The words, and what people get wrong about them

Three copies of the data, on two media types, one of them off site. The baseline rule for backup.

Common misconception: That a diode makes the third copy redundant. It moves where the boundary sits; it does not replace the disconnected copy.

Two networks with no connection at all. An absolute guarantee in principle, eroded in practice by media carried between them — and by shared peripherals, a shared display or shared acoustics.

Common misconception: That an air gap is free, and that it survives as long as the network cables are kept apart. It is upheld by manual work that is rarely counted as a cost.

Data diode vs firewall

A mechanism that lets the receiver ask the sender to slow down. Across a data diode it does not exist, so traffic in excess of the link is lost silently.

Common misconception: That TCP's flow control somehow survives. It does not.

What is a data diode?

Rebuilding a file into a known safe format instead of searching it for malicious code. A complement to the diode on incoming flows.

Common misconception: That the diode makes content disarming unnecessary. The diode enforces direction and never sees content.

Data diode vs firewall

Information transfer through a mechanism not intended as a channel, for example through timing or status messages.

Common misconception: That a one-way hardware link rules out covert channels. An automatic status message back is a channel, however narrow.

What is a data diode?

A composite solution that moves information between security domains under control. The diode is a component in one, not the whole of one.

Common misconception: That a diode or a KVM switch is a cross-domain solution. Neither inspects content: the diode enforces direction, a CDS also governs content and the decision.

Data diode vs firewall

Redundancy added to the transmission so the receiver can reconstruct lost parts without a retransmission. It is what replaces the acknowledgement on a one-way link.

Common misconception: That it gives complete protection. It covers a designed loss rate; above that rate the transfer fails anyway.

One-way protocols: UDP, Syslog, NTP and SNMP over a data diode

A message at a fixed interval showing that the link and the sender are alive. It separates "nothing has happened" from "something is broken".

Common misconception: That a heartbeat proves the data arrived. It proves the link exists, not that a transfer was complete.

One-way protocols: UDP, Syslog, NTP and SNMP over a data diode

The more and the less sensitive domain on either side of the boundary. The terms describe sensitivity, not network topology.

Common misconception: That the high side is always the sending side. Direction follows the flow, not the classification.

A copy that cannot be altered or deleted for a set period, regardless of privilege. It is a storage property, not a network property.

Common misconception: That a diode provides immutability. It provides distance; immutability comes from the storage system.

A device that duplicates traffic to a monitoring port without affecting the original traffic. A one-way tap cannot inject traffic back into the link.

Common misconception: That port mirroring in a switch is the same thing. A switch drops mirrored traffic under load, and is itself a configurable device.

The protocol terminates on one side, the payload is carried across separately, and the protocol is recreated on the other side. It is what allows TCP applications to work across a diode.

Common misconception: That the protocol is tunnelled across the diode. It is not — it ends and is recreated.

One-way protocols: UDP, Syslog, NTP and SNMP over a data diode

How much data the organisation accepts losing, measured in time. It determines how often backup has to run.

Common misconception: That RPO is the same as the backup interval. RPO is the requirement; the interval is what was chosen, and they can differ.

How long the organisation accepts being without the system. It has to be calculated on the restore, not on the backup.

Common misconception: That RTO can be estimated without having tried a restore. It cannot.

The decision that a piece of information may leave a higher security domain. A person with a mandate, not a filter rule.

Common misconception: That the decision can be automated without changing its nature. Automated, it becomes a rule — and a rule can be wrong.

Returning data from backup into production. Across a diode installation this is the direction towards the protected domain, and therefore the hard one.

Common misconception: That a restore is backup in reverse. It crosses the domain boundary the wrong way and needs a solution of its own.

Bidirectional data diodes – when a controlled return channel is needed

Moving data between networks by carrying physical media. It is the most common actual connection between networks described as disconnected.

Common misconception: That it is safer than a reviewed one-way link. It is unlogged, unmonitored and depends on one person.

Data diode vs firewall

An intermediate zone where incoming data is validated before it reaches the target system. It sits between two diodes in the pattern for bidirectional flow.

Common misconception: That it is the same as a DMZ. A DMZ is reachable from both sides; a staging zone is not.

