EC-Council Certified Ethical Hacker (CEH) v12Mobile Platform, IoT, and OT HackingMedium
A critical infrastructure organization is implementing a new Supervisory Control and Data Acquisition (SCADA) system for its power grid. To enhance security, they are considering a network architecture that physically separates the operational technology (OT) network from the information technology (IT) network, allowing one-way data flow from OT to IT, but strictly preventing any direct inbound connections from IT to OT. Which of the following security concepts does this architecture BEST exemplify?
- AVirtual Local Area Network (VLAN)
- BNetwork Access Control (NAC)
- CDMZ implementation
- DAir gapping with a data diode
Show answer & explanationAnswer & explanation
Correct answer: D. Air gapping with a data diode
The description of physically separating networks and allowing one-way data flow from OT to IT while preventing inbound IT to OT connections is the definition of an air gap, specifically implemented with a data diode to ensure unidirectional communication.
Why the other options are wrong
- A. VLANs segment a network logically, but they don't provide the physical separation or strict one-way data flow described for critical OT environments.
- B. NAC controls who can connect to a network but doesn't inherently enforce physical separation or one-way data flow between distinct networks.
- C. A DMZ (Demilitarized Zone) is a buffer network, but it typically allows two-way traffic for certain services, not strict one-way flow for OT protection.
Air Gap with Data Diode (OT Security)
An air gap is a security measure that isolates a secure network from unsecured networks. A data diode is a hardware device that enforces unidirectional data flow, often used to bridge an air gap for monitoring purposes without allowing reverse communication.
- Provides extreme network isolation for critical systems.
- Data diodes are hardware-enforced, preventing software misconfiguration.
- Commonly used in OT/ICS environments to protect against cyberattacks from IT networks.
Memory trick: Separate critical controls like a power plant, with a one-way gate for safety.