ISC2 CISSP (Certified Information Systems Security Professional)Communication and Network SecurityEasy
A security auditor is reviewing the network design of a critical infrastructure environment. The design includes specialized devices that allow data flow in only one direction, preventing any return path for information. This is crucial for preventing external threats from affecting internal operational technology (OT) networks. What type of device is being described?
- AIntrusion Prevention System (IPS)
- BData Diode
- CProxy Server
- DStateful Firewall
Show answer & explanationAnswer & explanation
Correct answer: B. Data Diode
A data diode (or unidirectional gateway) is a hardware device that enforces one-way data flow, ensuring that data can only move from a less secure network to a more secure one, or vice-versa, without any return path. This is commonly used in critical infrastructure to protect OT networks.
Why the other options are wrong
- A. An IPS analyzes traffic for threats and can block malicious activity, but it typically allows bidirectional traffic and doesn't enforce one-way flow by design.
- C. A proxy server acts as an intermediary for requests from clients seeking resources from other servers and allows bidirectional communication.
- D. A stateful firewall allows bidirectional traffic based on connection states, which contradicts the one-way flow requirement.
Data Diode
A hardware device that ensures data can only flow in one direction, preventing any return path for information.
- Enforces one-way data flow at the physical layer.
- Used for high-security environments, like critical infrastructure or military networks.
- Provides strong isolation and prevents data exfiltration or reverse attacks.
Memory trick: The 'Diode' points the way, only one way, for data's safe journey.