Data Diode vs Firewall: What UK Guidance Actually Says

Last updated: 24 July 2026

Short answer: a firewall decides what traffic is allowed; a data diode decides what is physically possible. In the data diode vs firewall comparison the firewall is software policy that can be misconfigured, bypassed or changed, while a diode is hardware that has no return path at all. That makes the diode absolute for genuinely one-way flows and useless for anything interactive. Almost every real OT architecture uses both, and the useful question is not which is better but which of your flows are truly one-way.

This page is written by a UK supplier that sells diodes, so treat the recommendation accordingly — but every claim below is anchored to NCSC, NIST or CISA guidance rather than marketing, including the reasons you might be better off not buying one.

On this page:

• What is the difference between a data diode and a firewall?
• How does a data diode physically enforce one-way flow?
• What UK guidance actually says about data diodes
• When a firewall is the right tool
• When a data diode is the right tool
• The limitations diode vendors skip
• Data diode vs firewall: how the two work together
• Frequently asked questions

What is the difference between a data diode and a firewall?

A firewall inspects traffic and applies rules. It is flexible, identity-aware, and can be reconfigured as operations change — which is precisely why it can also be misconfigured, bypassed or quietly loosened over years of change requests. A data diode carries no rules at all. Its hardware transmits in one direction and cannot receive, so the guarantee holds even if both networks are compromised.

NIST defines a data diode as a device that “allows data to travel only in one direction”, and describes the unidirectional gateway hardware as “physically unable to send any information at all back to the source network” (NIST SP 800-82r3, Guide to Operational Technology Security, 2023). The UK NCSC frames the benefit slightly differently, and more usefully for anyone who has managed a firewall estate: with a diode, directionality “cannot be accidentally re-enabled due to misconfigurations”. The guarantee survives human error. A firewall rule does not.

That is the whole distinction. Everything else — cost, complexity, use cases — follows from it.

How does a data diode physically enforce one-way flow?

The enforcement is in the hardware, not the configuration. The sending side has a transmitter with no corresponding receiver, so there is no physical path for a signal to return. CISA describes the send and receive elements as acting as a “one-way ‘communications protocol break’” between the two network domains (NCCIC/ICS-CERT, Defense in Depth, 2016). Traffic terminates on one side and is regenerated on the other; nothing traverses end to end, so there is no session for an attacker to ride.

This raises an obvious engineering problem. TCP — the basis of most useful protocols — is bidirectional by design, needing handshakes, acknowledgements and retransmission. None of that can cross a diode. The answer is a proxy pair: software on the sending side terminates a normal TCP session inside the OT network and pushes the payload one way, typically with forward error correction standing in for the retransmissions it can never request; software on the receiving side reassembles it and re-presents it over ordinary two-way protocols. NIST captures this as the software half of the definition — it “replicates databases and emulates protocol servers and devices”. Both endpoints believe they are in a normal conversation.

The practical consequence is worth stating plainly: reliability across a diode is engineered, not inherent. There is no true end-to-end delivery confirmation, because a confirmation would be a return path.

What UK guidance actually says about data diodes

This is where most comparison pages go quiet, because almost all of them are written by diode vendors outside the UK. In January 2026 the NCSC published Secure connectivity principles for Operational Technology, produced with CISA, the FBI, Germany’s BSI and other international partners. It is the most directly relevant guidance a UK operator has, and it is refreshingly unromantic about diodes.

NCSC endorses them for assurance of one-way flow, and gives a specific recommendation many buyers miss: diodes are useful for ingesting hard-to-inspect data into an isolated network, such as pulling logs or packet captures into a segregated monitoring environment. It also states the limit clearly — a diode “solely ensures data directionality” and does not provide the broader protections of a full cross-domain solution.

Two points from that guidance deserve more attention than they get. First, NCSC calls out a specific bad design: putting a diode in each direction, with software orchestrating the two-way flow, is described as an anti-pattern. If your requirement is genuinely bidirectional, back-to-back diodes are not the answer. Second, and largely absent from competing pages, NCSC’s isolation guidance points out that hardware-enforced links can be a reason to keep visibility during an incident: if telemetry and logging leave through a diode, you may be able to hold that link up while isolating everything else. A diode is not only a preventive control; it can be what lets you still see the plant on your worst day.

For the regulatory frame, UK operators of essential services sit under the Network and Information Systems Regulations 2018, assessed in practice against the NCSC Cyber Assessment Framework. Note that NIS2 is an EU directive and does not apply in the UK; the UK route is the Cyber Security and Resilience Bill, published in November 2025, which amends rather than replaces the 2018 regulations and, at the time of writing, is a Bill rather than law. Anyone telling you that NIS2 obliges you to buy a diode is selling something.

When a firewall is the right tool

For most boundaries, by count, the firewall wins — and this is the mainstream position of the standards bodies, not a hedge. NIST states that firewalls “typically constitute the primary mechanism for protecting OT devices”, and NCSC recommends investing in a modern next-generation firewall with application-layer inspection at the OT boundary, treating its patchability and modularity as a feature.

Choose a firewall when traffic must be bidirectional — remote engineering access, vendor support sessions, OPC UA client/server exchanges, any command and control. Choose it when you need authenticated, audited, identity-aware access, because a diode has no concept of who initiated anything. Choose it when you need protocol-aware inspection: OT firewalls parse DNP3, CIP and Modbus for deep packet inspection, which a diode never does.

One underused firewall control deserves a mention, because it is free and most sites skip it. NIST notes considerable variation in how organisations handle outbound traffic from the control network, and advises making outbound rules as stringent as inbound ones. Tightening egress is often a bigger real-world risk reduction than any hardware purchase.

