Cisco CCNP Security Core (SCOR) 350-701Visibility and EnforcementMedium
A security architect is designing a network segmentation strategy for an organization with a mix of IT and Operational Technology (OT) assets. The goal is to isolate critical OT systems from the IT network while allowing controlled, monitored access for maintenance and data collection. Which segmentation approach provides the strongest isolation for critical OT assets while still enabling necessary, secure communication paths?
- AMicro-segmentation using a firewall at each OT system boundary.
- BSoftware-defined segmentation (SDN) with policy-based enforcement.
- CAir-gapped network for OT with a data diode for unidirectional data transfer.
- DVLAN-based segmentation with ACLs on inter-VLAN routing.
Show answer & explanationAnswer & explanation
Correct answer: C. Air-gapped network for OT with a data diode for unidirectional data transfer.
An air-gapped network provides physical separation, offering the strongest isolation. A data diode then securely allows unidirectional data transfer, preventing any inbound threats to the critical OT systems while facilitating necessary outbound data collection.
Why the other options are wrong
- A. Micro-segmentation improves control but relies on network-based firewalls, which are still susceptible to complex network attacks or misconfigurations across a shared physical network.
- B. SDN provides flexible policy enforcement but is still a logical segmentation method over a shared network infrastructure, not physical isolation.
- D. VLANs with ACLs provide logical separation but still share physical infrastructure, making them less secure than physical air gapping for critical OT.
Air-Gapped Network with Data Diode
A security architecture where a critical network segment is physically isolated from other networks (air-gapped) and uses a data diode to enforce unidirectional data flow, typically from the secure to the less secure network.
- Provides physical separation for maximum isolation.
- Data diode allows data flow in one direction only.
- Commonly used for highly sensitive OT/ICS environments.
- Prevents inbound cyberattacks.
Memory trick: For OT, think physical separation and one-way streets.