ISC2 CISSP (Certified Information Systems Security Professional)Communication and Network SecurityHard
A security architect is designing a secure network for a new satellite ground station. Due to the extreme sensitivity of the data and the need for absolute isolation between the mission-critical network and the administrative network, any data transfer from the administrative network to the mission-critical network must be physically impossible, while one-way data flow from mission-critical to administrative is permitted for monitoring. Which secure communication channel component is the BEST choice to enforce this strict unidirectional data flow?
- AVLAN with ACLs
- BStateful Firewall
- CData Diode
- DVPN Tunnel
Show answer & explanationAnswer & explanation
Correct answer: C. Data Diode
A data diode is a hardware device specifically engineered to enforce unidirectional data flow at the physical layer. It physically prevents any data from flowing in the reverse direction, making it the most robust solution for absolute isolation and one-way data transfer in highly sensitive environments like critical infrastructure or satellite ground stations.
Why the other options are wrong
- A. VLANs with ACLs provide logical segmentation and filtering, but they do not offer the physical guarantee of one-way data flow and can be misconfigured or bypassed.
- B. A stateful firewall allows bidirectional traffic based on connection states and rules, which contradicts the requirement for physically impossible reverse data flow.
- D. A VPN tunnel provides encrypted bidirectional communication and authentication, but it does not inherently enforce physical one-way data flow.
Data Diode
A hardware-based network security device that creates an electronically controlled physical gap to ensure information can only flow in one direction.
- Enforces unidirectional data flow at the physical layer.
- Provides absolute isolation between networks.
- Used in highly sensitive environments requiring maximum security.
Memory trick: The 'Diode' is a one-way street, no U-turns allowed.