ISC2 CISSP (Certified Information Systems Security Professional)Communication and Network SecurityHard
A critical industrial control system (ICS) network needs to be isolated from the corporate IT network. The ICS network uses proprietary protocols and devices that are highly sensitive to latency and cannot tolerate any form of active inspection or proxying. However, a one-way data flow from the ICS network to the corporate network is required for monitoring purposes. Which secure network component is specifically designed to enforce this unidirectional data flow while maintaining strict isolation?
- ANext-Generation Firewall (NGFW)
- BRouter with Access Control Lists (ACLs)
- CIntrusion Prevention System (IPS)
- DData Diode
Show answer & explanationAnswer & explanation
Correct answer: D. Data Diode
A data diode (or unidirectional gateway) is a hardware-based solution specifically designed to enforce one-way data flow, preventing any data from traversing in the opposite direction. This is crucial for highly sensitive environments like ICS where strict isolation and guaranteed unidirectional flow are paramount.
Why the other options are wrong
- A. An NGFW can filter traffic but is inherently bidirectional and performs active inspection, which the scenario explicitly states is not tolerable.
- B. A router with ACLs can filter traffic, but it's a software-based solution on hardware that is fundamentally bidirectional and cannot guarantee absolute one-way flow at a physical level against sophisticated attacks or misconfigurations.
- C. An IPS is an active inspection device that can block traffic, but it's still bidirectional and introduces latency, unsuitable for the given constraints.
Data Diode
A hardware device that ensures data can only travel in one direction between two networks, providing absolute isolation and preventing reverse data flow.
- Physical enforcement of unidirectional data flow.
- Used in high-security environments like ICS/SCADA and nuclear facilities.
- Prevents data exfiltration and external attacks from reaching sensitive systems.
Memory trick: A 'Data Diode' is a 'One-Way' 'Gate' for 'Data'.