In today’s digital economy, data centres serve as the central nervous system of computing operations while simultaneously being huge energy consumers. As they increasingly adopt microgrids powered by renewable energy sources, this risks increasing their attack surface. Rafael Narezzi, CEO of Centrii, addresses the emerging cybersecurity challenges.
Data centres capacity is undergoing unprecedented growth, driven by the demands of cloud services, AI and other power-hungry applications.
The UK alone hosts over 500 data centres, one of the highest concentrations in the world, with nearly 100 new projects in the pipeline. While cloud service providers like Amazon Web Services, Microsoft Azure and Google Cloud are investing billions of dollars in building new data centres across the US.
This new generation of bigger, better data centres are more power-hungry than ever. But they are only as resilient as the power feeding them.
The sheer scale of expansion will significantly increase the risks to operational technology (OT) systems powering them, including generators, switchgear and energy management systems.
A single compromise could shut down onsite generation instantly, interrupting operations and resulting in a breach of service level agreements and compliance obligations. But downtime and disruption to services from an attack are the tip of the iceberg. Factor in financial and reputational loss, together with the insurance implications and the consequences go very deep indeed.
Powering rapid data centre growth
As data centres transform from simple IT facilities into some of the biggest energy consumers, the question is where all of this power will come from.
Development decisions for new data centres increasingly revolve around renewable availability, prioritising sites where clean energy is already part of the grid mix or where they can easily add new solar and wind capacity. Some are developing on-site microgrids that pull on the combined power of renewable energy resources, such as wind and solar power and battery energy storage (BESS) to create partially self-sufficient campuses.
By becoming ‘prosumers’ – both energy producers and energy consumers – operators can accelerate their timelines and bring capacity online faster, directly connecting power generation to data centres. Analysis by the Centre for Net Zero suggests that renewable microgrids could meet around 80% of a large data centre’s constant annual electricity need.
This shift toward decentralised energy production and consumption promises greater flexibility and a cleaner, cheaper alternative to traditional grid connections. But as systems become more distributed – and in turn more interconnected – the risk of cyberattacks grows.
Integration of IT and OT
As renewable energy sources become more deeply integrated into critical infrastructure, including data centres, growing reliance on digital control technologies may unintentionally increase the vulnerability of the very systems they underpin.
Data centres have traditionally focused their cybersecurity efforts on IT systems servers, networks, applications and user access. But as these facilities begin integrating renewable energy assets like solar panels, BESS and smart inverters, they are also inheriting a set of OT risks that are often less well understood.
Renewable energy systems are controlled through a range of OT protocols, including SCADA systems, PLCs and vendor-managed software platforms. These were never designed with modern cyber threats in mind. Many rely on outdated firmware, default passwords or unsecured remote access channels. Once integrated into a high-availability environment like a data centre, they become prime targets for attackers.
Further down the supply chain, the risks are often underestimated.
Turbines, solar inverters and battery components may come from international suppliers, sometimes involving firmware developed overseas. Without strong third-party risk assessments and firmware validation policies, operators unknowingly expose their infrastructure to embedded vulnerabilities.
Attackers gaining a foothold through a single vulnerable device can move laterally and take control of entire critical systems.
Visibility a major challenge
There is also the complexity of monitoring and defending hybrid IT and OT environments. Traditional security tools like firewalls and antivirus do little to detect anomalies in operational networks. Specialised tools for OT visibility are essential, but often not deployed in digital infrastructure environments.
Visibility in this type of environment is not optional but integral. Without continuous, validated visibility into operational states, data centre operators are managing blind.
Data centre expansion combined with the development of renewable energy sources like microgrids is reshaping the digital landscape. For those building the next generation of data centres powered by renewables, this brings a new set of risks and responsibilities – and a new approach to cybersecurity.
- Cybersecurity