It’s no secret that data centres need a large amount of power and water. What is less discussed is the security needed to ensure those supplies and other support services keep flowing to the data centres. Yet they’re under constant cyberattack as the value of data rises.
The supporting infrastructure itself depends on operational technology (OT) – the hardware and software used to monitor, control and automate physical devices and industrial processes.
There’s exploitable OT in the data centres themselves, such as precision cooling systems and internet-exposed infrastructure management software and physical devices such as sensors and cameras.
There needs to be a cultural shift towards acknowledging the need for OT security to protect these assets within data centres. While the sentiment in Australia has been focused on building more, faster, we lack a cultural awareness about protecting these assets. We can’t facilitate this new AI era if we don’t embrace security systems needed to keep them running.
And that’s just the data centre itself, which, of course, depends on the energy grid and water systems it’s connected to. These also use operational technology – such as network controllers and substation monitoring systems.
We’ve seen these very systems be weaponised time and time again. Right now, they’re being targeted in Ukraine.
In the first half of 2025 alone, over 3,000 cyber incidents were recorded in Ukraine. Many were hostile operations targeting hospitals, energy and transport systems, government services, and local authorities.
Britain and the European Union have imposed new sanctions targeting Russia’s persistent and increasingly reckless attempt to ‘sow chaos and division across Europe’. The sanctions were sparked by an attack by Russia’s Federal Security Service (FSB) in Poland that targeted renewable energy facilities, a manufacturing firm and a plant supplying heat for nearly 500,000 people.
And while these attacks feel far from home, Australian critical industries are also under constant threat, as the Australian Signals Directorate (ASD) has repeatedly warned.
The ASD warned in August that Chinese state-sponsored hackers were targeting networks globally, including Australia.
For the promises of Australia’s AI strategy to reach fruition, we need to prioritise security.
Data centres and the important systems they are connected to must have stringent cybersecurity requirements. Data storage and processing is a critical infrastructure sector under the Security of Critical Infrastructure Act 2018. So protecting them may be legally obligatory.
But the risk lives in the gaps. It lives between the operator who runs the physical computers, the electricity company that supplies the energy, the vendor who remotely services the cooling systems and the landlord who owns the building. OT security fails at exactly these handoffs.
A facility can be immaculate on the IT side and still be exposed through an insecure building management system commissioned by a subcontractor.
The ASD’s guidance makes the point that OT environments carry old devices, outdated protocols and slow replacement cycles. It also notes that operators are often locked into engineering contracts written long before cybersecurity was a consideration.
But these systems are all connected. If the water system connected to a data centre has vulnerabilities, it can put the data centre itself at risk and, in turn, Australia’s increasingly digital economy. OT security isn’t just a standalone issue or a lone vulnerability. We depend on critical industries every day, and they’re also dependent on each other.
While AI dominates the conversation, OT security supports the systems that allow it to function. And this should be a core consideration not only for Australia’s AI strategy, but for the smooth running of critical industries that make data storage, and our daily lives, possible.
Leave a comment