Network Security Devices | Automation Engineering Body of Knowledge

Network security devices control and monitor traffic to protect systems from unauthorised access, attacks and malicious communications. Selecting the correct device depends on the security objective, architecture, performance and operational constraints.

Firewall types, IACS protocol inspection and zone-boundary rules are filed under IEC/TR 62443-3-1 Clause 6. This page is the device-selection overview and the home for unidirectional gateways (data diodes), which the 2007 technical report does not treat as a heading.

Device selection

Choosing the correct security device is a design decision, not a catalogue purchase.

Consider:

Security objective (segmentation, monitoring, isolation)
Device location within the network
OSI layer where protection is required
Network complexity
Performance and latency requirements
Processing and resource overhead
Supported industrial protocols
Maintainability and operational requirements

Not every connection requires a firewall — a managed switch, router ACL or other network control may be sufficient inside a zone. Use a firewall (or diode) at a change of trust. See Clause 6.1 for classes (packet filter, stateful, proxy, DPI) and IACS placement rules.

Unidirectional gateways (data diodes)

A unidirectional gateway (data diode) is a hardware-enforced device that physically allows communication in only one direction. Unlike a firewall, this protection is enforced by hardware rather than software configuration.

Data flows source → destination with no physical return path. That prevents remote access, command injection, malware propagation and inbound network attacks over that path. Because many protocols (including TCP) expect a reverse channel, diodes typically emulate the handshake so one-way transfer still works.

Typical uses

Critical infrastructure, nuclear, defence, utilities and high-security industrial sites. Typical applications: historian data to IT, operational monitoring, performance and regulatory reporting — with no inbound path to OT.

Firewall vs data diode

Feature	Firewall	Unidirectional gateway
Communication	Two-way (controlled)	One-way only
Security enforcement	Software policies	Physical hardware
Remote access	Can be permitted	Impossible over the diode path
Traffic inspection	Yes	No (one-way transfer)
Primary purpose	Segmentation and access control	Absolute isolation on that path

Key takeaways

Select devices for objective, location, protocol support and latency — not brand first.
Firewall technology assessment lives in IEC 62443-3-1 Clause 6.1.
Data diodes provide hardware-enforced one-way flow where inbound access must be impossible.