5.8. Using Data Diodes
A data diode permits data to flow in one direction only, such as from a high-security zone like an OT network out to a lower-security zone. Absolutely no reverse or back-traffic is possible. The data diode mode of the DataHub Tunnel/Mirror supports both data diode hardware and software emulation.
5.8.1. Hardware and Software
Hardware support
Hardware data diodes enforce physical isolation to block all external attacks, as well as any attacks that may come via a compromised data user, because all TCP or UDP packets are simply not delivered, and get discarded. SSL is thus not available, however hardware data diodes are compatible with firewalls.
Software emulation
Software emulation provides similar data diode functionality, without the hardware. Running a tunnel/mirror connection in data diode mode immediately discards all incoming application data before it can be processed, leaving no chance of application flaws being exploited by malicious packets. This approach can be used with or without a firewall or SSL. TCP control packets and SSL protocol packets (if used) will still be processed, so attacks targeting the operating system TCP stack and SSL implementation can still be attempted. Again, data flow over this connection is strictly unidirectional.
