Part of the Industrial Engineering and Cyber Resilience: Keep the Toolkit, Patch the Assumption. Start there for the wide view, then come back here for the close-up.
A data diode can replace a firewall in a SCADA environment wherever the traffic only needs to go one way, which is more often than most plant networks assume. A firewall is a rulebook that someone has to write, audit and keep current. A data diode is a cable with the return lane physically missing, so there is no rule to get wrong. The catch is that most industrial protocols expect a reply. Here is how to tell which of your connections can make the swap.
| What the connection does | Diode in place of the firewall? | Why |
|---|---|---|
| Historian replication from OT to the business network | Yes | Data only needs to leave; the diode replays it on the other side |
| Alarm, syslog and monitoring feeds to IT or a SOC | Yes | Watching a process never requires writing to it |
| Corporate users polling live values from PLCs | Yes, with gateway software | The reads move to a replica outside; users never touch the PLC |
| Patches, antivirus signatures and recipe files going in | No, not on the same path | A diode aimed outward cannot carry anything inward |
| Vendor remote support and engineering workstation access | No | Interactive sessions need two-way traffic by definition |
How a Data Diode Differs From a Firewall
NIST's Guide to Operational Technology Security (SP 800-82 Rev. 3) puts the difference in one sentence: "Unlike a firewall, data diodes cannot be programmed to allow data to flow in both directions because the hardware is incapable." The one-way property is not a setting. The transmit fiber on one side simply does not exist.
A firewall is the opposite bargain. Austin Scott's SANS GIAC paper on tactical data diodes calls the software rule set a firewall's "greatest strength and weakness." That flexibility is why firewalls sit everywhere, and why a single rushed change window can open a door nobody meant to open, and nobody thought to log.
| Property | Firewall | Data diode |
|---|---|---|
| What enforces direction | A software rule set | Missing hardware on the return path |
| Can a bad change open inbound access? | Yes | No; there is nothing to reconfigure |
| Protocols supported | Almost anything, including OT deep packet inspection | Only what the gateway software can replicate or emulate |
| Delivery confirmation | Built into TCP | None on the wire; the sender never hears back |
| Ongoing work | Rule reviews, audits, firmware | Gateway software updates and replica upkeep |
Where a Diode Can Replace the Firewall
The best candidates are connections whose job is to report, not to control. NIST calls a unidirectional gateway "an alternative to firewalls" and gives the textbook placement: a gateway between Layers 2 and 3 "may protect Layer 0, 1, and 2 devices from a cybersecurity event that occurs at Layers 3, 4, or 5." In plain terms, ransomware on the office network can encrypt every laptop it likes and still cannot send a single packet to the controllers.
Modern gateways are more than a fiber with a missing strand. NIST's glossary describes software that "replicates databases and emulates protocol servers and devices," so a historian or OPC server appears on the business side as a live copy. Scott's paper flags database replication as a natural fit, because a diode moves data without applying software rules in flight.
Where the Swap Breaks
Scott is blunt about the limits: "the vast majority of modern communication protocols require two-way communications in order to function." Modbus polling expects a response. File transfers expect acknowledgments. A diode has no way of knowing whether a packet arrived, which is why commercial gateways lean on replication and emulation rather than passing native traffic.
The bigger gap runs in the other direction. Patches, antivirus signatures, new recipes and vendor support all need to reach the plant. A diode aimed outward cannot carry any of them. Pretending otherwise is how a "temporary" USB routine or a forgotten modem becomes the real inbound path, which is worse than the firewall you removed.
What Regulators Already Require
This is not a fringe idea. The Nuclear Regulatory Commission's Regulatory Guide 5.71 says "only one-way data flow is allowed from Level 4 to Level 3 and from Level 3 to Level 2," prohibits lower levels from initiating communication with higher ones, and lists "implementing one-way data flows using hardware mechanisms" among its controls. In 2025, a joint CISA and U.S. Coast Guard advisory (AA25-212A) told critical infrastructure operators to "implement unidirectional gateways (data diodes) where appropriate to prevent bidirectional communication."
The Department of Energy's Cyber-Informed Engineering strategy frames the same idea as a design principle, secure information architecture: design information pathways "to ensure data flows only in desired ways." A diode is that principle cast in hardware.
