Engineering Grade Protection for Data Center OT Systems

Network engineering is part of this new CIE initiative. Network engineering uses engineering-grade protections to prevent cyber attacks from entering data center OT networks in the first place. This is important because data centers are all about uptime and reliability. In the cooler example above, what happens when mechanical fail-safes engage to protect the cooler? Things shut down – the infrastructure that is essential to continuous data center operations is shut down to protect it from damage. It is a good thing that engineering-grade measures prevent threats to worker safety and equipment damage. But if we want our uptime preserved, we need more. We need to prevent cyber attacks from entering OT networks in the first place and triggering these fail-safe shut-downs.

While network engineering includes a number of engineering-grade tools for the prevention of cyber attacks from entering OT networks, the most widely-applicable tool is the unidirectional gateway. The gateways are deployed at consequence boundaries – connections between networks with physical consequences vs. networks with only business consequences. In data centers, the gateways are deployed most commonly at IT/OT interfaces. Unlike software firewalls, hardware-enforced unidirectional gateways provide engineering-grade unidirectionality – OT data is copied to IT networks in real time, with zero risk that cyber attacks (like ransomware) from IT can penetrate through the gateways back into OT networks to put uptime at risk, or to put the physical equipment that is essential to uptime at risk.