The UK government included data centers in its classification of protected critical national infrastructure (CNI) on Thursday. This amendment to the CNI list, the first since 2015 when space and defense sectors were added, places data centers alongside essential services like water, energy, and emergency services.

“By recognizing data centers as crucial infrastructure, the sector will benefit from increased government support for recovery and prediction of critical incidents. This assures businesses setting up in the UK and fosters economic growth,” said UK Technology Secretary Peter Kyle. He also mentioned that the CNI status would lead to the formation of a dedicated government team to oversee data center infrastructure, collaborate with security agencies such as the National Cyber Security Centre, and manage coordination with emergency services during crises. more info

The CNI designation includes both physical data centers and cloud services providers like Microsoft, AWS, and Google Cloud.

This follows recent investments by Amazon in UK-based data centers earlier this week. more info

“In a scenario where a data center crucial to the NHS suffers an attack, the government steps in to implement emergency measures to shield vital services such as patient appointments and surgeries from damage,” Kyle expressed in his announcement.

The government anticipates that these new safeguards will enhance the attractiveness of investing in data center ventures within the nation.

According to the statement, the extra security afforded by the CNI status should minimize the chances of data compromises due to power failures, cyberattacks, or severe weather conditions. However, the protection might not significantly deter cyberattacks targeting sensitive or high-value data important for state-level interests or lucrative for operations like phishing or ransomware.

Eric O’Neill, a founding partner at The Georgetown Group and former FBI operative, commented that the UK’s new designation and its envisioned protective measures are unlikely to lessen cyberattacks, remarking, “The designation itself doesn’t serve as a deterrent to an attack.”

Indeed, O’Neill suggested that this could potentially encourage attackers rather than deter them, as such adversaries often take pride in demonstrating their prowess and defying Western powers, making bold statements to impress their peers online, according to O’Neill.

Brian Levine, once a government lawyer and now a managing director at Ernst & Young, appreciated the UK’s declaration but highlighted concerns about the lack of detail, particularly regarding how the support would be implemented.

Levine pointed out that the term “critical infrastructure” is frequently too broadly used by governments and often lacks a clear definition. While the inclusion of data centers might seem rational, the effectiveness of the approach greatly depends on the government’s actual actions.

In contrast, the US identifies numerous critical infrastructure sectors without including data centers specifically. However, it clearly lists as critical, sectors like information technology, healthcare, and financial services, all of which are vital to virtually every significant cloud environment.

“It’s hard to imagine a data center that doesn’t have some of those sectors included as part of their customers’ information,” Levine said.

Like many other government security efforts, it is likely to help companies who have weaker security in their data centers. “If the data centers already have reasonable security and reasonable redundancy, then it may have little impact,” Levine said. “It may have the biggest impact on the smallest players, but I also wouldn’t assume that all of the larger players are performing at the level that their customers would want.”

Forrester Senior Analyst Alvin Nguyen applauded the UK move but was skeptical that it would change matters materially.

“This is unlikely to make a difference. Cyberattacks from large organizations and/or nation states have significant resources behind them. Being able to bring government resources to bear helps but will not eliminate cyberattacks on critical digital systems in data centers,” Nguyen said. “If this results in improved best practices, this might help the companies leveraging data centers mitigate simple attacks such as phishing, but not against larger, more coordinated attacks on higher value targets in the data center. This might evolve in the future to better coordinated defense of data centers that results in actual reduced cyber risk, but that isn’t clear right now.”

Nguyen believes that the UK’s decision could set a precedent that other nations might follow.

“This significant public step will draw more attention to the issue and shine a light on the challenges and dangers involved in securing data centers,” Nguyen commented. “While it might not immediately lessen cyber risks, it marks an important beginning. If this initiative is supplemented with the development of new best practices for combating both current and future cyber threats, it could inspire similar actions in other countries.”

The UK government referenced the CrowdStrike disruptions as a scenario that could benefit from the new measures.

“The significant disturbance caused by the CrowdStrike incident this past summer, which impacted 60% of GP practices, affecting systems managing patient appointments, prescriptions, and medical records, underlined the severe repercussions of IT and cyber threats,” Kyle explained. “The UK currently hosts the largest number of data centers in Western Europe.”

Welcome to DediRock, your trusted partner in high-performance hosting solutions. At DediRock, we specialize in providing dedicated servers, VPS hosting, and cloud services tailored to meet the unique needs of businesses and individuals alike. Our mission is to deliver reliable, scalable, and secure hosting solutions that empower our clients to achieve their digital goals. With a commitment to exceptional customer support, cutting-edge technology, and robust infrastructure, DediRock stands out as a leader in the hosting industry. Join us and experience the difference that dedicated service and unwavering reliability can make for your online presence. Launch our website.