One company’s data center is a bank vault, a warehouse and a switchboard in one building. The security firm Check Point says a data center houses shared infrastructure for corporate applications and data, built from three kinds of parts: compute, storage and networking.
Most now run a hybrid model. Companies moved a growing share of their systems to public or private clouds for agility, efficiency, flexibility and possible savings. Many kept on-premises hardware as well, because it gives them more control over, and visibility into, where their data sits.
Two kinds of threat
Check Point divides the threats into two groups: attacks on the underlying infrastructure, and cyberattacks on the applications and data hosted there. Redundancy for crucial functions removes single points of failure and keeps attackers from easily knocking out hosted applications. Backup power supplies, fire suppression, climate control and building security cover natural events and physical attacks.
Applications are the softer target. Check Point lists several routes in:
- web and application attacks, including those on the OWASP Top 10 and CWE Top 25 lists;
- DDoS attacks, which cut availability and cost revenue, customers and reputation;
- DNS attacks such as DNS DDoS and cache poisoning;
- stolen credentials, taken through breaches, credential stuffing or phishing.
Where the weak points are
Code is one. Applications in a data center can contain flaws, whether written in-house or imported through third-party libraries.
Remote access is another. When remote work spread after the pandemic, companies rolled out remote desktop protocol and VPN tools. Criminals went after those new entry points with compromised credentials and unpatched bugs, then planted malware on corporate systems.
Third-party software adds a further dependency. The data center is only as secure as the vendors whose tools run inside it.
What Check Point recommends
The firm says data centers should follow a zero trust model, giving each user and system only the access the business needs. Its list of priorities includes patching systems, using an intrusion prevention system to patch virtually when no fix exists yet, and segmenting the network to stop attackers moving sideways between machines. It also calls for secure development pipelines, web application and API protection, DDoS defenses, multi-factor authentication to block credential theft, and encryption for data at rest, in use and in transit.
