Data diodes have long been the default choice for isolating critical OT networks.<\/strong> Unidirectional by design, they physically guarantee that no traffic can enter the protected network from the exposed one. On paper, that is reassuring.<\/p>\n In the field, reality is more nuanced. Many OT use cases require bidirectional communication: SCADA system administration, file synchronization between zones, industrial protocols that rely on acknowledgments. This is where data diodes reach their structural limits. For more than ten years, Seclab has been developing a hardware-based isolation approach designed for these constraints, which works in both unidirectional and bidirectional modes. This article reviews the alternatives for OT network isolation, the criteria for choosing between them and how well they fit operational realities.<\/p>\n <\/p>\n <\/p>\n A data diode (also called a network diode or unidirectional gateway) is a hardware device that enforces a strictly one-way transfer of information between two networks. This one-way flow is guaranteed by physics, usually through a link with no return path, rather than by software configuration. The NIST SP 800-82 Rev. 3<\/strong><\/a> guide to OT security lists unidirectional gateways among the means of segmenting industrial networks.<\/p>\n In OT environments, diodes are used to send monitoring data (logs, SCADA metrics) to a SOC or a historian without opening a return channel. The nuclear, defense and energy sectors have deployed them for years for this reason.<\/p>\n The device addresses a specific need: one-way data flows. Constraints appear as soon as a use case requires protocol acknowledgments, bidirectional synchronization or remote administration of OT assets.<\/p>\n <\/p>\n The first limit is structural.<\/strong> Industrial protocols such as Modbus TCP, OPC UA or S7comm rely on a request-response model that a diode cannot carry directly. Diode vendors work around this through replication: proxies poll the devices on the OT side and rebuild mirror servers (OPC, historian) on the IT side. This works for reading data, but it allows neither writing to devices nor acknowledging a command. To simulate bidirectional exchanges, some deployments combine two diodes in opposite directions with synchronization gateways, at the cost of higher latency and complex integration.<\/p>\n The second limit concerns application compatibility.<\/strong> These proxies and synchronization agents are additional software components: they widen the attack surface and increase the OT maintenance workload. For teams that are already stretched thin, every added component is one more operational risk.<\/p>\n Finally, content control depends on the functions added around the diode.<\/strong> Some offerings include file inspection or sanitization (CDR), while others only handle the transfer. The level of protocol filtering and file verification therefore varies widely from one product to another and needs to be assessed case by case.<\/p>\n <\/p>\n Five operational criteria shape the choice of an OT network isolation solution:<\/p>\n <\/p>\n Industrial firewalls provide configurable bidirectional network filtering. That is their main advantage over diodes. Filtering rules can be tailored to OT protocols (Modbus, EtherNet\/IP, Profinet) and application compatibility is high.<\/p>\n A firewall nevertheless remains a software component connected to the network. A Seclab study of five OT firewall vendors puts the maintenance workload at 2 to 10 security patches per month. In OT environments, applying these patches requires maintenance windows that are rarely available.<\/p>\n A firewall compromised through one of its interfaces gives access to the different zones it separates. Its protection depends on the quality and constant updating of its rules, not on structural physical isolation.<\/p>\n <\/p>\n Several approaches try to combine the diode principle with extended capabilities. Unidirectional gateways with built-in proxies can export files or SCADA data streams while keeping communication strictly one-way.<\/p>\n Hybrid solutions (dual diodes with a synchronization gateway) aim to simulate bidirectional communication. The trade-off lies in latency and complexity: each additional layer adds transit delay and another component to maintain. At PG&E, a US gas and electricity provider, this type of architecture pushed gas leak detection time beyond two minutes, which was deemed incompatible with safety requirements. In the same context, Electronic AirGap brings latency down to 2 to 4 milliseconds (see the PG&E case study<\/strong><\/a>).<\/p>\n <\/p>\n Electronic AirGap<\/strong><\/a>, a technology patented by Seclab, is based on a different principle. Rather than filtering traffic or restricting its direction, it terminates OSI layers 1 to 4 on each side: no TCP\/IP stack and no network packet crosses the system. Only useful application data passes through, over a non-routable electronic bus.<\/p>\n The architecture relies on three independent processors, each dedicated to a distinct security function. Filtering is based on dual validation: two independent access controls, one at the input and one at the output, each hold half of the policy and are administered separately. A flow only passes if both allow it. The attack surface is therefore reduced by design, not by configuration.<\/p>\n Seclab Xchange<\/strong><\/a>, the appliance that embeds this technology, supports throughput of up to 1.2 Gbps with no additional software component on the network side. Files can be filtered in transit (extension, size, MIME type, signatures). Maintenance is limited to one software update per year on average.<\/p>\n The Electronic AirGap technology has been awarded CSPN certification by ANSSI, the French National Cybersecurity Agency, in version 3.4.0<\/strong>. The evaluation covered, among other things, the protocol break, compartmentalization, handling of malformed inputs and firmware signing. During the evaluation, evaluators were even given administrator rights on one of the access controls, without being able to get through the electronic isolation. Designed and assembled in France, it is a European alternative to the data diodes offered by US and Israeli vendors.<\/p>\n Unidirectional or bidirectional: Xchange adapts to your environment<\/b><\/p>\n <\/p>\n – Unidirectional mode (diode mode): for flows that must remain strictly one-way (sending logs to a SOC, feeding a historian, transmitting metrics), Xchange operates in diode mode. Only useful data passes, in a single direction, with no possible return path.<\/p>\n – Bidirectional mode: for use cases that require an exchange (device administration, file synchronization, protocols with acknowledgments), the same appliance allows controlled bidirectional flows, at up to 1.2 Gbps.<\/p>\n In both cases, the same certified technology provides application filtering, file verification and dual validation of flows. An environment that starts in unidirectional mode can move to bidirectional without changing equipment.<\/p>\n<\/blockquote>\n <\/p>\nKey takeaways: data diode alternatives for OT<\/strong><\/span><\/h3>\n
\n
What is a data diode and why is it used in OT?<\/strong><\/span><\/h3>\n
What are the limits of data diodes in industrial environments?<\/strong><\/span><\/h3>\n
Which criteria should you use to evaluate a data diode alternative?<\/strong><\/span><\/h3>\n
\n
OT firewalls: a partial alternative to data diodes<\/strong><\/span><\/h3>\n
Unidirectional gateways and hybrid solutions<\/strong><\/span><\/h3>\n
Hardware protocol break isolation: how Electronic AirGap works<\/strong><\/span><\/h3>\n
Comparison of OT network isolation approaches<\/strong><\/span><\/h3>\n