5 things you can use a data diode for

Data diodes are best known for enabling secure one-way data transfer between networks, but they can be used in several ways. In this article, we highlight five lesser-known ways data diodes can be used to solve organisations’ security challenges.

Questions we cover in this article

• What is a data diode?

• How does a data diode work?

• What is a data diode used for?

• What five other things can a data diode be used for?
  

What is a data diode?

A data diode is a cybersecurity solution that ensures unidirectional information exchange. This high assurance hardware device maintains both network integrity by preventing intrusion, as well as network confidentiality by protecting the most security sensitive information.

How does a data diode work?

Data diodes are the failsafe way to protect sensitive systems and confidential data. Data diodes are small hardware devices, also called “unidirectional security gateways”, which sit between two networks. Working like a check valve, the function of a data diode is to allow all data to pass in the forward direction, while blocking all data in the reverse direction. The fiber optical connection makes it physically impossible for data to travel in the opposite direction. And as it is not software, it cannot be compromised by malicious code, which is partly why data diodes are considered high assurance devices.

Five things you can use data diodes for

1. Data diodes and IoT sensor networks
   If you have an IoT sensor network, you want to be able to protect your network from tampering, but still be able to export sensor data. If the sensors are manipulated, it can have major consequences as very critical information is often involved. It is also crucial that incorrect data is not sent. When the sensor data is exported, the data diode can ensure that the information can be extracted, but that the sensor network is protected against threats. In this case, the diode is connected so that only export of sensor data is possible.
2. Data diodes and HTTP mirror
   An HTTP mirror is a way to mirror a website into a secure network in order to see the content securely. By using an HTTP mirror you do not have to download the information directly online, and thereby you can limit the possibilities for cyberattacks. A data diode ensures that the website can be mirrored/copied into the protected environment and ensures that no information can be leaked.
3. Data diodes and traffic tapping
   By using TAP (Test Access Point) or port mirroring (e.g. SPAN) where the traffic is dropped on a mirrored port on (usually) a switch, you can do a traffic tapping on a duplicate of the traffic. This way you can monitor OT or ICS systems without security risks.
   
   It can also be of value to know if someone has been inside your system and to be able to see exactly what has happened – then you can use a so-called intrusion detection system. In this case, a data diode can be used to ensure that the intrusion detection system can only listen to the traffic, but not in any way affect the systems in OT/ICS.
4. Data diodes and video streaming
   When streaming video, for example through a surveillance camera, a good security solution can be to let the multiple streams of information flow through a data diode. The purpose of the data diode will then be to protect the IT environment so that the connection between camera and network does not become an input for an attack.
5. Data diodes and logging
   Data diodes can be a good solution when working with logging. The purpose of logging is to be able to see if something has gone wrong, and if so what, much like a black box in an airplane. When exporting log data from a device that you want to monitor, a data diode can ensure that the log information can only go in one direction, so that the log analysis system cannot affect the sensitive systems being monitored.