When a data diode is the right tool

A diode earns its place when the flow is genuinely and permanently one-way, and the consequence of an inbound compromise is severe. The classic cases are historian replication from OT to a DMZ, telemetry and syslog egress to a SOC or SIEM, one-way file transfer, and protection of safety instrumented systems.

NCSC’s guidance on protocol handling supports the historian pattern directly: industrial protocols should stay in isolated OT segments, with operational data replicated to a DMZ historian through a unidirectional mechanism and no inbound connectivity from IT to OT, with IT querying the DMZ copy instead. NIST gives the Purdue-anchored version — a unidirectional gateway between Levels 2 and 3 can protect Level 0, 1 and 2 devices from an event occurring higher up the stack.

The other strong case is assurance. If you have to demonstrate to a regulator, an insurer or a board that inbound access is impossible rather than merely forbidden, a hardware guarantee is a materially different argument from a rule set and a change-control log.

The limitations diode vendors skip

We sell these, and we would rather you deployed one that works than one that disappoints. Five honest limitations:

• A diode controls direction, not safety. It has no view of content. Malicious or malformed data crosses a correctly functioning diode perfectly well. Directionality is not inspection.
• The parser becomes the target. NCSC is explicit that a diode feeding software parsers on the trusted side is not a cross-domain solution, and expects structural verification in hardware to reduce the risk of parser vulnerabilities. Without that, you have moved the attack surface rather than removed it.
• Patching and support still need a route. A diode cannot carry inbound updates. If that pushes your updates onto USB media, the aggregate risk may end up worse than a well-run firewall. Plan the inbound path before you buy the outbound one.
• No identity, no authorisation. A diode cannot tell you who initiated a transfer or whether they were authenticated. It is not access control.
• Cost and complexity scale per flow. Each data type — historian, files, syslog — needs its own proxy configuration, and a diode is materially more expensive than a firewall port, before integration effort.

The strongest argument against a diode is the one NCSC implies throughout: a correctly configured, monitored, patched firewall with strict egress rules addresses more real risk than a diode bought as a compliance trophy and then left to justify itself.

Data diode vs firewall: how the two work together

Stop framing it as data diode vs firewall and the design gets easier. Work out which flows are truly one-way, then enforce those in hardware and everything else in policy.

The structured way to do that is the zones-and-conduits method in IEC 62443-3-2, which partitions a system into zones and the conduits between them, assigns each a target security level, and derives the requirements from risk. Worth being precise: the standard specifies a risk-assessment process and does not mandate diodes. A diode is simply one way to meet a conduit’s target where that conduit is one-way. It does require separating safety-related assets, which is often where a diode ends up being the cleanest answer.

In practice that produces a next-generation firewall at the IT/OT DMZ handling the bidirectional majority, and a diode on the specific high-consequence egress flows — historian replication, telemetry to the SOC. If you want the deeper treatment of segmentation itself, see our guide to data diodes and IT/OT segmentation and our OT cybersecurity best practices for UK operators.

Frequently asked questions

Can a data diode replace a firewall?

No, and any supplier who says otherwise is overselling. A diode enforces direction on a specific flow; it cannot handle bidirectional traffic, authenticate users, or inspect content. NIST treats a unidirectional gateway as an alternative to a firewall for a given path, not as a site-wide replacement, and describes firewalls as the primary protection mechanism for OT devices.

Is a data diode more secure than a firewall?

Framed as data diode vs firewall, this is the wrong question. For one-way flows, the diode’s guarantee is stronger because it is physical rather than configured and survives misconfiguration. For everything else the question does not apply, because a diode simply cannot carry the traffic. Comparing them overall is comparing a lock to a door policy.

Do data diodes support two-way communication?

Not by design, and you should be wary of workarounds. NCSC describes deploying a diode in each direction with software orchestrating bidirectional flows as an anti-pattern. If your requirement is genuinely two-way, a properly configured next-generation firewall or a full cross-domain solution is the honest answer.

Are data diodes only for defence and nuclear?

No. That is their heritage, but the same argument applies wherever an inbound path would be catastrophic and the outbound flow is fixed — water and energy utilities, manufacturing, transport, and any operator holding safety instrumented systems. NCSC also recommends them for ingesting logs into isolated security monitoring environments, which is a mainstream use.

How does a data diode handle TCP if there is no return path?

Through a proxy pair. The send-side proxy terminates a normal TCP session inside the OT network and pushes the payload one way with forward error correction in place of retransmission; the receive-side proxy reassembles it and serves it over ordinary protocols. Each endpoint sees a normal connection, but there is no genuine end-to-end acknowledgement.

What does a data diode cost in the UK?

It depends on throughput and how many distinct data flows you need to carry, since each flow needs its own proxy configuration. We will not publish a headline figure we cannot stand behind — tell us the flows and the environment and we will quote against the actual requirement, usually within one working day.

The bottom line

The data diode vs firewall debate is mostly a category error. A firewall is how you govern the traffic that has to move in both directions, and it will carry the majority of your boundaries. A diode is how you make an inbound path impossible on the handful of flows where “impossible” is worth paying for — and, as NCSC points out, how you might keep seeing your plant while isolating everything else during an incident.

Indiott supplies and integrates BlackBear data diodes in the UK as the secure layer of a full industrial IoT stack, alongside the sensing and connectivity around it. If you want a straight answer about whether a diode is right for your architecture — including “not yet” — see our OT security solutions or call 023 9223 3611.