Bidirectional data diodes – when a controlled return channel is needed

A list of what was sent — filenames, sizes, hashes, sequence numbers — sent as a transfer of its own. It is the only way to detect that a whole file is missing.

Common misconception: That per-file hashing is enough. A hash proves a file is intact, not that every file was sent.

One-way protocols: UDP, Syslog, NTP and SNMP over a data diode

A storage mode in which data can be written but not altered. The basis for immutable backups and evidence archives.

Common misconception: That WORM also provides confidentiality. It provides integrity; confidentiality is a different control.

Two one-way links in opposite directions inside one unit, for protocols that require acknowledgement.

Common misconception: That it is a diode. It is two, and the risk picture is a different one.

Bidirectional data diodes – when a controlled return channel is needed

Activity covered by the Swedish Protective Security Act (2018:585).

Common misconception: That it always means the information is classified. The activity can be sensitive for other reasons.

Information covered by protective security, in one of the four Swedish security classes.

Common misconception: That “hemlig” is the umbrella term. It is one of four classes, and using it generically excludes three.

Unintended electromagnetic signals that carry information about what the equipment is processing. They arise from physics, not from a connection.

Common misconception: That they only radiate through the air. They also conduct out along mains cables, earth conductors and signal conductors.

What is EMSEC?

A compromising signal that leaves the equipment along a conductor — mains cable, earth conductor or signal conductor.

Common misconception: That distance protects. A receiver on the same electrical circuit never has to come near the room.

What is EMSEC?

The routine that keeps the approved configuration unchanged, and that decides what happens when something has to change.

Common misconception: That it is administration. It is what stops the approval being eroded by individually reasonable component swaps.

M-numbers and FMV – what they mean for a buyer

One conductor inducing a copy of its signal in a neighbouring conductor. A common root cause of leakage in shared cable containment.

Common misconception: That it only happens between signal cables. Power conductors couple too.

TEMPEST and RÖS explained

A hardware construction that physically permits data flow in one direction only. The direction is a property of the hardware, not a setting.

Common misconception: That it inspects content. It guarantees direction and nothing else.

What is a data diode?

The decision that a completed installation meets the requirements for the intended level. It is issued for the installation, not for the products.

Common misconception: That approved equipment automatically yields an approved installation.

M-numbers and FMV – what they mean for a buyer

The Swedish Armed Forces' designation for an approved article in the materiel system. Identity, traceability and orderability — not a test result.

Common misconception: That it is a certificate. It is the customer's decision, not the laboratory's.

M-numbers and FMV – what they mean for a buyer

A filter in the power supply that attenuates conducted emission at the zone boundary. Without it the conducted path is open.

Common misconception: That approved equipment makes the filter unnecessary. The approval covers the unit, not the installation.

What is EMSEC?

Transfer in which no return channel exists at the physical level.

Common misconception: That a firewall rule gives the same guarantee. The rule can be changed; the hardware cannot.

What is a data diode?

The lock class used on the storage hatches of the equipment in this catalogue.

Common misconception: That the lock replaces the storage requirement for the medium itself.

A compromising signal that leaves the equipment through the air.

Common misconception: That a wall is sufficient shielding.

What is EMSEC?

The red side processes classified information in clear; the black side does not. The separation is physical, not logical.

Common misconception: That encryption makes a conductor black. The emission arises on the plaintext, before encryption.

TEMPEST and RÖS explained

The requirement that red and black cabling be kept physically apart to prevent crosstalk between them. It covers all cable routing, including AV and power.

Common misconception: That the separation applies only to network cables. It applies to every conductor, power included.

TEMPEST and RÖS explained

The Swedish approval levels, corresponding to TEMPEST Level A / B / C.

Common misconception: That RÖS and TEMPEST are two different protections. They are two names for the same thing.

SDIP-27 and TEMPEST levels A, B and C

A physical seal showing whether an enclosure or a connection has been opened. It differs from tamper resistance, which tries to prevent the intervention rather than reveal it.

Common misconception: That sealing protects. It detects — and only if someone actually checks the seals against a register.

M-numbers and FMV – what they mean for a buyer

NATO's designations for approval levels under SDIP-27, corresponding to the Swedish RÖS U1 / U2 / U3. The designation is a proper name and is not translated.

Common misconception: That the level follows the classification of the information. It follows the environment.

