Data center segmentation fails when it separates infrastructure by function but preserves a trusted path between those functions.
An attacker does not need direct access to cooling, power, or building controls when a compromised management system can reach them.
Claroty analyzed 174,577 data center infrastructure assets. Direct internet exposure was minimal in some categories. Its power-monitoring group contained no directly exposed devices among 30,610 assets. Yet 32,157 assets, or 18% of the total, sat one network hop from a system making risky connections to the public internet.
The exposed system is only the entry point. The real question is what becomes reachable after it is compromised.
Exposure and reachability are not the same
Internet exposure is easy to measure. A scan identifies a listening service, an external IP address, or an accessible management interface. The result produces a specific asset and an obvious remediation task.
Indirect exposure is harder because every connection in the path can be legitimate.
A building management platform collects data from cooling systems. A facilities contractor connects through a remote-access gateway. A monitoring server polls power equipment. An administrator uses a shared management network to reach several infrastructure systems.
Each connection has an operational purpose. Combined, they can create a route from an exposed host to equipment that can interrupt data center operations.
Claroty’s power-monitoring data shows why perimeter scans provide an incomplete view. None of the 30,610 systems in that category was directly exposed. That does not prove the systems were isolated. Their reachability depended on the systems allowed to communicate with them.
A controller does not need a public IP address to become part of an internet-originated incident. It only needs to trust a system that does.
Separate VLANs can preserve the same attack path
VLANs establish boundaries, but they do not determine whether those boundaries contain a compromise. Routing, firewall policy, access controls, and management architecture decide that.
A data center can place servers, building controls, cooling equipment, and power systems on separate VLANs while allowing broad traffic between them. The diagram shows segmentation. The permitted flows preserve lateral movement.
This failure usually develops gradually. A project needs temporary access, so a firewall rule is widened. A monitoring tool needs visibility across several zones, so it receives broad reach. A vendor cannot support a narrow configuration, so an entire subnet is permitted. The immediate problem disappears, and the exception remains.
Over time, the network accumulates individually reasonable rules that produce an unreasonable path.
This is the same failure pattern behind costly network segmentation mistakes. The boundary exists, but routine exceptions reduce it to a routing distinction rather than a containment control.
The firewall is enforcing the access operators approved. The weakness sits in the policy that created the path.
Facilities access rarely has one clear owner
Data center operational systems often sit between organizational responsibilities.
Facilities teams own cooling, power, and building equipment. Network teams provide connectivity. Security teams set policy. Vendors maintain specialized devices. Platform teams operate the monitoring and management systems that connect the environments.
Each group understands part of the route. Ownership of the complete route is less common.
This is where temporary access becomes permanent infrastructure. A vendor gateway remains active because another maintenance visit is expected. An old firewall rule stays in place because its application owner cannot be identified. A shared jump host retains access to several operational zones because splitting the workflow would slow support.
These are predictable results of divided ownership and pressure to preserve availability.
Removing a connection can interrupt maintenance or monitoring immediately. Leaving it in place creates a risk that can remain invisible for years. Operations favor the known short-term requirement unless the review process forces someone to evaluate the whole path.
A valid exception needs an owner, a defined purpose, a narrow destination, and a review date. Without those elements, the exception becomes part of the architecture without receiving architectural scrutiny.
Legacy protocols increase dependence on the network boundary
Many cyber-physical devices cannot enforce modern controls after traffic reaches them.
Claroty reported that 88% of the building management systems in its study communicated over insecure protocols and 40% ran outdated firmware. More than 80% of the observed OT control, power-monitoring, and IoT systems used legacy protocols such as BACnet or Modbus.
These systems have long service lives, limited maintenance windows, proprietary dependencies, and direct roles in facility availability. Replacing them is not equivalent to updating an application server.
That makes network enforcement more important.
A controller that cannot authenticate individual commands depends on the surrounding network to restrict who can send them. Once an attacker reaches an approved management host, broad access can remove the strongest control protecting the device.
Monitoring traffic and control traffic should not automatically use the same route. A server that reads telemetry does not need authority to change settings. A cooling contractor does not need access to power-monitoring equipment. A remote session used for one device class should not open a path to every controller in the facilities network.
