Public sector

Evidence and forensic chain

Transaction logs and per-transfer hash verification are what make the chain documentable.

Area
Data diodes
Architecture patterns
1
Products used
2

The problem

What makes it hard

Collected material has to enter an evidence archive that cannot be altered from behind, and the analysis environment must not be able to reach back to the collection.

Here the diode is as much an integrity argument as a confidentiality argument — you can show that the material cannot have been altered after it passed, because no path back exists. Complementary timestamping has to be bought separately.

How it is built

Log export and evidence retention

Syslog passes natively without middleware, and the chain of custody gets stronger as a side effect.

See the full pattern
Logs leave the monitored network. A compromised SOC is not a way back in.Monitored networkSOCSystem logsSyslog collectorSIEMEvidence archive, WORMdiode, syslogpasses nativelylogs cannot bedeleted from behind
Logs leave the monitored network. A compromised SOC is not a way back in.Monitored networkSOCSystem logsSyslog collectorSIEMEvidence archive,WORMdiode, syslog passesnativelylogs cannot bedeleted frombehind
  • One-way path
  • Data path
  • Path that does not exist
Logs leave the monitored network. A compromised SOC is not a way back in.

In the catalogue

Equipment from the catalogue

Built from: Data Diode Secure 1 Gbit SM 60-00-8362 and Data Diode Middleware (DDMW) 60-00-7367.

Standard

Data Diode Secure 1 Gbit SM

Data rate
1 Gbps
Wavelength
Singlemode 1310 nm
Input, LC
1000 BaseLX

Product no 60-00-8362

Standard

Data Diode Middleware (DDMW)

Software solution for transferring data over data diodes in such a controlled manner. It consists of a sender…

Product no 60-00-7367

Reading and references

Explained in

Named customer references are not published. What we can show is the solution area this environment belongs to, and the reasoning behind the design.

Sector

Environments

Environments with the same problem

The technology is the same; the buying process usually is not.

Hands soldering a circuit board under a work lamp

Next step

Describe your environment

If yours is close to this one but not the same, that difference is usually where the design decisions are. Tell us what it looks like.

Verified credentials

All certifications