Listen to this Post
Introduction
The 2025 COPASIR Annual Report has crystallised what security professionals have long suspected: energy security is no longer a peripheral concern but an integral component of national security. As data centres evolve from mere consumers of electricity into complex “prosumers” that both produce and consume energy, the intersection of digital and energy criticality demands a unified security framework that addresses physical, cyber, and operational resilience in equal measure.
Learning Objectives
- Understand the strategic convergence of energy security, data centre operations, and national security imperatives
- Master the technical implementation of combined heat and power (CHP) and trigeneration systems with integrated cybersecurity controls
- Identify and mitigate cyber-physical vulnerabilities in UPS, HVAC, and building management systems (BMS)
- Apply NIST, IEC 62443, and Zero Trust frameworks to data centre energy infrastructure
- Develop actionable incident response and monitoring strategies for energy-critical digital assets
- The Energy-Digital Nexus: Why Data Centres Are Now Critical Infrastructure
Data centres consumed 1.5% of global electricity in 2024, with consumption expanding by 12% annually. This demand growth is accelerating, driven primarily by AI workloads that require unprecedented computational power and, consequently, energy density. The implications extend beyond mere consumption figures.
Data centres create situations where large loads suddenly join or drop off the grid, posing significant challenges to grid stability. This interdependence between data centres and energy systems makes it imperative to understand and manage cyber risks to energy infrastructure, including on-site power production at data centre facilities.
The UK government’s Cyber Security and Resilience Bill, introduced in April 2025, mandates mandatory reporting for data centres—a critical recognition from authorities that cybercriminals have evolved beyond traditional IT attacks to target operational technology (OT) systems. This regulatory shift signals a broader trend: energy security, sustainability, and digital competitiveness can no longer be addressed as separate agendas.
- CHP and Trigeneration: Technical Implementation and Security Considerations
Combined Heat and Power (CHP) and trigeneration (CCHP) systems represent a strategic response to the energy demands of modern data centres. These systems simultaneously produce electricity, heating, and cooling from a single fuel source—typically a high-efficiency gas engine.
Technical Architecture
A typical CHP installation for a data centre includes:
- Prime mover (gas engine or turbine) generating electricity
- Heat recovery system capturing exhaust and jacket water heat
- Absorption chiller (in trigeneration configurations) converting heat to cooling
- Thermal storage for load balancing
- Battery Energy Storage Systems (BESS) for grid-forming capabilities
Security Implementation
When designing CHP systems for data centres, the power generation component must contribute to the overall electric reliability design of the facility. Current Tier classifications require:
- Redundant capacity and redundant controls
- Minimum 36-72 hours of on-site fuel storage
- Island-mode operation capability
Hardening CHP Control Systems
Linux-based SCADA/HMI systems (common in CHP deployments):
Audit open ports on CHP control network nmap -sS -p- --open 192.168.100.0/24 Verify firewall rules restricting access to control interfaces iptables -L -1 -v Implement strict inbound rules for CHP management interfaces iptables -A INPUT -p tcp --dport 502 -s 192.168.100.0/24 -j ACCEPT Modbus iptables -A INPUT -p tcp --dport 2404 -s 192.168.100.0/24 -j ACCEPT IEC 60870-5-104 iptables -A INPUT -j DROP Disable unnecessary services on CHP controllers systemctl list-units --type=service --state=running systemctl disable telnet.socket ftp.service
Windows-based engineering workstations:
Audit Windows firewall rules for OT network interfaces
Get-1etFirewallRule | Where-Object {$_.Enabled -eq "True"}
Restrict RDP access to authorized jump hosts only
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -1ame "UserAuthentication" -Value 1
Disable SMBv1 (known attack vector for OT environments)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
3. The Cyber-Physical Threat Landscape: Real-World Vulnerabilities
The first quarter of 2025 shattered cybersecurity records with a 126% attack surge. For data centres, the threat landscape has expanded from traditional IT attacks to sophisticated cyber-physical operations that can simultaneously cripple digital networks and compromise power infrastructure.