Access should reflect the work being performed, not the convenience of the system providing it.
Power and cooling change the cost of lateral movement
A compromise of data center infrastructure can cause loss without reaching the applications or data stored on the servers.
Claroty found that 41% of power distribution units and 32% of HVAC or cooling systems were one hop from a risky internet connection. These systems support the physical conditions required by every compute, storage, and network device in the facility.
An attacker who reaches them can create an availability incident by changing environmental settings, interrupting automated controls, disabling alerts, or cycling power. Redundant servers do not remain available when the supporting facility systems fail together.
Facilities equipment is therefore part of the data center control plane, not a collection of peripheral devices.
An organization can invest heavily in clustered applications, redundant links, backup power, and failover systems. A reachable management platform can bypass that resilience when it controls the infrastructure on which those safeguards depend.
The potential loss is determined by the equipment the controller can disrupt, not by the value of the controller itself.
Test from an assumed compromise
A useful segmentation review starts by assuming that each internet-facing or remotely accessible intermediary has already been compromised.
From that position, the team traces which operational assets are reachable, which ports and protocols are permitted, which credentials are available, which administrative interfaces can be opened, and which commands the intermediary can issue. The review continues until the path reaches a hard boundary.
This approach tests the network as an attacker experiences it. Reviewing rules one at a time does not.
A rule allowing a monitoring server to contact a building management platform can have a valid business purpose. A second rule allowing a remote-support gateway to contact the monitoring server can also appear justified. Together, they can create a route from an external account to facility controls.
Firewall policy should be reviewed as connected paths, not isolated entries. Firewall rules that appear reasonable on their own can produce excessive reach when combined with other trusted relationships.
Testing must also reflect operating conditions. Vendor accounts are active during maintenance. Emergency rules are wider than standard policy. Shared credentials exist because older equipment does not support individual identities. Monitoring platforms often reach more systems than their documentation suggests.
An architecture review confirms what the network was designed to do. An assumed-compromise review shows what a captured system can actually reach.
Network equipment can limit what policy is practical
Granular segmentation depends on infrastructure that can enforce and expose the required controls.
Managed switches must support the VLAN, access-control, authentication, logging, and management features used by the design. Firewalls need enough capacity to inspect traffic without becoming an operational bottleneck. Logging must show which system crossed the boundary and what connection it made.
Older equipment can remain stable while preventing the network team from applying precise policy. A switch can forward traffic reliably but provide limited visibility. A firewall can support the required rules but lack the capacity to inspect operational traffic under load. A management platform can force several device classes through one broad access path.
Replacing equipment does not fix weak architecture by itself. It becomes necessary when the existing hardware makes the required architecture impossible to enforce.
The useful distinction is capability, not age. Enterprise switches provide different levels of traffic separation and visibility. The correct platform is the one that can enforce the intended boundary under normal load and during an incident.
A control that has to be disabled when the network is busy will not contain an attack when conditions are worse.
Segmentation must stop the next connection
The most important data center boundary is not the one between the internet and the first exposed system. It is the boundary that prevents that system from becoming a route into power, cooling, and building controls.
Attackers work through sequences of permitted connections. Management servers, remote-support gateways, monitoring platforms, and vendor access systems can bridge zones without violating any single rule.
Effective segmentation breaks that sequence. A compromised intermediary reaches the end of its authorized path and stops there.
Separate subnets and documented zones do not prove containment. Containment is proven when the first compromise cannot produce the connection that turns an IT incident into a facility outage.
Sources
- State of CPS Security: Data Center Exposures, Claroty Team82
- Data center exposures and the pathways putting data center assets at risk, Claroty Team82
- Adapting Zero Trust Principles to Operational Technology, CISA
- Foundations for OT cybersecurity: Asset inventory guidance for owners and operators, CISA
About NetworkTigers
NetworkTigers is the leader in the secondary market for Grade A, seller-refurbished networking equipment. Founded in January 1996 as Andover Consulting Group, the company originally built and re-architected data centers for Fortune 500 firms. Today, NetworkTigers provides consulting and network equipment to global government agencies, Fortune 2000 companies, and healthcare companies. Visit www.networktigers.com
