Strengthening data centre security amid rising cyber threats

The designation of specific data centres as Critical National Infrastructure (CNI) by the UK government marks a dramatic change in recognising their function in preserving the country's vital services. Because data centres are essential to sectors like healthcare, finance and telecommunications, they are more vulnerable to cyberattacks. Although this action improves security for certain facilities, it also poses issues for the sector as a whole. The consequences of the CNI designation and the reasons why all data centres should take steps to strengthen their security are examined here by Martin Wegrostek, cyber security portfolio manager at managed IT services firm OryxAlign.

An environment of growing threats

The National Cyber Security Centre (NCSC) reports that hostile cyber activity increased by 16 per cent in the UK in 2024 as compared to the year before. The government has strengthened the defences of vital sectors in response to this growing threat. Because of the CNI classification, certain data centres are now given priority assistance from organisations like the NCSC and have improved coordination with emergency services in the event of a cyberattack.

But the designation also brings with it new challenges. As a precaution, the government does not reveal which data centres are CNI-designated. With this, attackers are more likely to target numerous data centres indiscriminately in the hopes of hitting a critical one, even if this helps shield truly critical facilities from targeted attacks. This increases the danger for all data centres, regardless of their designation.

IT and operational weaknesses

Data centres should change their approach to security in light of the ever changing cyber threat landscape. Traditionally, operational technology (OT) systems, such as building management and power control systems, have not been as well-protected as IT environments. 

Attackers are, nevertheless, increasingly using these systems as points of entry to breach larger infrastructure. Because they frequently lack strong encryption or current firmware, devices including cooling units, access control systems and security cameras are prime targets.

A comprehensive security audit is an essential first step for data centres. This procedure aids in compiling a thorough inventory of every endpoint in both IT and OT environments, including any previously unnoticed legacy equipment. A solid basis for implementing efficient security measures is provided by knowing the extent of linked systems and their possible weaknesses.

Following the creation of an inventory, tools such as Endpoint Detection and Response (EDR) can be used to monitor for indications of malicious behaviour on servers and workstations, among other important endpoints. Rapid threat containment is made possible by EDR systems, which stop threats from propagating throughout the network. 

By integrating threat detection across endpoints, networks and servers, Extended Detection and Response (XDR) expands on this, providing a comprehensive perspective of vulnerabilities and facilitating more thorough defence.

Data centres must simultaneously handle the human element in cybersecurity by regularly teaching employees on phishing awareness. This lowers the possibility of breaches brought on by user mistake by giving staff members the skills they need to recognise and react to phishing efforts and social engineering techniques. 

By isolating distinct areas of the network, network segmentation can further improve security by restricting the ability of attackers to migrate laterally in the event of an initial breach. Maintaining the most recent security patches on all systems, including OT devices, requires regular patch management.

Fulfilling client and regulatory requirements

The government's action has important regulatory ramifications for data centres that have been designated as CNI. Stricter requirements, such as mandatory incident reporting, improved security procedures and frequent audits to verify compliance, are now required of facilities. Financial penalties, the loss of important clients and harm to one's reputation could arise from noncompliance.

But what about those outside the CNI designation? Since customers in every industry are growing more concerned about security, it is critical that data centres implement comparable standards. By showcasing strong security procedures, even non-CNI data centres can set themselves apart and potentially earn new business.

One of the main reasons data centres implement CNI-level security measures is to protect customer trust. Before working with a supplier, government agencies such as the NHS want strict proof of compliance. Adhering to strict security guidelines not only draws in important customers, but it also enhances reputation and trust in a competitive sector. Because of this, proactive compliance investment is important for long-term performance.

An appeal for collaboration and funding

The designation by the government emphasises the necessity of increased public-private sector cooperation. Policies such as tax exemptions or incentives may help data centres comply with stricter security regulations. Setting security investment as a top priority goes beyond compliance; it is a calculated move to increase resilience and win over customers in a market that is becoming more and more competitive.

Furthermore, OryxAlign and other service providers are essential to this ecosystem. They help data centres achieve a greater level of security by carrying out audits, locating vulnerabilities and putting customised solutions in place.

Getting ready for the future

Data centre operators should thoroughly evaluate their current security posture in light of these changes. It is crucial to identify the gaps and develop a clear plan to close them. Whether a data centre is already well-established or working to fulfil the higher standards of a critical security designation, proactive planning will position it for long-term success.

The government's action serves as a reminder that no facility is impervious as the danger landscape changes. Although the CNI designation may target particular facilities, it serves as a warning to the industry as a whole. Data centres can protect their customers, preserve their reputations and strengthen the resilience of the UK's digital infrastructure by putting security first.