The offline reality of protecting data

One of the most vulnerable aspects of any data center lies with its physical infrastructure, not just online content or digital tools. Commonly, managers tend to discuss the concept of securing stored information via digital means, which might include firewalls, real-time IP monitoring and even regular data backups.

These things are all extremely important, of that there is no question. The problem is that sometimes it’s all data center teams focus on. The thousands of large data breaches that occur each year warrant the attention, but physical security should be a major concern, too.

IT and security teams spend most of their time focused on remote attacks, when truthfully, one of the easiest ways to breach a system is through local access. In addition to an outside attack, an unplanned hardware failure can bring an entire network and operation to its knees.

Something like this happening is not unheard of, either. In early 2017, Amazon’s incredibly powerful S3 servers went down simply because of a typo one engineer made during debugging. As a result, several of Amazon’s web services were offline until the problem was fixed, bringing down popular platforms like Quora, Trello and IFTTT as well.

While the Amazon example isn’t exactly what you’d call a conventional security breach from unscrupulous parties or events, it does show just how easy it would be to take down cloud computing systems from the inside. Imagine if someone were to pose as an engineer or maintenance member, and then gain access to data center hardware. The damage they could cause could be irreparable.

Why physical security matters

A misconception about data centers and their hardware is that only the servers are vulnerable. However, the reality is that everything from power supplies to the heating and cooling systems that keep the center operational can be a potential access point. Attackers or threat actors don’t necessarily have to target the hardware. There are a wide variety of possible vulnerabilities, some of which may not even seem related to the regular operation of the data center.

For example, additional systems plugged into a network can pose a threat, and that includes everything from mobile phones to inventory management devices. A high-profile Target breach, for instance, involved its point-of-sale systems and happened because of a third-party HVAC vendor.

Barring the fact that no brand can truly manage third parties and how they handle security, it certainly highlights the need for reliable physical safety measures.

Data centers must ensure physical security is a top priority at least on keel with digital and remote methods. This means locking down hardware rooms and requiring specific authentication for access.

Regularly monitoring and restricting access to outlying systems, such as HVAC solutions and power distribution, is a must. In addition, all employees should be properly vetted — not just once, but continuously. A disgruntled or dismissed employee, for instance, should have all their access revoked immediately to prevent potential tampering.

To provide an example, rack power distribution units often employ remote monitoring tools and solutions. This helps data center administrators keep an eye on power requirements at all times, but also allows them to take action quickly if something goes awry.

However, local and remote solutions often have incredibly lax security systems. It would not be difficult to gain access to them or abuse existing access. If someone manages to get in when they’re not supposed to, they could wreak havoc on the entire operation just from a power distribution unit standpoint.

Beyond external attacks and security events, there’s also a need for general maintenance.

Keeping the data center clean

The physical enclosures, rooms and centers where servers are kept can get dirty like those in any home or office. Dust has a habit of building up in some spaces, thanks to a variety of elements like heat, static charges and more.

All data center locations should be cleaned regularly to help stave off damage, accelerated wear and tear, or unwanted events from unseen contaminants. Server and cleanroom review processes are necessary to prevent widespread contamination.

It may sound silly to worry about dust and dirt, especially considering the nature of most high-profile security breaches. However, that doesn’t change the fact that neglecting physical security can cause serious issues.

Believe it or not, the cleanliness and routine maintenance of the data center do play a role in its reliability. They certainly deserve to be a consideration in terms of maintaining security and optimal performance.

Protect data at all costs for peace of mind

When all is said and done, focusing on the physical security of any data center operation is just as important, if not more so, than digital and conventional security practices. Don’t neglect any of it, as the consequences could be disastrous.

Arrange a Conversation