Modern digital society rests largely on the cybersecurity of data centers, where the weakest link is still the human being

Modern data centers are the pillars of our digital-loving society. Everything on the internet has to physically exist somewhere, and data centers, as parts of critical infrastructure, provide a secure and controlled environment for storing and managing information. Although data centers, as infrastructure service providers, do not directly protect customers' data against all cyber threats (because they do not control customers' data traffic), they undoubtedly have a duty to protect themselves. The infrastructure, IT systems and staff of data centers are frequent targets of cyberattacks.

Hannes Aavaste

It all starts with physical security

First, data centers must emphasise physical security to protect IT equipment from unauthorised access and physical threats. All the cybersecurity in the world does not help if a villain can walk up to the IT equipment and gain direct access to the systems. 3-metre security fences, automatic road barriers, PTZ cameras with motion and heat sensors, biometric authentication and automatic video analysis are only a few examples of the security measures applied. You can read more about physical security in one of our earlier blog articles.

But what about cybersecurity?

Given the ever-increasing dependence on interconnected systems, data centers must protect their internal network with particular care, says Hannes Aavaste, head of information security at the Baltics' largest data center. "One example of such measures is separating critical infrastructure components, such as the power and cooling systems, from the public internet. By isolating these systems, data centers significantly reduce the risk of high-impact cyberattacks," he explains.

Although these critical infrastructure components may not directly store or process customer data, they are essential for the proper functioning of the data center facility. "Switching off the cooling system, for example, can cause the servers to overheat, which in turn can cause interruptions to the services those servers provide. That in turn may prevent a consumer from accessing their favourite app or making a bank transfer, for instance," Aavaste adds.

In addition to these measures, data centers apply the following to protect their infrastructure:

• firewalls (a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block particular traffic);
• data diodes (a one-way network communication device that allows data to be transferred securely and unidirectionally between networks);
• intrusion detection systems (monitor network traffic for suspicious activity and signal a threat);
• data collection and analysis systems (security information and event management technology that supports threat detection and response through continuous collection and analysis of information);
• virtual private networks (a service that creates a secure and private connection).

Regular security analyses are also carried out to identify network vulnerabilities, so that possible risks can be prevented or quickly addressed and eliminated.

Protection through encryption

Encryption techniques protect modern data centers against the interception or unauthorised disclosure of sensitive data. Encrypting data at rest ensures that data recorded on physical storage media (such as hard disks and backup tapes) remains protected even if it falls into the wrong hands. For example, if an unwanted person breaks into the data center office and steals a hard disk containing sensitive information, encryption ensures the stolen data remains unreadable without the correct decryption key.

This kind of encryption protects not only against physical theft or unauthorised access but also saves the day in other threats, such as losing a storage medium or a failed deletion. Encryption adds a further layer of security to the data center's infrastructure, ensuring the confidentiality and integrity of the sensitive data stored.

Encrypting data in transit protects information as it moves across networks, preventing eavesdropping and interference. For example, to enable a home office a secure connection has to be created between the employee's home and the data center. Without a VPN, the exchange of information would take place over the public internet, where surveillance is considerably easier.

Detecting anomalies

Imagine that one day a network traffic analysis tool detects an unusually large volume of outgoing data traffic in the data center's IT equipment. That strange activity triggers an alert and the incident is investigated immediately. Further analysis reveals that a server fell victim to a malware attack. The malware penetrated the primary defences and gained access to the server and sensitive data.

The attack is then analysed to determine its scope and possible impact. That identifies the malware and its point of entry. In parallel, the compromised server is isolated, its communication with other systems is cut and further exfiltration of data is prevented. That helps minimise possible damage and stops the malware spreading to other parts of the data center infrastructure.

Continuous monitoring of the data center infrastructure is vital for detecting and quickly responding to such (and other) incidents. "Attack detection, security information and event management, and network traffic analysis systems make intrusions visible in real time. Trained people monitor the alerts, investigate the background of the alarms and respond as needed," Aavaste specifies. Naturally data centers also have their own response plans for different incidents.

Human error poses the greatest threat

Human error remains the greatest security problem in data centers (as in all other organisations). According to the World Economic Forum, 95% of cybersecurity incidents stem from human mistakes. "Imagine an employee who falls victim to a targeted attack. The target receives an email seemingly from the IT department asking the employee to update their account passwords for security reasons. Suspecting nothing, the employee clicks the link in the email and unwittingly gives the attacker their login details. Now the attacker has access to internal systems," the head of information security gives an example.

"Employees must regularly undergo cybersecurity training to understand the importance of information security, recognise social engineering attacks and follow best practices. Clear policies and procedures, including access control, password management and incident reporting, must be equally known to everyone," Aavaste offers a solution. Regular audits help assess the effectiveness of security awareness programmes and identify shortcomings.

Certificates show commitment

Data centers are subject to various compliance requirements and regulations, such as the General Data Protection Regulation (GDPR), the Network and Information Security 2 Directive (NIS2) and industry-specific standards such as EN 50600, ISO 27001 and so on. Data centers should strive equally for compliance and certification. Compliance ensures general adherence to the standard requirements, while certification adds credibility and confidence that the commitments made are actually fulfilled.

Keeping up with regulations and standards and applying for certificates shows a commitment to security. In some heavily regulated markets, such as Germany, a certificate from recognised auditors (such as EN 50600) is in fact the only way to obtain the right to serve a particular sector (banking, public sector and so on).

In conclusion, it is fair to admit that in today's digital and interconnected landscape data centers constantly face security threats. Protecting the confidentiality, integrity and availability of data requires an integrated approach encompassing physical security, network security, encryption, monitoring, incident response, employee awareness and compliance with international standards.

Comprehensive cyber defence in data centers mitigates risks, ensures the security and reliability of customers' equipment and grows the trust of customers and stakeholders.