Training
Data diodes and one-way transfer
From mapping the flows to running the installation. The track answers the question customers ask most often: how a backup environment is built so that nothing can come back.
The sessions
Map the flows before ordering hardware
Who it is for: Network architect, security officer.
After the session you will be able to:
- List every flow that has to cross the domain boundary, and for each one determine direction, protocol, peak volume and the consequence of loss
- Produce a flow inventory for your own environment and decide from it whether a one-way diode is enough, whether middleware is required, or whether two directions are needed — before a tender is requested
Content and exercise: The flow inventory as a method. The four questions per flow. Why volume is measured at peak and not on average. Which flows pass natively and which require middleware. Walk-through of a real, anonymised flow list.
Backup over a diode: designing the flow and the restore
Who it is for: IT operations, security officer. This is the session that answers the backup question directly.
After the session you will be able to:
- Design a backup flow across a one-way link and make a deliberate decision about the restore path
- Work out whether your backup volume fits your backup window across a 1 Gbit link, and justify the choice of restore path to your management
Content and exercise: The backup pattern in full. The sizing calculation with 1 Gbit as the ceiling. 3-2-1 in a diode environment, and where the diode ends and the storage system begins. The four restore paths with their costs. What is not protected.
Sizing and failure modes in one-way links
Who it is for: Network architect, operations engineer.
After the session you will be able to:
- Understand what happens when a one-way link saturates, and design the flow so that it is noticed
- Specify which measurements have to be monitored for loss to be detected, and formulate the performance questions to put to a supplier
Content and exercise: The absence of back-pressure and its consequences per flow type. Alarms against telemetry and why they should not share sizing. Manifests, counter comparison and heartbeats. What forward error correction does and where it stops being enough.
Writing and reviewing a requirement on one-way transfer
Who it is for: Buyer, requirement author, security protection manager.
After the session you will be able to:
- Write requirements that exclude equipment lacking the physical property, and review an incoming tender against them
- Write a requirement that an unapproved product cannot qualify against on paper, and identify the three most common gaps in your own draft
Content and exercise: The requirement clauses with the reasoning behind each. The difference between requiring a function and requiring an approval. Which evidence to demand with the tender. Sealing as a checkable requirement. Participants bring a draft, which is reviewed in the session.
Running a diode estate: monitoring, seals, replacement
Who it is for: Operations engineer, security officer.
After the session you will be able to:
- Run an installed diode environment over time without eroding the assurance
- Write the operating instruction for your diode environment, including the checking routine, alarm handling and the decision path that applies when someone asks for a flow in the opposite direction
Content and exercise: Monitoring by SNMP trap and why polling does not work. Seal checking as a routine. Replacing a unit in a sealed environment. Test restores as a scheduled activity. How a request for a return path is handled as a decision rather than as operations.
Before the session
Background reading and equipment
Training
Four tracks, seventeen sessions, built from real installations.
Next step
A track that is not here?
These four grew out of the questions we are asked most. If your question is a different one, it is probably worth a session of its own — tell us what it is.