Critical Vulnerabilities Discovered
In June 2025, cybersecurity researchers at Team82 (Claroty) identified critical vulnerabilities in widely deployed data centre products:
Vertiv Liebert IS-UNITY-DP UPS Network Cards (CVSS 9.8):
- Authentication bypass allowing unauthorised access to UPS control interfaces
- Remote code execution enabling attackers to execute arbitrary code
- Potential to force “output OFF” commands affecting entire facility power distribution
Trane Tracer SC+ HVAC Controllers:
- Unauthenticated API routes exposing sensitive device information
- Complete control over building management systems from external networks
- Attackers can map connected devices via BACnet or LonTalks protocols
Thermal Attack Vectors
Adversaries can exploit computational workloads to intentionally overheat servers:
- Running “power virus” programs or synchronised intensive tasks generates excess heat
- Localised hotspots degrade server performance by 15-25%
- Cooling energy consumption increases by 30-40% during attacks
- Cascading failures occur when exhaust heat raises intake temperatures for adjacent racks
BMS and DCIM Compromise
Hackers targeting Data Centre Infrastructure Management (DCIM) systems can:
– Change or override temperature set-points
– Manipulate cooling tower temperatures and fan speeds
– Control chilled water flow rates and humidity thresholds
– Disable alarms and emergency shutdown protocols
- Zero Trust Architecture for Data Centre Energy Systems
Building management systems (BMS) and environmental monitoring systems are increasingly connected to the internet, creating potential vulnerabilities that can be exploited by malicious actors. Implementing a Zero Trust security model for BMS is essential.
Implementation Steps
1. Network Segmentation and DMZ Deployment
Implement a DMZ to separate control centres from the enterprise network:
Linux: Configure DMZ zone with iptables Create separate network namespace for OT ip netns add ot_network ip link add veth0 type veth peer name veth1 ip link set veth1 netns ot_network Restrict traffic between enterprise and OT zones iptables -A FORWARD -i eth0 -o veth0 -p tcp --dport 502 -j ACCEPT Allow Modbus only iptables -A FORWARD -i eth0 -o veth0 -j DROP
2. Identity and Access Management
Windows: Enforce MFA for all administrative access Require smart card authentication for OT system access Set-ADUser -Identity "OT_Admin" -SmartcardLogonRequired $true Implement Just-In-Time (JIT) access Use PowerShell to create time-limited admin groups $group = "OT_Admin_JIT" $timeLimit = (Get-Date).AddHours(4) Add-ADGroupMember -Identity $group -Members "User1" Scheduled task to remove after 4 hours
3. Encrypted Communications
Encrypt and authenticate all communications between sites end-to-end, whether via point-to-point link, satellite, or Internet:
Linux: Set up IPSec tunnel for OT site-to-site communication Using strongSwan for industrial protocol security ipsec add conn-1ame ipsec up conn-1ame Verify encrypted tunnel status ipsec statusall
5. OT Network Monitoring and Anomaly Detection
Continuous monitoring of data centre power systems through network monitoring systems (NMS) and Security Information and Event Management (SIEM) is essential.
Implementation Guide
Deploying Industrial IDS/IPS:
Install and configure Snort for OT protocol analysis Custom rules for Modbus/TCP anomaly detection cat > /etc/snort/rules/modbus.rules << EOF alert tcp any any -> any 502 (msg:"MODBUS Read Request"; content:"|00 00 00 00 00 06 01 03|"; sid:1000001;) alert tcp any any -> any 502 (msg:"MODBUS Write to Coil"; content:"|00 00 00 00 00 06 01 05|"; sid:1000002;) alert tcp any any -> any 502 (msg:"MODBUS Write to Register"; content:"|00 00 00 00 00 06 01 06|"; sid:1000003;) EOF Monitor for abnormal BACnet traffic (port 47808) tcpdump -i eth0 -1n port 47808 -v
SIEM Integration for OT Events:
Forward syslog from CHP controllers to SIEM echo ". @192.168.200.10:514" >> /etc/rsyslog.conf systemctl restart rsyslog Monitor UPS status via SNMP snmpwalk -v3 -u monitor -a SHA -A "authpass" -l authNoPriv 192.168.100.50 .1.3.6.1.2.1.33
Visibility Across Systems of Systems
The power plant, backup power, cooling, and physical access systems each have potential for misuse that could affect data centre and grid stability. Implement:
- Asset discovery: Automated identification of all OT devices
- Baseline behaviour monitoring: Establish normal operating parameters
- Anomaly detection: Alert on deviations from established baselines
6. Supply Chain Risk Management and Regulatory Compliance
The Department of Energy’s Technical Assistance for Digital Assurance (TADA) initiative emphasises cyber-informed engineering (CIE) for data centre infrastructure. Key principles include:
- Consequence-focused design
- Engineered controls
- Secure information architecture
- Proactive reduction of cyber-physical vulnerabilities
Vendor Security Requirements
Owner/operators should:
- Include security capability as evaluation criteria for IT and OT asset procurement
- Require vendors to notify of security incidents within a reasonable timeframe
- Implement secure procurement and supplier risk management frameworks
NERC CIP and IEC 62443 Compliance
Current standards such as NERC CIP, IEC 62443, and IEEE 1547 must be applied to data centre-grid interfaces. IEC 62443 groups technical security controls into seven foundational requirements:
1. Identification and Authentication Control (IAC)
2. Use Control (UC)
3. System Integrity (SI)
4. Data Confidentiality (DC)
5. Restricted Data Flow (RDF)
6. Timely Response to Events (TRE)
7. Resource Availability (RA)
What Undercode Say
Key Takeaway 1: The convergence of energy security and data centre operations represents a paradigm shift in how we conceptualise critical infrastructure protection. The COPASIR 2025 report makes it clear that energy security is now national security, and data centres sit at the epicentre of this convergence. Owners and operators who fail to integrate cybersecurity into their energy infrastructure planning are exposing themselves to existential risks.
