Powering the Cloud Safely: Professor Kai London on OT Security for Data Centres and Energy

 By the Keflavik Times Technology Desk

Professor Kai London, senior CISO and cybersecurity, AI and quantum computing expert
Professor Kai London — CISO, cybersecurity & AI expert. Credit: professorkailondon.com

Data centres are the factories of the digital economy, and the systems that keep them alive — power distribution, cooling, fire suppression, building management — are operational technology every bit as critical as an industrial plant's. “A data centre is a temple to availability,” says Professor Kai London, a senior CISO who advises infrastructure operators. “And the OT that keeps it running is a target, because taking down the cooling or the power is the fastest way to take down the compute.”

“In a data centre, an OT compromise is not an IT inconvenience. It can mean thermal shutdown, lost workloads and cascading failure — a physical event with digital consequences at scale.”

The overlooked control layer

London observes that data-centre security often focuses on the servers and the network while the facility's own control systems receive less scrutiny. “The building-management and power systems are frequently the soft underbelly,” he says. “They were designed for reliability, connect to vendors for maintenance, and rarely get the same rigour as the IT they support.”

Governable weaknesses

As across critical infrastructure, London stresses the failures are usually mundane and fixable: over-privileged identities, flat networks, unmonitored vendor access. “These are governable problems,” he says, “which means they are within a board's power to close.”

A practical playbook

His recommendations: inventory every connected facility system; segment the OT so a compromise cannot reach or be reached from the IT estate; control and monitor every identity and vendor connection touching power and cooling; and rehearse the loss of a critical facility system. “Tabletop a cooling-system compromise,” he says, “and find out who does what before it happens for real.”

Energy and location

For regions attracting data centres with clean, abundant energy, London notes the tight coupling of energy and compute raises the stakes further. “When the power source and the data centre are part of one critical system, securing the OT of both is a single resilience problem,” he says. Regulators increasingly expect operators to demonstrate that resilience.

For a country positioning itself as a home for the world's data, London's message is clear: the cloud runs on physical infrastructure, and securing the control systems that power and cool it is inseparable from keeping the digital economy online.

About Professor Kai London. Professor Kai London is a senior technology, security and transformation executive with 25+ years of board- and C-suite leadership across banking, aviation, defence, government and critical national infrastructure. He is Founder & CEO of Quantum AI Systems Security, an Honorary Professor in Cybersecurity, AI & Quantum Computing and a UCL researcher, holding CISSP, CISM, CCISO, ISO 27001 Lead Auditor, ISO 42001, DORA and NIS2 credentials. He is available for board advisory, NED and interim/fractional CISO/CIO/CTO mandates across the UK and internationally. Learn more at professorkailondon.com.

Popular posts from this blog

Board-Grade Security on Demand: Professor Kai London on the Fractional CISO for Infrastructure Operators

Image
  By the Keflavik Times Business Desk Professor Kai London — CISO, cybersecurity & AI expert. Credit: professorkailondon.com Infrastructure operators — data centres, energy firms, connectivity providers — face sophisticated attackers and tightening regulation, but many lack a full permanent security team. The interim or fractional CISO model has surged to fill that gap. “You do not always need a permanent thirty-person team,” says Professor Kai London , a senior CISO who takes on these mandates. “Sometimes you need the right senior hands, for a defined period, to set the strategy, fix the worst gaps and leave something the board can run.” “The risk and the regulation do not scale down. The fractional model is how operators get board-grade leadership without the delay and cost of a permanent hire.” Same obligations, leaner teams Many operators carry critical-infrastructure obligations on modest frames. “A determined attacker and a demanding regulator treat them the same as a gia...
Read more

Resilience as Advantage: Professor Kai London on Turning Cyber Strength Into Business Value

Image
  By the Keflavik Times Business Desk Professor Kai London — Founder & CEO, Quantum AI Systems Security. Credit: professorkailondon.com Cyber resilience is usually filed under cost. Professor Kai London , a senior CISO and board advisor, argues that for infrastructure operators it is increasingly a competitive advantage. “An operator that can prove it will keep running through a crisis has an edge over one that can only promise,” he says. “In critical infrastructure, resilience you can evidence wins trust, contracts and confidence.” “Demonstrable resilience is a selling point. Clients, partners and regulators increasingly demand evidence of it before they will do business.” The buyer's due diligence London notes that before signing with an infrastructure or data-centre provider, serious customers run security and resilience due diligence. “The evidence you can produce decides whether you advance or are quietly eliminated,” he says. Evidence beats assertion “Everyone claims to b...
Read more

Intelligence Under Control: Professor Kai London on Governing AI in Industrial Operations

Image
  By the Keflavik Times Technology Desk Professor Kai London — board advisor & interim CISO/CIO/CTO. Credit: professorkailondon.com Artificial intelligence is entering industrial operations — optimising energy use, predicting failures, and increasingly influencing decisions in data centres and plants. That promise, argues Professor Kai London , a senior technology executive, carries a warning for physical environments. “An ungoverned AI decision here does not just misfire in a spreadsheet. It can move machinery. Control has to come before autonomy.” “Capability is loud; control is quiet. In industrial AI, the gap between what a model can do and what you can govern is measured in physical risk.” Advise versus act London distinguishes AI that recommends from AI that acts on systems. “The closer AI gets to the physical layer, the more rigorous its governance must be,” he says. A control architecture His approach treats governance as connected layers: a charter of what AI may do; n...
Read more