Unmanned Aerial Vehicles, commonly referred to as drones, have been a source of entertainment for millions of enthusiasts, and a technical resource for many industries to advance their aerial surveillance, mapping, and protection programs. They’re bringing new views to light through film and photography, inspecting infrastructure to find vulnerabilities, and even flying in fleets to survey natural disasters, deliver medicine and food, and locate missing persons. For as many positive case uses for drones, there are even more possibilities for the negative, including espionage, spying, warfare, and most recently unfolding, data center hacking.
Significant resources are spent to protect a data center, from ground fences, armed doors and windows, and emergency shutdown systems. Aerial threats are emerging, and without the ability to create an airspace barrier, security officers need to create a drone defense program to prevent attacks on data center infrastructure.
The interruption of a data center’s operation can cause system malfunctions and server failures, financial damages, including losses by customers, and can diminish brand image and prompt a loss of client confidence. Drones are enabling new avenues for hackers and terrorists, who can use them to carry payloads of any kind. The FAA and other federal regulatory bodies are significantly behind in developing and enforcing regulations to protect vulnerable buildings, and drone operators can easily evade and ignore existing regulations. Data centers and organizations with critical infrastructure must be proactive to protect their airspace and vulnerable buildings from unauthorized drone activity.
Drones are becoming a critical part of a hacker’s equation introducing a sophisticated level of espionage.
In February 2017, researchers with Ben-Gurion University’s Cyber Security Research Center demonstrated an alarming hacking technique by using drones to detect vulnerabilities in air-gapped computers installed with malware. Air-gapped computers are developed as a network security measure to ensure that a secured computer network is physically isolated from an unsecured network. However, these researchers demonstrated how air gaps can be breached and data can easily be intercepted by a drone. Once a computer is infected, a drone with a camera can be deployed to hover outside a window, near the hardware. Detected through electromagnetic signals, the transmitting computer can be located by the drone, and capture data through LED signals emitted by the hard drive.
A blinking light on a computer may seem innocuous, and these researchers show that infected computers can be easy to overlook, but programmed to help a drone find its location and prompt a swift and easy transfer of information. If When the drone’s camera has a line of sight to the target, it will identify the correct computer. It takes only moments for a drone to locate the computer, complete an upload of information, and fly away and out of sight. See the process in action, here. New use cases for drones are being tested every day, and hackers are quick to note how drone technology can support illegal activity. Data centers are on the lookout for new hacking techniques. Those with aerial defense systems in place are best prepared to protect their operations.
Not only are drones laptops in the sky, but they are also a physical risk and can carry hazardous payloads.
Data center security officers are acutely aware that it only takes a few grams of a mysterious powder to be dropped into a cooling unit to prompt a catastrophe. In combat zones, drones have been designed to steadily carry sensitive payloads, anywhere from cameras, medical supplies, and pesticides. Terrorist groups have taken advantage of this, transporting bombs, guns, grenades and deadly chemicals to drop off quickly and without any physical harm to their soldiers. The same risks apply for data centers, particularly when their rooftops hold cooling units. Drones can be custom built by hackers, designed specifically for spying and infiltrating a network. There’s no such thing as an airspace fence, and a $500 drone crashing into a cooling unit could cause millions in damages to climate-controlled hardware.
Drones on the market today can carry upwards of 200 pounds and can stay in the air for over an hour – enough to fly many miles. A crash could be catastrophic. Without knowing the drone’s payload, whether it be a camera or other device, data center operators need to be aware that any drone in their area is a risk to their operation and employees’ safety.
Drone technology and use cases are outpacing federal regulators and lawmakers, leaving data centers and other critical infrastructure security officers to decide how to address aerial threats.
The FAA estimates small, hobbyist unmanned aerial systems (UAS) purchases may grow from 1.9 million units in 2016 to as many as 4.3 million by 2020. Sales of UAS for commercial purposes are expected to grow from 600,000 in 2016 to 2.7 million by 2020. Combined total hobbyist and commercial UAS sales are expected to rise from 2.5 million in 2016 to 7 million in 2020. This market is growing rapidly, and there are few and inconsistently enforced requirements to register a drone with the FAA.
Federal laws have been written to guard aircraft, including drones, treating them with the same protections as a commercial airliner. It is illegal in the United States to interfere with the operation of or cause physical damage to a drone. This only leaves room to create a defense program. Data centers and organizations with critical infrastructure must not wait for federal regulators to provide guidance on drone espionage and physical attacks, and regardless of the existence of laws, hackers and terrorists will evade and ignore such regulations.
Data centers must take proactive measures to detect drones and deploy a defense to protect high-risk and high-value infrastructure.
Drone protection for data centers is no longer theory – it’s a practice in place today since any drone user is capable of causing millions in damages. Drones threaten the physical security of data centers, and consequently, their cybersecurity. They are discreet and capable of carrying payloads of several pounds over fences and right next to structures, including devices to intercept or disrupt data communications or hack into servers.
Unique aerial security risks exist for data centers, as demonstrated through new drone research and hacking programs, and a lack of regulatory protections. With an understanding of the threat that drones pose, as well as a proactive plan in place to protect critical infrastructure, security officers at data centers will be a significant step ahead of hackers, spies, and terrorists.
