I just ran across an interesting article on The Register that discussed a recent physical security breach and armed robbery of a Chicago-based co-location facility. This wouldn't have been so bad, but it was least the fourth forced intrusion in two years. The operator of the data center that was robbed, C I Host, lists the following security and access measures for the facility:
- 24x7 on-site technicians
- Multiple layers of 24x7 security cameras, proximity card readers, biometric
- access controls and key pads
- Double-locking mantraps at data center entrance
- 24x7 access to equipment area
- Non-customers enter equipment area by escort only
- All cabinets, cages, and suites have locking mechanisms; security upgrades are available
- Facilities are monitored with 24 hour DVR systems and 14 day video storage
- 360-degree perimeter and roof surveillance
- Physical audit trails on all entry points
- Anti-pass back and tail gating systems
- 24x7 break-in, smoke, heat and fire alarms monitored by police and fire departments for instant reaction
- No signage, nondescript building
I could understand a single forced entry, but not four or more at the same site. It does provide food for thought though. What kind of security measures have you implemented in your data center? Does it consist only of access to/from the data center, alarms and fire suppression? Have you considered installing surveillance cameras? APC does offer a line of in-rack security products to for access control and surveillance.
Fortunately I've only had one instance of some server components disappearing and that was when a consultant stole a large number of hot-spare drives out of the servers, but this wasn't noticed immediately because the thief was smart enough to put drive blanks in the empty space and removal of a the unused hot-spare wasn't noted in our logs. I suppose a DVR would have been useful and we were too trusting of our personnel.
Comment Preview