Jacobs

Data centers are no longer static vaults of computing - they are dynamic, distributed and increasingly automated ecosystems. As organizations scale into hybrid and multicloud, security can’t be an afterthought. The modern data center must be designed with resilience, modularity and sustainability in mind, each with deep security implications.

Emerging Threats in a Changing Landscape

Traditional perimeter defenses fall short when adversaries target firmware, supply chains and AIdriven vulnerabilities. With the rise of east-west traffic, containers, multi-cloud sprawl and compliance mandates, data centers require new, adaptive security models.

Core Security Pillars

1. Zero Trust at the Core

Zero Trust is now the default operating model for data centers. Its principle - never trust, always verify - is simple, but its execution across identity, network and workload layers is transformative.

Identity and Access

• Granular Admin Controls: Administrators should never have standing, persistent access. Just-in-time (JIT) and just-enoughaccess (JEA) ensure privileges expire automatically.

• Machine Identities: As APIs, workloads, IoT and OT systems multiply, machine identities outnumber humans. Zero Trust requires strong authentication and full lifecycle management for every identity.

• Hardware Root of Trust: Security begins at the chip level, with cryptographic identity embedded into silicon.

Network Segmentation and Microperimeters

• Micro-segmentation: Workloads are isolated into tightly controlled segments, with policies enforced at the VM, container or process level.

• East-West Traffic Controls: Lateral movement is the true battleground. Internal traffic must be authenticated, monitored and encrypted.

• Dynamic Policies: Access depends on realtime context - user behavior, geolocation, workload health and risk signals.

Data and Workload Security

• Attribute-Based Access Control (ABAC): Data access depends on multiple attributes such as role, device, workload state and dataset sensitivity.

• Data-in-Use Protection: Confidential computing protects workloads even if underlying hardware is compromised.

• Policy Enforcement at Scale: Zero Trust policies automatically attach to every new workload, reducing reliance on manual configuration.

Monitoring and Continuous Validation

• Continuous Authentication: Session trust is constantly reassessed through behavioral analytics, endpoint health and telemetry.

• Deception and Anomaly Detection: Honeytokens and canary workloads reveal insider threats or compromised accounts.

• Automated Response: Violations trigger automated action - revoking access, quarantining workloads or notifying security teams.

Extending Zero Trust Beyond It

• OT and Facility Systems: Cooling, power and building management systems (BMS) must also follow authentication, segmentation and monitoring protocols.

• Supply Chain & Maintenance Access: Vendor access uses ephemeral credentials, never persistent accounts.

Zero Trust in the modern data center becomes an operational backbone, unifying cyber, physical and supply chain defenses. The “perimeter” evolves into a micro-perimeter surrounding every workload and system component.

2. Modular Data Center Design for Security

Next-gen data centers increasingly use modular architectures - self-contained units that can be deployed or replaced rapidly. Security advantages include:

• Isolation by Design: Modular pods restrict the blast radius in case of a breach.

• Rapid Replacement: Compromised or degraded modules can be swapped without affecting the facility.

• Standardized Controls: Security is built into each module at manufacture, ensuring uniform and compliant protections.

3. Liquid Cooling with Security Implications

AI and high-density computing push cooling beyond traditional air systems. Two-phase immersion cooling - servers submerged in dielectric fluids - brings notable security tie-ins:

• Reduced Attack Surface: Immersion limits physical access, decreasing tampering risks.

• Energy & Thermal Monitoring: Cooling infrastructure becomes a security signal - abnormal patterns may indicate cryptojacking or hardware manipulation.

• Resilience at Scale: High-efficiency cooling allows denser compute consolidation, simplifying monitoring and strengthening defenses.

4. Confidential Computing and Custom Silicon

Data-in-use has become a prime target. Confidential computing technologies (AMD SEV, Intel TDX, ARM CCA, custom ASICs) encrypt memory and isolate workloads. Paired with modular designs, they create secure, tamper-evident enclaves inside the data center.

5. AI-Driven Defense and Self-Healing Infrastructure

• Autonomous Threat Response: AI agents analyze telemetry and contain lateral movement within seconds.

• Self-Healing Systems: Workloads shift automatically from suspect hardware to verified modules.

“Zero trust in the modern data center becomes an operational backbone, unifying cyber, physical and supply chain defenses.”

• Digital Twins: Virtual replicas simulate adversarial scenarios and stress-test both physical and logical defenses.

6. Sustainability as a Security Imperative

Modern data centers must also be environmentally resilient. Renewable-powered designs, advanced cooling and smartgrid integration expand the security perimeter into energy infrastructure. Compromise of power or cooling systems can cause cascading failures, making sustainability and cybersecurity inseparable.

7. Why Separating GPUs and CPUs Can Improve Security

As AI reshapes data center architectures, separating GPU and CPU clusters provides meaningful security advantages.

Isolation of High-Value Workloads

• GPU clusters often handle proprietary or highly sensitive AI/ ML datasets.

• Separation prevents lateral movement from compromised CPU workloads into GPU environments.

Reduced Attack Surface

• CPU and GPU environments have distinct firmware, drivers and API stacks.

• Separating them limits vulnerabilities from crossing stack boundaries and allows tailored patching cycles.

Enhanced Monitoring and Detection

• GPU workloads generate unique telemetry, enabling precise anomaly detection for cryptojacking or firmware tampering.

• CPU workloads follow different baselines, reducing SOC noise. Stronger Policy Enforcement.

• Different Zero Trust policies can be applied to GPU and CPU environments.

• Tight controls prevent leakage of sensitive AI models or training datasets.

Supply Chain & Firmware Security.

• GPU and CPU hardware have separate supply chains.

•Segregation reduces the blast radius of firmware or driver compromise.

Future-Proofing Against AI-Specific Threats

• Attacks such as model inversion and data poisoning primarily target GPU environments.

• Segregation ensures these threats don’t automatically extend across traditional enterprise workloads.

Trade-Offs

• Requires additional orchestration and monitoring.

• Increases networking and operational complexity.

• Dedicated GPU environments may increase cost if underutilized.

Bottom Line: Separating CPUs and GPUs is emerging as a best practice for Zero Trust enforcement, supply chain assurance and risk containment.

The Road Ahead

The next generation of secure data centers will feature:

• Edge-Hardened Modular Pods with built-in physical and cyber defenses

• Liquid-Cooled AI Clusters generating security telemetry

• Quantum-Safe Cryptography for long-term confidentiality

• Bio-Inspired Security Models that isolate, adapt and self-defend automatically

Conclusion

Modern data center security now extends far beyond firewalls. It requires modular, self-healing, energy-aware ecosystems where Zero Trust converges with engineering innovation. Organizations embracing modular design, liquid cooling, confidential computing and AI-driven defense will build resilient, future-proof digital fortresses for the decades ahead.