Generation Firewall (NGFW)
Show answer & explanationAnswer & explanation
Correct answer: A. Data Diode
A data diode (or unidirectional gateway) is a hardware device that ensures data can only flow in one direction. It physically enforces a one-way data transfer, making it impossible for data to return from the corporate network to the OT network. This provides the highest level of assurance for preventing data exfiltration or external command injection into critical systems.
Why the other options are wrong
- B. An application gateway (proxy) filters traffic at the application layer but is still a bidirectional software component, not a physical one-way device.
- C. IPS detects and prevents attacks but is bidirectional and software-based, not enforcing physical one-way data flow.
- D. NGFWs provide advanced filtering but are software-based and bidirectional, not guaranteeing physical one-way flow.
Data Diode
A hardware-based network security device that enforces one-way data flow between two networks. It prevents any data from flowing in the reverse direction, providing absolute assurance against data exfiltration or external network intrusion.
- Physically enforces unidirectional data transfer.
- Offers the highest level of network segregation security.
- Commonly used in critical infrastructure (OT/ICS) and classified networks.
- Prevents data leakage and external command injection.
Memory trick: Data Diodes Direct Data Definitely One-Way.