The digital revolution has transformed the business landscape, with data becoming the new gold. The crux of this transformation lies in data centres, which are the backbone of the digital world. However, alongside the increasing reliance on data centres, the concern for data security has surged. JSA Media Consultant João Marques Lima offers a closer look in this feature article.

The global average cost of a data breach in 2023 was US$4.45 million, a 15% increase over three years, according to IBM. Aside from avoiding these obvious and painful costs, data centre security is a must for preserving customer trust and guarding trade secrets, business plans, or other confidential information that provides a competitive advantage.

In the European Union (EU), stringent data protection regulations necessitate a comprehensive approach to data centre security.

Data centre security refers to the practices, policies, and technologies employed to safeguard a data centre from potential threats.

It encompasses the protection of data centre resources, including computing power, data storage, and networking components, from both physical and virtual threats.

At its core, data centre security aims at shielding valuable information, such as intellectual property, sensitive customer data, and financial records, from unauthorized access, data breaches, and other cyber threats.

As data centres act as the nerve centres of businesses, supporting critical operations and storing large volumes of sensitive data, any disruption in their operations can lead to severe financial losses and reputational damage. Consequently, maintaining high data centre security standards is not just desirable but essential.

Developers play a critical role in data centre security because modern development and DevOps teams essentially hold the keys to cloud security. In the cloud, developers and engineers set and change important security configurations while building and running critical applications on cloud infrastructure.

From coding errors to exposed secrets to configuration mishaps, everything in the cloud is software-driven, and the changing nature of data centre infrastructure puts the responsibility for security increasingly on the shoulders of those involved with software development.

Threat Landscape

European data centres face a myriad of threats that can compromise their security and disrupt their operations. Understanding these threats is the first step towards building robust data centre security.

Some of the threats faced by operators include:

Direct Infrastructure Attacks – Data centres comprise complex infrastructure, including computing, storage, and networking components. Attacks targeting this infrastructure can impact the data centre’s availability, performance, and security.

Cyberattacks Against Hosted Services – Data centres host a plethora of internal and customer-facing applications that can be targeted by cybercriminals. These attacks can take various forms like:

• Web and application attacks: These attacks exploit vulnerabilities in web applications.
• Distributed Denial of Service (DDoS) attacks: These attacks target service availability, leading to revenue loss and customer frustration.
• Credential compromise: Breached credentials can be used to gain unauthorized access to the data centre, compromising sensitive information.

Pillars of Security

Data centre security standards – the pillars of security – provide guidelines and protocols for how data centres operate and protect user data.

These standards can vary based on the specific industry requirements or regional regulations, but a few widely-accepted standards form the backbone of data centre security in Europe and globally.

These include:

ISO/IEC 27001 – An international standard outlining the best practices for establishing, implementing, and maintaining an Information Security Management System (ISMS). The standard includes guidelines for information technology, applications, and data centre infrastructure, with a special emphasis on cybersecurity and information security.

SSAE 16 (SOC 1, 2, and 3) – The SSAE 16 (Statement on Standards for Attestation Engagements) outlines the standards for reporting on the controls at a service organization. It provides guidelines for conducting a thorough audit of a data centre’s controls and processes, ensuring the protection of data confidentiality, integrity, and availability.

PCI DSS – The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.

NIST 800-53 – The National Institute of Standards and Technology (NIST) Special Publication 800-53 provides a set of guidelines for managing information security and privacy risk for systems and organizations. It includes recommendations for implementing risk management programs that meet the requirements of the Federal Information Security Modernization Act (FISMA).

HIPAA – The Health Insurance Portability and Accountability Act (HIPAA) is a federal law in the United States that sets standards for the protection of sensitive patient health information. It provides guidelines for safeguarding electronically protected health information (ePHI) stored in data centres.

GDPR: A Game-Changer in European Data Protection

The General Data Protection Regulation (GDPR) has brought about a sea change in data protection across the EU. A huge disruptor to enterprises across the continent, the regulation imposes stringent requirements on companies regarding the collection, storage, and management of personal data. Non-compliance with the GDPR can result in hefty fines and penalties. This has on the other hand forced a surge in data centre investment, including by the large hyperscalers which sough to be compliant with Brussels new rules.

The GDPR applies to all companies that process personal data and are based in the EU, regardless of where the actual data processing takes place.

It also applies to companies outside the EU that process personal data in relation to offering goods or services to individuals in the EU or monitors their behaviour.

The legislation has laid down several key provisions to enhance the control of EU residents over their data. Some of these provisions include:

Rights of Individuals: The GDPR outlines how organizations should help users find the data maintained about them, and comply with users’ requests to modify or delete the data.

Data Protection Officer (DPO): The GDPR mandates the appointment of a DPO to monitor compliance with the GDPR and ensure there are no violations.

Data Breach Notification: Organizations are required to maintain a register, assess the scope and impact, and notify the authorities and subjects within 72 hours of detecting a data breach.

European Data Centre Regulations and Standards

Different European countries also have their specific data protection laws that organizations must comply with while doing business in those countries. Here are some of the major privacy and security laws in Europe:

The German Bundesdatenschutzgesetz (BDSG) – The German BDSG is a federal data protection act that governs the exposure of personal data in Germany. It complements, specifies, and modifies the GDPR. Violations to some sections of the BDSG, such as those involving consumer loans, are considered criminal offenses, and the penalties are more severe than other fines from the GDPR.

The Dutch GDPR Implementation Act – The Dutch GDPR Implementation Act is the local implementation of the GDPR in the Netherlands. It follows a policy-neutral approach, meaning that the requirements of the previous Dutch Data Protection Act are maintained as much as possible under the GDPR.

The Danish Data Protection Act – The 2018 Danish Data Protection Act supplements the GDPR with its regulations specific to member states. This act contains information about the roles of the authorities, as well as provisions related to data processing, data disclosure, the appointment of a DPO, and other areas specific to Denmark.

UK-GDPR – Post-Brexit, the UK-GDPR has come into effect, which is similar to the GDPR but accommodates domestic areas of law. The UK-GDPR expands sections on national security, intelligence services, and immigration.

Final Thoughts

The future of European data centre security lies in adopting a comprehensive approach to security, incorporating best practices, following stringent standards, and leveraging advanced technologies. The evolving threat landscape necessitates continuous monitoring and updating of security measures to ensure robust protection of data centres.

Developers and IT teams must work hand in hand to ensure that their data centre security measures align with the latest standards and regulations.

In an era where data is king – or queen -, securing Europe’s data centres is no longer optional but an imperative for businesses. With evolving threats and stringent regulations, the need for robust data centre security is more pressing than ever.