The Hybrid Pattern Most Plants Land On
"It is not a matter of which technology is better; it is a matter of which is better suited for the specific cyber risk reducing implementation."
Austin Scott GICSP, author of Tactical Data Diodes in Industrial Automation and Control Systems, SANS GIAC Gold paper (2015)
"In place of" rarely means "instead of everywhere." The pattern that holds up puts a diode on the busy, always-on outbound flows (historian, alarms, monitoring) and keeps a tightly scoped firewall, or a manual transfer procedure, for the rare inbound jobs. That shrinks the firewall's rule set to a handful of scheduled, logged exceptions instead of a standing highway. NIST adds a detail most rule sets miss: make outbound firewall rules "as stringent as inbound rules," because outbound is exactly the direction a diode handles for free.
Protocol Cheat Sheet: What Crosses a Diode Cleanly
| Traffic | Fit for a diode | Notes |
|---|---|---|
| Historian database replication | Strong | The classic use case; the business side reads the replica |
| Syslog and SNMP traps | Strong | Already fire-and-forget; loss handling still needs a plan |
| OPC or Modbus reads for dashboards | Good with emulation | Gateway software polls inside and serves a copy outside |
| File exports and reports | Good with gateway software | No acknowledgment, so the software must resend and verify |
| Writes, setpoint changes, recipe downloads | None | Control traffic needs an inbound path by design |
| Remote desktop and vendor support sessions | None | Keep on a separate, time-boxed, monitored path |
Swap Checklist: Before You Pull the Firewall
| Step | Question to answer |
|---|---|
| 1. Map the flows | Which connections cross this boundary today, and in which direction does each one actually need to move? |
| 2. Sort by direction | Which are report-only, and which change something inside the plant? |
| 3. Check vendor approval | Does your control system vendor support a diode in its reference architecture? |
| 4. Plan the way in | How will patches, signatures and support reach the plant without a standing inbound path? |
| 5. Plan for silence | How will you notice when the one-way feed stops, given the sender never hears back? |
| 6. Retest after cutover | Does a penetration test confirm nothing else, such as a modem or dual-homed host, still bridges the boundary? |
Frequently Asked Questions
- Can a data diode replace a firewall in a SCADA network?
- Yes, for connections that only need to send data out, such as historian replication and monitoring feeds. Anything that must reach into the plant (patches, remote support, setpoint changes) still needs a separate, controlled path.
- What is the difference between a data diode and a unidirectional gateway?
- NIST treats them as the same category. In practice, "gateway" usually means the diode hardware plus software that replicates databases and emulates protocol servers so two-way applications work across it.
- Can a data diode be hacked to allow two-way traffic?
- The one-way property comes from missing return hardware, not configuration, so it cannot be reconfigured. The software on either side can still have flaws, and attackers may look for other paths around the diode.
- Do regulations require data diodes?
- For U.S. nuclear power plants, NRC Regulatory Guide 5.71 requires one-way data flow between its highest security levels and lists hardware-enforced one-way flow among its controls. CISA recommends them for critical infrastructure where appropriate.
A data diode will not do a firewall's whole job, and that is precisely its charm: it does one job with nothing left to misconfigure. Start with the outbound flows, keep the inbound exceptions small and scheduled, and treat the result as one of the engineered controls in an industrial engineering approach to cyber resilience. If you would like help mapping which of your plant's connections can go one way, our cybersecurity team brings the whiteboard.
About Data Diodes
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- SANS GIAC, Tactical Data Diodes in Industrial Automation and Control Systems
- U.S. NRC Regulatory Guide 5.71, Cyber Security Programs for Nuclear Facilities
- CISA and USCG Advisory AA25-212A
- Wikipedia, Unidirectional network
NIST maintains the SP 800-82 guide for operational technology security, and data diodes are also called unidirectional gateways, unidirectional networks or deterministic one-way boundary devices.
Sources: NIST SP 800-82 Rev. 3 (September 2023), Austin Scott, Tactical Data Diodes in Industrial Automation and Control Systems, SANS GIAC (2015), NRC Regulatory Guide 5.71 (January 2010), CISA and USCG Advisory AA25-212A (July 2025), DOE National Cyber-Informed Engineering Strategy (June 2022), Wikipedia, Unidirectional network
