Data centres make Ireland a target for hackers - expert

A cybersecurity expert has said Ireland is "in the crosshairs" for hackers because the country hosts so many data centres.

CEO of BH Consulting and cybersecurity expert Brian Honan made his comments following the power outage yesterday that hit online bank Revolut.

Speaking on RTÉ's Morning Ireland, he explained that yesterday's issue with Revolut was due to a power outage at Google's data centre in the UK, resulting in a "cascading effect" that brought down their systems resulting in problems for some banks and financial institutions.

Mr Honan said similar issues have previously occurred with other data centres but are rare. However, when they do happen, they cause major issues for banks and consumers, he said.

"Around this time last year, we had outages with Amazon, AWS. Their systems went down, resulting in companies and providers who use that platform being unavailable for several weeks after that.

"Microsoft had an outage in their cloud environment as well, which had a similar impact and then there was another impact several weeks after that with an American company called Cloudflare, which routes a lot of the internet traffic," he said.

"They don't happen very often, but when they do, they have a major impact," he added.

Mr Honan added that in the cybersecurity industry there is a concentrated risk, because many organisations rely on a few providers and "if anything happens to those providers, you end up with a major impact."

In relation to data centres being targets for hackers, which is not thought to have happened in yesterday's case, Mr Honan said: "They've become a nice big target because so many organisations are using them.

"You could have nation-state attackers trying to break into systems to get access to government systems, cybercriminals trying to get access to personal data and other systems as well.

"There have been reports of allegedly Chinese state actors breaking into the Microsoft Office 365 platform several years ago and accessing the assistance belonging to US defence organisations."

He added: "This concentrated risk actually puts Ireland in the crosshairs as well because we host so many of their data centres that any cyber criminals or any threat actors that will be targeting these systems could have a collateral damage impact on our national security and our infrastructure as well."

He said regulations are coming through from the EU, namely the NIS2 Directive, which the Government has yet to transpose into Irish law, and the EU Digital Operations Resilience Act (DORA), that enforce strict risk-management rules around mandatory incident reporting and supply chain security.

They require critical entities like fintech companies and banks to manage cybersecurity risk in their supply chain and to make sure that they have processes in place to enable them to continue providing services in the event of a cyber incident.

"These things cost money, so you need banks etc to manage the risk, assess the risk and look at other alternatives," Mr Honan said.

"For example, if they're hosting a system in one area in Amazon AWS, can they have a replicate system in another area or with another provider so if there's a problem with one system, they can switch to the other one."