SDIP-27 and TEMPEST levels A, B and C

A bounded space in which a given emission level applies, and whose boundary defines what may cross it. The boundary is set by how close an adversary can get, not by the floor plan.

Common misconception: That the zone is the same as the room.

SDIP-27 and TEMPEST levels A, B and C

The surface at which a conductor or signal passes from the protected to the unprotected environment. Anything crossing it has to be either light or filtered.

Common misconception: That fiber makes the boundary irrelevant. The mains supply always crosses as copper.

Why galvanic isolation matters

The attenuation of the fiber per kilometre at a given wavelength.

Common misconception: That it is a property of the fiber alone. It applies at a wavelength — the same fiber attenuates about 0.35 dB/km at 1310 nm and about 0.22 dB/km at 1550 nm.

Singlemode vs multimode – which fiber do you need?

Attenuation deliberately inserted to bring received power below the saturation threshold.

Common misconception: That it is a workaround. On links under 100 m it is a designed component.

The difference between the delay in each direction.

Common misconception: That it is zero when the link is working. It arises when a transport network protection-switches one direction.

IEEE C37.94 explained

The device in a synchronous chain whose clock all the others follow.

Common misconception: That it can be implicit. Two ends on internal clock will slip within minutes.

G.703, G.704 and E1 – the telecom interfaces that refuse to die

The variant in which data and the 64 kbit/s timing travel on the same pair.

Common misconception: That it is interchangeable with the contradirectional variant. It is not, and the fault is hard to find.

G.703, G.704 and E1 – the telecom interfaces that refuse to die

Two mated connectors. Counted as one attenuation item, not two.

Common misconception: That you count connectors. You count pairs — and a pass through an ODF is two pairs.

Attenuation that arises when light is coupled from a larger core into a smaller one (62.5/125 into 50/125, about 4.7 dB).

Common misconception: That the fault is symmetrical. The opposite direction costs almost nothing — hence the one-directional fault.

Singlemode vs multimode – which fiber do you need?

An unlit fiber pair, leased or owned, without the operator’s equipment on it.

Common misconception: That it is documented. It is documented by somebody else, under somebody else’s measurement conditions.

Protection at one end trips the breaker at the other through a binary command.

Common misconception: That it is the same as differential protection. Transfer tripping only needs low delay; differential protection also needs symmetry.

Fiber optic teleprotection and trip links

A lost or repeated frame when the sending and receiving clocks drift apart.

Common misconception: That it is a cable fault. Slips arrive at an even interval; cable faults do not.

G.703, G.704 and E1 – the telecom interfaces that refuse to die

A permanent fused joint (about 0.05–0.1 dB) and a mechanical joint (up to 0.4 dB) respectively.

Common misconception: That the splice type is a workmanship detail. The difference is four to eight times the attenuation.

No electrically conducting path between two systems. Achieved with fiber, which neither carries current nor bears an electromagnetic signature.

Common misconception: That it means logical isolation. Two networks joined by a fiber converter are still joined — it removes one path, not every path.

Why galvanic isolation matters

The attenuation a component adds to the optical path.

Common misconception: That a passive component is free. A 1x8 switch costs up to 1.5 dB per unit.

An optical switch that keeps the selected path without supply voltage.

Common misconception: That every optical switch does. The catalogue states it for one model.

Compares current at both ends of the line and trips on the difference.

Common misconception: That the channel only has to be fast. Above all it has to be symmetrical.

IEEE C37.94 explained

The frame where fiber is terminated and cross-connected.

Common misconception: That it is passive and therefore free. Every pass through costs two connector pairs.

The difference in dB between the transmitter's output power and the receiver's sensitivity. It states how much attenuation the link can tolerate in total.

Common misconception: That it is the same as range. The budget is in dB; the range depends on fiber type, wavelength, splices and connectors.

Singlemode vs multimode – which fiber do you need?

The relay's method of estimating one-way delay as half the round-trip time.

Common misconception: That it measures the delay. It assumes symmetry — the asymmetry never shows up as such, it becomes a phase error.

IEEE C37.94 explained

Bit errors caused by received power that is too high, typically on links that are too short.

Common misconception: That bit errors always mean too little light. Too much light gives identical symptoms.

