Securing the Data Center and its Data
August 16, 2010

Appeared in Data Center Journal

By Paul Benne, PSP, CPOI, senior security specialist, and Jeffrey J. Kirchner, RCDD, associate partner, technology, Syska Hennessy Group, Inc., New York
Securing a data center involves more than just employing surveillance cameras and access control points. Instead, the complexity of the mission critical environment requires security to be implemented at multiple levels of the design process in order to identify and mitigate any number of risks. As a two-part, holistic process, data center security begins as early as site selection and penetrates the building all the way down to its electrical ports, creating a facility-wide, multi-disciplinary approach.

Part I includes a security risk assessment of the building and its environment, including potential threats and vulnerabilities, while Part II focuses on equipment protection and eliminates risks to the data center’s telecommunications infrastructure during operation. Together, the process should consider all potential impacts to the facility, allowing security to be woven into the data center’s design, further enhancing the building and its systems reliability.

Part I: Securing the Data Center’s Environment

Engaging the data center’s security consultant from the first stages of design will foster the desired holistic approach. Engaging with the owner, architect, engineer and other building team members from day one, the security consultant should work to implement both security best practices and applicable site-specific design criteria developed during the initial security risk assessment.  
The security risk assessment should first define the site’s potential threats and then evaluate how vulnerable the data center is to each one. Security threats include criminal, non-criminal or consequential threats. A criminal security threat could range from a terroristic act to burglary or arson, while a non-criminal threat could be a weather event or a behavioral act that defies the facility including a violation of company policy. A consequential threat is one that is created based on an association; like a data center located in close proximity to a neighboring fuel storage facility or a federal building.

Next, how vulnerable is the data center to these threats and what is their probability of occurrence? To find these answers the security consultant should meet with local law enforcement agencies and examine the FBI Uniform Crime Reports for the area, identifying crime trends and statistically forecasting the probability of future events. In addition, the current and planned architectural design is reviewed for physical vulnerabilities. At this point, industry best practices and local and federal security regulations as well as owner-specific security protocol should also be evaluated.
Together these threats, vulnerabilities and their probability of occurrence should result in the final security risk assessment report, defining a multi-disciplinary security design criteria for each of the project’s building team members, from the architect and the MEP engineers to the landscape designers and electronic security specialists.

Part II: Securing the Equipment

The principal asset of any data center is its network infrastructure. Unlike the environmental threats, network infrastructure risks come from within, including third party maintenance and repair service as well as unauthorized network accessibility and equipment connections.
Providing an internal level of security within the data center is the first way to mitigate any potential infrastructure risks. Potential solutions include determining the company’s communications needs and requirements, locking ports, monitoring intelligent patching systems and segregating equipment to control unauthorized traffic.
By defining the company’s security requirements for its IT network up front, both erroneous and intentional risks can be mitigated. For example, which personnel are authorized to access which networks? Do different organizations within the company function on different networks? Port lock ins or lock outs can be installed on the cabling infrastructure to allow only an authorized person to access certain areas of the network, while intelligent patching systems inform a network administrator of unscheduled or unauthorized network connections or disconnects, identifying breaches in security.

Another best practice is to isolate the data center’s IT-based surveillance system on a network separate from the one on which the corporate data resides. By segregating the security traffic, both networks will be protected while the speed and bandwidth on both will improve.

Next is to protect the data center’s internal assets from third party vendors by segregating the data center owner’s equipment from that of a third party. Cabling infrastructure entering into the data center from the outside should be buried in metallic conduit and encased in a concrete duct bank, ensuring protection from the elements and any third party vendors. To ensure redundancy and diversity, this cabling should enter the facility from two different directions. This way, the cable isn’t just protected physically, but also logically with a dual path. The same principal applies to pathways inside the data center facility itself, which should be enclosed in a cable tray to protect them both from third party maintenance and public pathways within the facility. When possible, it is best practice to install separate rooms or cages for service providers, affording them access to their equipment without contact with the larger data center and its equipment.

Using pre-terminated cabling throughout the data center is another way to reduce third party exposure to the network. Deploying a pre-terminated infrastructure from day one will enable internal data center maintenance personnel to maintain and add cabling to the network infrastructure as needed, reducing the overall reliance on a third party.

Much like the security risk assessment report of Part I, the total of these equipment and network best practices will translate into security requirements for each member of the building team. 

The nature of the mission critical environment and its uptime demands require holistic security design to be holistic, accounting for all potential risks and vulnerabilities from the data center’s exterior environment all the way down to its network infrastructure. The two-part process laid out here considers all potential impacts on the facility, allowing security to be woven into the data center’s design from day one, creating a more reliable mission critical environment overall.


Securing Existing Data Centers

Similar to new construction, existing data centers should survey their local environment and internal network for threats and vulnerabilities when developing a security risk assessment. Unlike new construction, however, implementing security changes in the existing data center will carry a higher price tag and can be more invasive.

One data center recently secured by Syska Hennessy Group had a neighboring loading dock that faced the data center. During the security risk assessment, it was discovered that vehicles leaving the loading dock would drive directly downhill toward the data center. Any out-of-control vehicle would impact the facility while a local gas main and meter piping are located just above ground on the same side of the building, increasing vulnerability. While the existing data center couldn’t be moved, Syska was able to specify some simple design elements including vehicular bollards and landscape stones to protect the data center from this risk.