Why the physical protection of data centers is as important as the rest of cyber security.

According to Cyber Security Ventures, “there will be a 12-15 percent increase in Cyber Security spending every year through 2021.”

The brain power being devoted to security at IT companies, the “Cloud,” and Data Centers is tremendous; and while cyber criminals continue to enjoy success with credit card fraud, ransomware, and other malicious breaches, the good guys seem to be turning the corner. Efforts to secure the world wide web and keep nation state and criminal actors from disrupting cyber operations seems to be on an upslope. However, what we obliquely call “The Cloud”, that place where it has become super cheap and efficient to store data, now has a home address. Everybody from Fortune 500 companies, the Intelligence Community, and stay-home moms have a place to keep their data and these places are competing for services. We know who these cloud services are, what they have (generally,) and often where they are located. This means the same efforts that have been devoted to protecting data in cyber space has to be directed to the physical locations where The Cloud resides. There must be a realization that full-scale physical security efforts need to be put in place at these data centers, that make them a center of physical security excellence, not an afterthought.

The security posture at a Data Center needs to be a lot more akin to a nuclear power plant or The White House than a used car lot. This is critical because Data Centers often hold the crown jewels of their client’s businesses. This security posture ideally starts with a secure perimeter that includes a set back between the fence or wall, and the actual data center(s) inside the fence. When practical, patrols should be established outside the perimeter and between the inside perimeter and the data center(s)themselves. The best security postures include all weather vehicles so the patrols are constant and fencing that sounds an alarm in the Security Operations Center (SOC) should the fence be cut or breached. An appropriate number of cameras should be along the fence line, or on the building looking toward the fence line (or both) and resolve back to the SOC with good resolution.

The second perimeter includes all entrances to Data Centers being adequately staffed by at least one officer per entrance. More than one is preferable depending on the amount of traffic related to employees, visitors and deliveries. Ideally, the technology at the gate allows officers to communicate via radio, cell phone or a visitor management system, back to the SOC. Up to date access control systems and badging needs to be in place for all employees and visitors. High levels of badge in-badge out security need to be in place including badge recordings of in and out, no piggy backing rules, and rapid investigations of alarms. The next inner ring of security is a realization that employee work areas, break rooms, etc. are treated much differently than the areas that hold servers. Employees may be able to carry cell phones, thumb drives and other tools around the common work areas, but these things, and almost everything else, should be strictly prohibited from the inner ring where servers reside.

The best security postures include separate security procedures at the entrances to the server work areas including magnetometers and wanding to insure nothing goes in or comes out. The officers manning these entrances have to be given additional training on these clean in –clean out procedures and should be among the best officers assigned to the data center. Other best practices for a robust security posture at Data Centers includes;-A security operations center that monitors all traffic, cameras, badging operations and dispatching procedures.

Ideally, officers assigned to the SOC, specialize in SOC operations are are among the most tech savvy of your officers.-Interior roving patrols to monitor common areas and insure there are no unauthorized personnel in areas they do not belong. Very aggressive inspection and red teaming regimes. These should include bringing in outsiders who are unknown to both the security officers and employees who work in the Data Center.-Close coordination between the company providing security services and Data Center security personnel.-Agreed upon metrics to measure security performance concerning response times to alarms, badging violations, red team response, investigations, etc.

Data Centers represent a new frontier in the security arena; they are an area where valuables, in some cases a businesses most valuable property, resides in a space that is vulnerable from both outside and inside the entity. Companies who play in this space need to take security extremely seriously and put strong physical security procedures in place to protect their customer’s important data.