5 ms·
The things are much easier: two parts, one has blinking LED, another is photosensor. This is called "data diode" and there is a lot of them. Here is a random v
by theamk 2y ago
The things are much easier: two parts, one has blinking LED, another is photosensor. This is called "data diode" and there is a lot of them.
Here is a random vendor with nice pictures: https://owlcyberdefense.com/learn-about-data-diodes/ https://owlcyberdefense.com/learn-about-data-diodes/
- eastbound 2y agoAn optic fiber.
- dangsux 2y ago[dead]
- jalk 2y agoSo one-way IrDa?
- folmar 2y agoYes, but the vendor also gives some reasonable transmission software that will be able to transmit common protocols (like OPC/DB updates and so on) multiplexed and abstracting away the confirmationless medium.
- ibeff 2y agoLet's hope the photosensor processing software on the receiving end doesn't have any bugs that could be exploited.
- theamk 2y agoDepends on the direction. If data diode points to outside, like a power plant exporting its status to web, then photosensor can be completely taken over. Sure, the web page might be completely bogus, but there will be no disruption in power plant's system. The hardware design guarantees it. That is the strongest case for data diodes. If data diode points to inside, like a power plant getting new data from the outside, then sure, photosensor software is a concern, but since it's relatively simple, this would not be my biggest worry. I'd worry about app that runs on target PC and receives files; if file is an archive, about un-archiver exploits; an finally about the files themselves. If there a doc, are you sure it's not exploiting Word? If there is an update, are you sure it's not trojaned? Are you sure users are not click on the executable thinking it's a directory?
- alwa 2y ago> But what if I need to send data two-ways? Some systems cannot operate one-way, so they require a two-way solution. For these use cases, Owl has a unique bidirectional data diode solution – ReCon – that operates on two parallel one-way paths. Get all the security advantages of data diodes with the flexibility of a two-way solution. …but…what? Why are we doing the blinking-light song and dance at all then?
- deleted 2y ago[deleted]
- dotancohen 2y agoIf you're already using a data transfer mechanism that the human can't verify every character going over the line, why use infrared? What does that give over a USB cable or, gasp, an internet connection?
- krisoft 2y agoThe idea is in the name. It is a "data diode". It lets data through in one direction and the data can't go in the other. Verifiably because it doesn't have the hardware for data to go the other direction. I don't think this property can be guaranteed for the alternatives you proposed.
- jszymborski 2y agoBut surely malware is just "data", no? Or am I missing something.
- krisoft 2y agoThe idea is that the malware could have infiltrated the system (probably) but couldn't have exfiltrated data from it. So a data diode wouldn't stop a "stuxnet" scenairo where the malware is trying to sabotage the air-gapped. But it would prevent secret information being leaked out. (Btw. I'm just explaining what a data diode is, and what guarantees it provides. I don't actually think that it would be useful in practice, because it feels to be too cumbersome to use it and therefore the users/IT would poke holes into the security it would provide otherwise.)
- jszymborski 2y agointeresting, thank you.
- vrolijk 2y agoThere is a cheap way to test via the open source data diode workshop. Https://www.github.com/vrolijk/osdd Love to read your findings!