Data center strategy to protect against cyber attacks given the trend of their growth

Traditional threats to the security of data centers, related to infrastructure, construction and operation errors, will continue to lead in the near future, but now we must pay attention to the risks of cyber attacks. The list of attack vectors can be reduced to three basic directions: on power supply, cooling, communication systems. Even if the air-conditioning and power management systems do not have a connection to the global network and / or to corporate systems, the human factor remains. Employees can bring malicious software to a USB flash drive or connect network management system to the engineering systems of the data center to the global network via 3G / 4G modems.

The main problem is the lack of a comprehensive strategy of enterprises in the field of security. The financial sector has long realized the importance of countering cyber threats, but other sectors in this respect are lagging behind. Often it is not obvious to decision makers how to protect automation systems of engineering systems. They simply do not know that on some objects the automation reaches such a level that a attack on such systems can disable the DC for hours or even days. Financial and reputational losses in this case will be enormous.

What to expect?

As the cloud services evolve, the vector of threats will shift towards cybercrime. In general, this will concern cyber espionage attempts, theft of personal data, fraud, blackmail. But given the growing competition and complex geopolitical situation, we do not exclude attacks of the class terrorism and / or sabotage, the purpose of which will be temporary disabling the DC as a whole. Such attacks can be carried out by affecting the engineering systems of data centers.

DCs vary widely in terms of business model, size and level of criticality in terms of law. Therefore, recommendations for the use of outsourcing for security can only be general. It is always better to combine efforts. To maintain a team of high-level specialists in most cases is unprofitable.

For most projects to create security systems it is better to involve external experts, but in the process of implementing such a project it is necessary to prepare your own specialists or to involve them in monitoring. Also, external a security auditors should be involved on a regular basis. In addition, it is advisable to analyze the actions of competitors or market leaders, constantly upgrade the set of security measures.