ISC2 CISSP (Certified Information Systems Security Professional)Communication and Network SecurityMedium
A manufacturing plant is implementing an Industrial Control System (ICS) network. To prevent unauthorized access and maintain system uptime, the security architect proposes a design where network traffic for critical control devices is strictly isolated from the corporate IT network. Data flow from the ICS network to the corporate network is permitted for monitoring purposes, but no traffic from the corporate network should ever reach the ICS network. Which network component is most suitable for enforcing this unidirectional data flow?
- ARouter with Access Control Lists (ACLs)
- BStateful Firewall
- CIntrusion Prevention System (IPS)
- DUnidirectional Gateway (Data Diode)
Show answer & explanationAnswer & explanation
Correct answer: D. Unidirectional Gateway (Data Diode)
A unidirectional gateway, or data diode, is a hardware device that physically enforces one-way data transfer, ensuring that data can only flow from the ICS network to the corporate network, but never the other way around. This provides the highest level of isolation for critical systems.
Why the other options are wrong
- A. A router with ACLs can filter traffic but is software-based and inherently bidirectional, making it susceptible to misconfiguration or bypass.
- B. A stateful firewall monitors connection states and filters traffic but is also a software-based, bidirectional device that could be compromised or misconfigured.
- C. An IPS detects and prevents intrusions but is designed for bidirectional traffic and cannot guarantee physical unidirectional flow.
Data Diode
A hardware device that permits data flow in only one direction, ensuring absolute physical isolation between networks.
- Physically enforces one-way data transfer.
- Used for maximum security in critical infrastructure (ICS/SCADA).
- Prevents reverse data flow and cyber attacks.
Memory trick: Diode is one-way, Firewall is two-way.