Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

MITRE D3FEND™ Learning Center

D3-DNL — Directional Network Link

Enforce one-way network communication by preventing two-way communication.

2ICS inferred
1Parent technique
2Related artifacts
1Source reference

Isolate · D3FEND ontology 1.6.0 · Active

Open official technique ↗
Official D3FEND definition

Definition

Enforce one-way network communication by preventing two-way communication.

Official D3FEND knowledge-base content

How it works

Using a device such as a data diode, or otherwise enforcing unidirectional (one-way) network communication / data transfer, to physically prevent signals from traveling in the reverse direction.

Unidirectional network link enforcement is a security measure used to separate control and safety systems in operational technology (OT) environments. By employing physical data diodes, this approach ensures one-way communication, allowing information from safety systems to be viewed without permitting any modification or interference, thereby protecting the integrity of the safety system.

Bare Metal Cyber interpretation

Implementation perspective

Directional Network Link should be treated as a technical defensive capability rather than a product checkbox. In practice, teams should define the protected scope, the conditions under which the technique acts, and the observable evidence that demonstrates the intended behavior. For this technique, likely engineering context includes Physical Link.

Use the technique to create a logical or physical boundary that limits access, execution, communication, or movement.

Questions to ask

  • What is being isolated, from whom or what, and under which conditions?
  • Which flows or operations remain explicitly allowed across the boundary?
  • What happens when the isolation mechanism fails or loses policy context?
  • How is the boundary tested for alternate paths, bypasses, and unintended dependencies?

Evidence and validation

  • Architecture and data-flow diagrams showing the isolation boundary
  • Policy, rule, or configuration exports from enforcing components
  • Tests of allowed, denied, and failure-state behavior
  • Monitoring evidence for boundary violations and policy changes

Common failure patterns

  • The intended boundary has undocumented alternate paths or inherited trust relationships.
  • Rules accumulate without ownership, review, or removal of obsolete exceptions.
  • Isolation is assumed from network location while application, identity, or management paths remain open.

This implementation perspective is original Bare Metal Cyber educational content. It does not replace the official D3FEND definition or establish that a specific product implements the technique.

Ontology hierarchy

Technique hierarchy

Top-level family

Parent techniques

Direct child techniques

None listed at this level.

D3FEND graph relationships

Artifacts and ontology entities

These relationships describe how D3FEND connects a defensive technique to artifacts or other ontology entities. They describe graph semantics, not a product certification.

Explicit technique relationships

restrictsPhysical Link
usesPhysical Data Diode
Show inferred artifact relationship paths (1)
Directional Network LinkrestrictsPhysical Link
Inferred and experimental

Offensive-technique relationships

These relationships are generated from D3FEND graph paths and are explicitly experimental. They should be treated as hypotheses for defensive analysis—not as proof that the technique prevents, detects, or removes an offensive behavior.

ATT&CK for ICS (2)
T0860Wireless CompromiseInitial Access
T0887Wireless SniffingCollection, Discovery
Source record

Authoritative sources