Key Takeaway 2: Cyber-physical attacks are no longer theoretical. The discovery of CVSS 9.8 vulnerabilities in widely deployed UPS and HVAC systems demonstrates that adversaries have clear pathways to cause physical damage and operational disruption. The 126% surge in cyberattacks in Q1 2025 is not an anomaly—it is the new baseline. Organisations must move beyond reactive patching to proactive, cyber-informed engineering that bakes security into the design phase of energy systems.
Key Takeaway 3: The regulatory landscape is shifting rapidly. The UK’s Cyber Security and Resilience Bill is likely the first of many mandatory reporting requirements that will force data centre operators to demonstrate comprehensive security across both IT and OT domains. Early adopters of Zero Trust architecture, network segmentation, and continuous monitoring will gain competitive advantage while laggards face regulatory penalties and operational risks.
Key Takeaway 4: CHP and trigeneration offer compelling efficiency and resilience benefits, but these systems introduce new attack surfaces. The industrial control systems managing these installations must be hardened with the same rigour applied to core IT infrastructure—if not more so, given the physical consequences of compromise.
Key Takeaway 5: Visibility is the foundation of security. Without comprehensive monitoring across power, cooling, and building management systems, operators cannot detect or respond to threats in time. The integration of OT telemetry with enterprise SIEM solutions, combined with anomaly detection capabilities, is essential for building cyber-resilient data centre energy infrastructure.
Expected Output
The strategic convergence of energy security and digital infrastructure demands a unified security architecture that spans IT, OT, and physical domains. Data centre operators must treat their energy systems—from CHP plants to UPS networks—as critical assets requiring the same level of cybersecurity rigour applied to customer-facing applications. The 126% increase in cyberattacks in early 2025 serves as a warning: adversaries are targeting the operational technology that keeps data centres running, and legacy security frameworks are inadequate.
Regulatory requirements are evolving to mandate comprehensive security across all domains. Organisations that proactively implement Zero Trust architecture, network segmentation, and continuous monitoring will be positioned to meet these requirements while building resilience against emerging threats. The integration of cyber-informed engineering principles into the design phase of energy systems represents the most effective strategy for reducing cyber-physical vulnerabilities before they can be exploited.
Prediction
-1 The proliferation of AI-driven workloads will continue to accelerate data centre energy consumption, creating unprecedented strain on electrical grids. This demand growth will outpace the deployment of renewable energy sources, leading to increased reliance on fossil fuel-based backup generation and heightened geopolitical energy security risks.
-1 Cyberattacks targeting data centre energy infrastructure will become more frequent and sophisticated, with nation-state actors developing capabilities to cause cascading failures across multiple facilities simultaneously. The interconnected nature of energy grids means that a successful attack on one data centre could have ripple effects across regional power systems.
+1 The regulatory push for mandatory cybersecurity reporting and standards compliance will drive significant investment in OT security, creating a robust market for industrial cybersecurity solutions. This will accelerate innovation in AI-powered threat detection, zero-trust architectures, and secure-by-design engineering practices.
+1 CHP and trigeneration technologies, combined with battery energy storage systems, will enable data centres to operate as grid-stabilising assets rather than just consumers. This shift will create new business models and revenue streams while enhancing overall energy system resilience.
-1 The skills gap in OT cybersecurity will remain a critical vulnerability. The shortage of professionals who understand both industrial control systems and cybersecurity will leave many organisations unable to implement or maintain adequate protections, making them attractive targets for adversaries.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Davide Maniscalco – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
