Security Risks of Power Distribution Units
Introduction
Power distribution units (PDUs) play a critical role in data centers, serving as the middleman between power sources and equipment. PDUs are often overlooked during risk assessments because they are not considered mission-critical equipment. However, it is important to remember that PDUs are a gateway for both physical and digital intrusions, which could lead to performance issues or even complete service outages. If a threat actor gains privileged access to a PDU, they can shut down outlets and cause equipment reboots, risking operational uptime. Further they may also be able to gain network and system information, including credentials.
What is a PDU?
A PDU, or Power Distribution Unit, is a device used to distribute and monitor power in a secure environment. These devices are often found in data centers and server rooms. However, they can also be found in other locations where computer systems like computers or servers are used regularly.
PDUs have several unique features that make them useful for both technical support staff and security professionals alike:
- Monitoring – The ability to monitor the amount of wattage being used by various pieces of equipment helps ensure energy efficiency as well as prevent overloading of electricity sources such as generators or the grid itself.
- Management – Having control over how much power each piece of equipment receives allows you to prioritize certain processes over others for maximum efficiency across all machines running at once within an organization’s network infrastructure (e.g., if one system needs more power than another)
What are the risks?
In this section, we will discuss the risks associated with PDUs. As you learn more about these risks and understand how they can affect your organization, you will be able to better assess your security needs.
- Loss of data – The primary risk associated with PDUs is that they may expose sensitive or confidential information to unauthorized users. For example, if someone manages to gain access to a network through an unsecured port on a PDU, they could potentially access other systems and access company data.
- Loss of business – A breach in security can also result in lost time while investigating the incident and repairing damages caused by it (e.g., restoring damaged networks). In addition, if attackers have already accessed parts of your network before being detected by IT personnel or monitoring/detection software, then there is likely nothing left but damage control at that point—and even that is not guaranteed because the attack may continue unabated after detection has occurred.
- Loss of reputation – Finally, the loss for an organization caused by any type of cyberattack can be devastatingly long-term. It hurts both its bottom line directly (through direct financial costs) as well as indirectly through negative publicity, which could affect future sales growth potential, employee morale, etc.
Attacks against IoT devices increased by 100 percent last year, according to a report by San Francisco-based cybersecurity vendor Darktrace. According to a survey last year by the SANS Institute, only 40 percent of companies apply and maintain patches and updates to protect IoT devices, and 56 percent said that difficulties in patching are one of their greatest security challenges. In addition, almost 40 percent said they had problems finding, tracking, and managing these devices.
Preventative measures
As with all other systems in your environment, PDUs are susceptible to attack, and they need to be managed and protected with the same diligence.
There are several approaches data centers can take to secure these systems.
- Ensuring access is limited to specific users, and remote access is controlled by only opening specific ports to those devices.
- Micro-segmentation, for example, can block all traffic to a device except for authorized traffic. It may make sense for each device to have its own logical, or even physical, network.
- Keeping devices current with both firmware and software.
- Monitoring and logging access, both physical and logical.
- Updating configurations as networks, devices, and resources change.
- Upon decommissioning, contact an IT Asset Disposition (ITAD) specialist, like Sipi Asset Recovery, to ensure that the data is completely inaccessible.
Conclusion
In summary, while PDUs provide many benefits, they also carry significant security risks. To ensure the protection of your data and data center against these harmful threats, a comprehensive security solution is necessary to mitigate or prevent attacks.
All devices on your network should be considered in your cybersecurity strategies, including PDUs and other IoT devices. Network and user access should be restricted and monitored, and all devices should be regularly checked and updated.
Many of these threats can be avoided by implementing basic security protocols to protect your systems while. Further, an ITAD specialist should assist you in discarding these devices upon decommissioning. Protection of your assets extends beyond being in-service.
