3 security problems that authorities can solve with the help of data diodes

Authorities often handle large amounts of sensitive information. Information that can be valuable both for society, the authority and for the individual. If such information is lost or incorrect, it can have disastrous consequences.

A solution that is often used to protect sensitive or security-classified information from leakage or manipulation is to disconnect it from other networks entirely, a so-called air-gap. However, there are situations when you need to secure information exchange between domains with different security or protection needs. This can be between databases, servers, applications or combinations of these – then you need a Cross Domain Solution. Data diodes address the concept of communicating, sharing, or moving information between domains and apply validation, transformation, or filtering to the exchange.

Three areas ehere authorities need data diodes

Secure file transfer

Transferring socially critical information from a system to an administrative office network involves potential security risks. However, if a data diode is pointed out of the high-security network toward a lower-security network, data can be transmitted while the network remains protected. By transmitting information through a data diode, you are guaranteed that no one else can use the same connection in the opposite direction to access the sensitive network and manipulate its environment.

A data diode can also be aimed at the sensitive network. In these cases, it is most likely that you want to collect information from another network. The security risk that arises is how you collect the information while ensuring that no sensitive data from your sensitive network is leaked through this channel. A data diode ensures network confidentiality by preventing leakage from occurring.

Interested in learning more about our data diodes?

Traceability and logging in security-sensitive operations

Centralised log collection in security-sensitive systems increases the risk of attacks. To reduce the risks, a solution is required that protects both log information and all connected systems.

Most IT systems create logs that enable troubleshooting and traceability. To get the most out of such logs, it is important to collect logs from as many systems as possible into a central system for storage and analysis.

If you have security-sensitive or zoned systems and want to introduce centralised log collection, you must consider a built-in goal conflict. Logging benefits from having a common system for all zones/subsystems while a common system increases the risk of attacks of various kinds.

Centralised log collection is a task that can be protected in a very powerful way using data diodes. All zones that deliver log information are protected with a data diode each. The data flow is unidirectional in the direction of the log system. A common log system can thus be used regardless of how many zones that deliver data to the log system. If any of the zones contain secret information, the log system must be protected at the corresponding level of confidentiality, alternatively the log information from such a zone must be filtered so that the log system is not contaminated with secret information. However, this can lead to a decrease in the value of the log information because the free text data often must be filtered out, which means that the log information can become more difficult to interpret. Learn more here.

Secure updates

Since the start with Windows and/or Linux based systems within ICS/SCADA, the need to be able to update these systems has increased. This need is because complex software often contains bugs that should be fixed to ensure system stability and security.

But doing these updates is something that can itself pose a security risk if not done properly. Integrity and availability of the systems must be maintained, and most system updates are normally not sufficiently evaluated in the environment in which they are used or in combination with the applications that are running.

The update can be done securely by using a data diode that ensures a one-way communication. The data diode is connected so that information can be imported into the system, but since no traffic can be transmitted in the opposite direction, information leakage is made impossible. Learn more here.

Need more help securing your information?
We are at your service.