1 in 5 Data Center Cyber-Physical Assets Exposed Within One Network Hop
Written by AI from the linked story. Not reviewed by an editor. How this works
Claroty's analysis of over 750,000 data center assets found that roughly 18% of cyber-physical systems — including HVAC units and power distribution units — are just one network hop away from internet-exposed pathways. These systems rely on insecure legacy protocols, carry known unpatched vulnerabilities, and often use weak or default authentication credentials, making them attractive targets for attackers. Compromising these systems doesn't just mean a data breach — it can result in physical disruption to critical infrastructure, including power failures or environmental damage. This finding highlights a systemic failure to apply IT security principles to operational technology (OT) and cyber-physical environments. The convergence of IT and OT networks without adequate segmentation dramatically expands the attack surface.
Tactical Insight
Immediate actions
- Conduct a full asset discovery audit to identify all cyber-physical systems with direct or indirect internet exposure.
- Immediately isolate any HVAC, power, or OT systems reachable within one hop of internet-facing interfaces using firewall rules or VLANs.
- Rotate or disable default credentials on all cyber-physical and OT devices.
Long-term improvements
- Implement strict network segmentation using a Purdue Model or Zero Trust architecture to separate OT/cyber-physical systems from IT networks.
- Establish a dedicated vulnerability management program for OT/ICS assets, including regular scanning and a tracked remediation workflow.
- Replace or wrap legacy insecure protocols (e.g., Telnet, FTP, Modbus without authentication) with encrypted, authenticated alternatives wherever possible.
Detection measures
- Deploy continuous monitoring and anomaly detection tools purpose-built for OT/cyber-physical environments (e.g., Claroty, Dragos, or Nozomi).
- Establish alerting for any unauthorized lateral movement attempts between IT and OT network zones.
- Maintain detailed network topology maps and review them quarterly to detect newly exposed pathways.