Is Your Data Center Uninterruptible Power Supply Exposed

Learn why a facility’s cybersecurity measures must include and go beyond the data center’s uninterruptible power supply.

Data centers include various equipment to keep those facilities running smoothly, even during challenging circumstances. The uninterruptible power supply (UPS) is an excellent example. A data center’s uninterruptible power supply works with a generator. However, it’s a battery backup that independently supplies enough power to keep the data center functioning until the generator activates. Some UPS options provide up to a half-hour of power.

Although a UPS increases a data center’s reliability, it’s not risk-free. That’s particularly true if data center managers don’t stay on top of UPS cybersecurity and maintenance.

Federal Organizations Warn of Cyber Risks

In March 2022, the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Energy issued an alert warning that threat actors could access a data center uninterruptible power supply. The agencies clarified that such attacks often happen when people do not change the default credentials on a UPS. They also recommended that people take UPS management portals offline, preventing internet criminals from accessing them.

People may initially overlook UPS cybersecurity because internet connectivity is not the equipment’s main selling point. Purchasers primarily want products that will keep their data centers running during power outages. They may not prioritize internet connectivity features, such as accompanying apps.

However, if a UPS connects to the internet, it’s a potential target. Following best practices for good cyber hygiene reduces the associated risks.

Researchers Find Data Center Uninterruptible Power Supply Risks

Cybersecurity researchers from Armis backed up the federal organizations’ warning with their independent study. They found three zero-day vulnerabilities in UPS products made by APC. That company is one of the leading providers of UPS equipment, with more than 20 million units sold worldwide.

Barak Hadad, who leads research initiatives at Armis, said it was not until recently that people viewed UPS devices as potentially vulnerable to attack. However, he noted that these are often remotely managed without the necessary cyberattack preventive measures in place. Relatedly, people often lack the necessary data center uninterruptible power supply visibility. That issue raises the chances of an attack happening before people can notice and stop it.

The study showed hackers could overtake systems and bring them offline without physically interacting with a targeted UPS. This research is a strong reminder that people must include vendor vetting in their cybersecurity actions. Today’s data centers need numerous third-party products in the environment.

However, manufacturers and service providers with data center brands as clients can suffer cyberattacks at their companies. A related issue is that some products reach the market with security as an afterthought rather than a priority. Keeping cybersecurity at the forefront when deciding what kind of UPS products to buy or which vendors to select will help keep data centers safer.

After researchers alerted the company to these three vulnerabilities, the manufacturer worked with the cybersecurity team to develop patches. Luckily, that happened in time – there were no known instances of cybercriminals exploiting these weaknesses.

Better Cybersecurity Could Improve Quality of Life for Employees

Cyberattack first responders have increasingly tough jobs. Many need more resources as attack volumes rise. These problems affect, but are not limited to, data centers. An October 2022 global survey from IBM shed light on difficulties affecting those tasked with responding to cyber incidents.

For example, 81% said the increase in ransomware had made their roles more psychologically demanding. Moreover, 67% experienced daily stress. Some also reported insomnia, burnout, and relationship impacts. These professionals must multitask, with 68% reporting they commonly respond to at least two incidents at once.

A facility’s cybersecurity measures must include and go beyond the data center uninterruptible power supply. Following best practices and staying aware of risks should reduce the chances of security incidents. If those decreased events reduce stress for cybersecurity practitioners, they’ll have more job satisfaction. That benefit could reduce data center turnover, which is vital when cybersecurity professionals are already in short supply and high demand.

Poor UPS Cybersecurity Not the Only Risk

Preventing UPS exposure due to insufficient cybersecurity is a great start, but people must also assess other weaknesses that could subject a UPS to increased threats. The lack of a comprehensive maintenance strategy is one example. Proper upkeep increases life span and ensures optimal performance. However, maintenance shortcomings make system failures more likely and raise the operational costs of a UPS.

Experts recommend specific types of UPS maintenance to occur monthly, quarterly, biannually, and yearly. Carrying out those tasks is an excellent way to spot potential problems before they become catastrophes. However, even thorough maintenance measures don’t always prevent problems.

Consider a 2021 incident at a French cloud provider’s data center. Firefighters arrived to find the UPS equipment ablaze, although maintenance had occurred the previous day. A news site later reported that wooden floors and outside air circulation may have furthered the fire’s spread.

Overall, the blaze destroyed the facility where it broke out, along with four halls of a neighboring data center. This example highlights the need to perform risk assessments before and after a data center’s construction. Mitigation measures can curb identified threats.

How Will You Protect the Data Center Uninterruptible Power Supply?

A UPS is essential for keeping a data center operational. The equipment’s critical nature, and the risks explored here, emphasize why people must remain observant and action-oriented to minimize threats.