Managed Security Service Providers

Physical Security Augments Logical Security

Many administrators devote a great deal of time to the software side of security while ignoring the fact that simple architectural tricks also play an important role in any basic security scheme.

by Drew Bird of CrossNodes, an EarthWeb site [September 25, 2001]

When we discuss security for our server systems, logical security measures tend to take precedence. Lets be honest; configuring a firewall to deter a seasoned hacker is a little more exciting than making sure the lock on the server room door is working properly. However, years of research and numerous statistics show that you are far more likely to lose data or suffer downtime as a result of the actions of an employee than an outside source.

That's not to say that firewalls and the like are not important—they are—it's simply vital to remember that such measures are only part of an overall security strategy. That security strategy should include physical security measures as well as logical ones. Physical security is about limiting access to equipment for the purposes of preventing tampering, theft, human error, and the subsequent downtime these actions bring.

In most environments, many of the basic physical security measures are already in place. Server and other associated equipment are placed in a separate room, away from the prying eyes and wandering fingers of overcurious staff. Backup tapes are commonly password protected, but do such password systems offer the protection your data warrants?

Extra protection
For an extra degree of protection, using encryption devices such as the aptly named Paranoia from Avax can ensure that if backup tapes fall into the wrong hands, the likelihood of unwanted eyes seeing your data is slim indeed. Security of backup tapes is an often-overlooked aspect of physical security, which is a shame. Organizations spend massive amounts of money creating a physically and logically secure network environment, and then send a backup tape that contains an entire copy of a server's data offsite with little or no protection. In many cases the loss of a tape serves as the wake up call, but often this is a case of closing the barn door after the horse has bolted.

Of course, as important as the security of offsite tape backups is, it must not distract us from the physical security of our equipment and data while it is onsite.

Inside the server room, server-specific racks allow equipment to be stored in a tidy and efficient manner; they also allow keyboards to be protected by a locked door. Most server rack locks are more of a discouragement than a preventative measure, but in many cases that is all that's needed. Network switches, routers, and other networking equipment should be similarly protected. The key consideration here is not theft or damage to equipment, but rather the downtime created by a borrowed power cable or the clumsy disconnection of a network cable.

If servers can't be secured by lockable racks they should be password protected. Some server and network administrators have objections to password-protected screensavers as they prefer to be able to see the server screens and any possible error messages. A safer and more efficient approach is to have remote monitoring and remote notification in place.

Removing keyboards and mice is also a reasonable option, though this can present a level of inconvenience that many server and network administrators are reluctant to explore.

Moving away from the security of individual equipment and looking at the server room as a whole, there are many more physical security factors to consider. For example, depending on your physical location and your degree of paranoia, windows should also get plenty of attention. If you server room is on the first floor, security bars are a must, as are blinds or reflective film to stop prying eyes. For a further degree of protection, consider using a film such as BurglarGard from ShatterGARD that can serve both purposes.

If your server room is higher up within the building, the chances of someone gaining entry are lessened, but windows should still be considered, particularly in settings such as a downtown tower block where people from other buildings may be able to look into the server room. How much information could be gained by 'peeping toms' may be debatable, but for the sake of a small investment in window blinds or reflective film it's not a risk worth taking. If another justification were needed for the use of blinds or reflective film, consider the benefits to cooling in the server room. Blocking the sun will stop the room heating up and allow air conditioning units to work less.

Ideally of course, server rooms will have no windows at all, but placement considerations don't always allow an internal room to be used, a point that has more of a bearing than just windows.

In the conclusion to this article, we look at server room placement within the physical plant.

Server Room Placement
An often-overlooked aspect of server room placement is the existence of an outside wall. If someone really wants your data that badly, and you have made it sufficiently difficult to get at it through the inside, another method of getting at your server and valuable data is to come through the wall.

Sound a bit extreme? Well it is, but it does happen. Its less of a problem in downtown districts, but in technology parks and warehouse environments, the veil of darkness, lack of people, and modern (cheap) construction methods make it possible to push a hole in the side of a building using a heavy truck or construction equipment, run in, grab the equipment and be off before someone has thought about what the noise was. If you think this method is a little far fetched, ask one of the organizations that's fallen foul of this kind of attack, which is known as a 'ram raid' for obvious reasons.

While unauthorized access may be easy to manage by careful server room placement and adequate security measures, authorized access brings its own challenges, such as when visiting contractors need access to the server room. In a utopian environment, it would be nice to think that the server room contained nothing but computer equipment, but the reality is there is likely to be telephone systems, wiring closets, air-conditioners, fire detection systems, and a host of other units, many of which will require outside contractors to maintain.

The ideal scenario is that when visitors are in the server room they are escorted and monitored by a member of the IT staff, but in many cases there simply isn't the time or manpower available to have someone standing in the server room chatting it up with an air condition maintenance guy. One approach that provides a cheap and relatively effective method of server room monitoring is the use of video surveillance cameras. Beware, though, there are many restrictions governing the use of closed circuit video cameras, and at the very least anyone entering the server room should be made aware of their existence.

Another approach, which is a security dream and a server administrator's worst nightmare, is a server room with glass walls. The upside is that personnel working in the serve room can be observed by anyone walking past. The downside is that the person being observed could be you. It's just the kind of extra pressure you need when attempting a tricky repair on a mission critical server. Imagine looking up from the server to see a selection of your workmates motioning encouragement, or something else, from the other side of the glass!

Whether or not you have the necessary measures and considerations taken care of, physical security must always be high on the server and network administrators priority list. Physical security is all about prevention rather than cure, and you know what they say about that.

—End