Data diodes and unidirectional gateways: frequent asked questions
Security Strategy and Architecture
Cloud analytics, centralized monitoring and vendor services can introduce new connections to OT. Reassessing segmentation helps identify unnecessary access paths, critical dependencies and connections whose compromise could affect operations.
When data must leave a protected environment but communication back through that boundary is unnecessary or unacceptable. Typical uses include historian replication, security logging and reporting. Selection should reflect operational consequences and required data flows.
A single outbound gateway cannot support interactive administration or commands returning to OT. These requirements need separate assessment. Distinguishing data consumption from operational control helps determine which applications can operate through one-way replication.
Data access allows applications to consume selected information. System access may allow sessions, queries or configuration changes. Unidirectional replication provides external applications with a data copy without opening a return path to the source systems.
Yes. Restricting connectivity can reduce exposure where equipment cannot readily be patched or replaced. Integration must respect application dependencies and operational constraints. Segmentation limits selected attack paths; it does not remove existing vulnerabilities.
Firewalls control permitted communications through rules. A hardware-enforced unidirectional boundary physically prevents reverse transmission across a designated link. The technologies can complement each other where outbound data is necessary but inbound connectivity creates unacceptable risk.
Data Diodes and Unidirectional Security
A data diode is a hardware device that permits information transfer in one direction and physically prevents reverse transmission across that link. An OT-to-IT diode enables industrial data export without a return path through the same connection.
A data diode physically enforces one-way transmission. A unidirectional gateway adds software to make applications work across that boundary. Cyberium’s One-Way Appliance (OWA) combines hardware-enforced segmentation with proxies and replication agents, enabling industrial data exchange without opening a return path across the protected link.
No. Protocol break terminates and reconstructs communications between environments. Hardware-enforced unidirectionality physically restricts transfer direction. Cyberium combines these functions, but protocol break alone does not prove that reverse information flow is physically impossible.
An OT-to-IT diode prevents ransomware in IT from using that link to communicate back into OT. Other infection routes remain relevant, including removable media, compromised maintenance equipment and separate connections.
Only in the direction it blocks. An OT-to-IT diode permits information to leave OT. Export policies, content controls and destination security remain necessary to protect sensitive information.
Industrial Data and Application Integration
Replicate selected data to a receiving system outside the protected OT zone. External applications access that copy rather than the source historian. Cyberium supports AVEVA PI replication through its MICA agent.
MICA replicates AVEVA PI point values and metadata one-way to a destination PI server. It supports direct, fan-in (multi-site to central) and fan-out topologies, high-availability operation, and automatic backfill after failover or data loss. Supported PI versions and capacity must be validated against the selected deployment.
Yes. Each site can export selected information through its own unidirectional boundary to a central platform. Cyberium supports multi-site AVEVA PI replication, with naming, timestamps and data ownership addressed during integration.
Cyberium provides connectors for file transfer (FTP/FTPS/SFTP), HTTPS, SMTP relay, Syslog, UDP and MQTT, and integration services for AVEVA PI (MICA), OPC UA, AspenTech IP.21, Honeywell PHD, database replication (Oracle, Microsoft SQL Server), WSUS and managed folder synchronisation. Compatibility depends on versions, interfaces and required application functions.
Logs are collected within OT and exported through a unidirectional gateway. Cyberium supports Syslog and HTTPS/API integrations. The SOC analyzes exported information; any response commands require a separately assessed access mechanism.
Yes. Applications can analyze data exported to a receiving environment outside OT. An outbound-only link cannot return process changes. Automated control requires a separately designed inbound workflow and operational safeguards.
Inbound Transfers and Remote Visibility
For imports into protected networks, Cyberium OWA 2U/3U provides Content Inspection and Filtering (CIF), with dual antivirus scanning, per-file and file-type filtering, and digital-signature filtering. These controls apply only to imports. They inspect and filter files; they do not perform Content Disarm and Reconstruction (CDR).
No. Each link remains unidirectional, but the combined architecture permits information flow both ways. Inbound content and application interactions must be assessed; the protection model differs from an architecture with no inbound channel.
Yes. One-way viewing exports images or video without returning keyboard or mouse input to OT. Cyberium lists CCTV and remote screencasting among its use cases. Formats and application compatibility require project-specific validation.
Performance and Deployment
Measure sustained end-to-end throughput with representative protocols, file sizes and security controls, rather than relying on interface speed. Cyberium OWA’s 10/25G models support sustained 10 Gbps transfers for high-volume workloads. A proof of concept should confirm throughput, latency and data integrity under your operating conditions.
Cyberium OWA uses downstream buffering and replay to resume delivery after destination outages, within configured storage limits. On supported configurations, active-active high availability adds redundancy and automatic failover for component failures. Validate buffer capacity, recovery behavior and HA availability for the selected model during your proof of concept.
Management connections must not bypass the protected boundary. Assess interfaces, administrator workstations, maintenance access and shared services on both sides. Document their permitted communications and privileges alongside operational data flows.
Validate application compatibility, data completeness, latency, source-system load, failure recovery and administration. Include inbound controls where relevant. Agree acceptance criteria beforehand so results support the intended production architecture.
Compliance and Certification
No. A diode can support organizational security controls under NIS2, while the CRA addresses product cybersecurity obligations. Neither framework is satisfied by one component; applicable requirements must be assessed across the relevant scope.
Not automatically. A diode can strengthen restricted data flow, but security levels depend on multiple requirements and the assessed scope. Target levels, component capabilities and achieved system security must be distinguished.
No. Certification covers a defined product, version and evaluation scope. Cyberium identifies certifications applying to optional diode components. These do not automatically extend to the gateway, software or complete installation.
Cyberium and Investment Decisions
Cyberium OWA combines hardware-enforced segmentation with proxies, protocol connectors and application-level replication, including AVEVA PI historian replication. This enables operational data exchange across isolated networks. Cyberium’s deployment experience spans more than 400 deployments across Europe, the Middle East and Asia.
Cyberium OWA’s ROI includes simpler controls, easier audits and less documentation where unidirectional segmentation reduces the applicable compliance scope. Document that reduction and the associated savings with your auditor. Assess operational savings separately, and include insurance discounts or avoided downtime only when supported by evidence specific to your organization.