Frequency transfer at Ethernet's physical layer, ITU-T G.8261/62/64.

Common misconception: That it is enough for the ends to support it. Every network element in the path has to.

G.703, G.704 and E1 – the telecom interfaces that refuse to die

The part of the budget deliberately left unused for ageing, repair splices and future cross-connects.

Common misconception: That it is headroom to build cross-connects into. It is set aside so the link still works in five years.

Singlemode vs multimode – which fiber do you need?

Transfer of protection information between substations, typically trip commands.

Common misconception: That it is data communication with tight timing requirements. It is protection engineering with two opposing failure modes.

Fiber optic teleprotection and trip links

A channel carrying audio backwards from display to source in HDMI 1.4 and later.

Common misconception: That audio always travels the same way as the picture.

A single-wire, addressed two-way control bus in the HDMI cable, intended for remote control between AV devices.

Common misconception: That CEC only controls volume and power. The bus carries vendor-specific messages.

A device that connects one shared set of video conference peripherals to one of several separate codecs, one per network.

Common misconception: That it is a video matrix. It is a domain boundary.

The two-way I²C bus in the HDMI and DVI cable that carries EDID and the HDCP key exchange.

Common misconception: That HDMI is one-way. DDC runs in both directions.

A room used at more than one security level at different times, with a documented physical changeover in between.

Common misconception: That the changeover can be a setting in a control system.

SDIP-27 and TEMPEST levels A, B and C

A data structure in a display describing its resolutions and capabilities, which the source reads on connection. It usually sits in writable memory.

Common misconception: That EDID is just information about the screen. It is a shared, potentially writable object.

An intermediate device presenting its own constant EDID to the source instead of forwarding the display’s.

Common misconception: That it is a compatibility feature. It is first of all a separation feature.

The state a device assumes without user action, and which should be the safe one.

Common misconception: That a safe default is enough. It also needs a visible indication when the device has left it.

A technology carrying picture, sound, Ethernet, USB and control in one link. Several of the sub-channels are two-way by design.

Common misconception: That HDBaseT is "HDMI over longer distances". It is five services, not one.

A device that passes picture and sound in one direction and physically disconnects DDC pass-through, CEC, ARC and HEC. The equivalent of a data diode, in the AV cable.

Common misconception: That it is just an HDMI splitter or an isolator.

What is a data diode?

HDMI Ethernet Channel — 100 Mbit Ethernet inside the HDMI cable.

Common misconception: That an HDMI cable cannot carry network traffic.

The USB device class for keyboards, mice and similar input devices. The only class normally permitted across a domain boundary.

Common misconception: That a device which looks like a keyboard belongs to the HID class. Composite devices can change class after enumeration.

Today's threat level

A device that moves keyboard, monitor and mouse away from the computer over a link. It separates spaces, not domains.

Common misconception: That the extender is itself a security boundary.

A device that lets one keyboard, monitor and mouse control several computers. A secure KVM switch additionally ensures the computers cannot reach one another through the shared peripherals.

Common misconception: That every KVM switch separates. An ordinary office KVM shares EDID, USB state and sometimes memory between the hosts.

A device's control signals travelling on a path separate from the data flows the device handles.

Common misconception: That a control panel on the network is out of band. It is in band for the network it sits on.

A device that lets several hosts share keyboard, monitor and pointing device. The international name for the product class a secure KVM switch belongs to.

Common misconception: That the category covers only KVM switches. It also covers docks, hubs and AV switchers.

A design in which a port is physically disconnected until a user actively connects it, and reverts on its own.

Common misconception: That a disabled port is disconnected. Disabled in software is still connected.

The shared display, projection screen or touch screen in a room. It is common to everyone who uses the room, including over time.

Common misconception: That it is an output device. It is a shared node.

A KVM switch built so that every data path between the domains is physically excluded, not merely disabled in software.

Common misconception: That "secure" is a marketing word. It corresponds to a defined set of requirements.

TEMPEST and RÖS explained

That a loudspeaker or an earphone can work as a microphone, because the same physical principle applies in both directions.

Common misconception: That an earphone can only play sound.

What is EMSEC?

Video teleconference. In a security context it means a system in which camera, microphone and codec are deliberately separated and can be switched off.

Common misconception: That VTC is the same as a cloud meeting tool.