Claroty Research Finds 18% of Data Center Infrastructure Assets Vulnerable to Attack

Vulnerability of Data Center Infrastructure

New research from Claroty reveals that approximately 18% of cyber-physical systems (CPS) in data centers are just one network connection away from internet-exposed systems. This proximity creates a potential access vector for attackers to reach critical operational technology (OT) and infrastructure assets.

Scope of the Analysis

Claroty's analysis covered more than 750,000 data center assets, including 191,000 OT assets and 174,000 infrastructure assets. These infrastructure assets encompass systems such as HVAC, power monitoring and distribution, fire management, and UPS systems. While less than 0.4% of infrastructure assets are directly internet-exposed, 18% are a single 'hop' away from such systems.

Potential Attack Paths and Consequences

Attack paths could exploit weaknesses like insecure communication protocols, known exploited vulnerabilities (KEVs), unmanaged remote access, flat network architectures, weak authentication, and misconfigured asset communications. Successful attacks on these CPS could lead to disruptions in cooling operations, power distribution, environmental controls, and backup generation systems, degrading overall operational resilience.

Specific System Vulnerabilities

The research found that 41% of power distribution units and 32% of HVAC systems are one hop away from a risky internet connection. Building management systems were also identified as vulnerable, with 88% communicating over insecure protocols and 40% using outdated firmware. Additionally, 11,000 OT control systems, including SCADA and PLC devices, had known exploited flaws.

Recommendations for Strengthening Security

Claroty's report suggests practical steps to enhance data center operational resilience. These include adopting continuous exposure management, implementing zero trust network segmentation, hardening building management systems, and deploying protocol-aware threat detection.