DORA

Protecting Data Centers from Kinetic and Cyber Attacks: What Regulators Worldwide Are Proposing

InfoWatch experts have updated their April report on data center resilience, highlighting how physical and cyber threats now directly threaten business continuity and national security. Regulators in the United States, European Union, and Russia are treating data centers as strategic infrastructure requiring layered defenses that combine physical hardening, geographic distribution, and strict cybersecurity controls. The United States has launched the Cyberstrategy for America 2026 emphasizing offensive operations, Zero Trust modernization, and supply-chain restrictions. The European Union is implementing ProtectEU and the Cyber Solidarity Act with real-time threat sharing and mandatory resilience standards under DORA. Russia is advancing technological sovereignty targets, new siting rules for data centers, and Presidential Decree No. 604 that enables temporary state management of inadequately protected critical facilities. The report also notes growing recognition that attacks on data centers can constitute acts of aggression under the Tallinn Manual.

Implementing DevSecOps in Unprepared Teams: A Practical Three-Month Roadmap

Many development teams face resistance when security tools are introduced without proper process changes, leading to bypassed checks and unresolved findings. The article outlines a structured approach for small teams of five to eight developers without a dedicated security specialist, focusing on one service as a pilot. It emphasizes assigning clear roles including a Security Champion, selecting initial checks such as secret scanning with Gitleaks and dependency analysis, and converting scanner reports into actionable tasks with owners and deadlines. The plan covers the first eight weeks of setup, including baseline handling for legacy issues, automated blocking rules, and incident rehearsal exercises. Metrics recommended include time to first triage, age of open critical defects, and false positive rates, aligned with DORA indicators for release performance. The guidance draws on OWASP SAMM practices and stresses that security requirements must be integrated into daily workflows rather than added as extra gates.