Physical Security at Data Center: A survey
Objective of the Survey 1. To identify the current physical security in data centre. 2.To analyse the effectiveness of the current physical security in data centre. 3.To propose an effective hardware system of physical security for data centre.
Problem Statement To test and ensure on how far the current physical security can counter all the potential threats that the operation center will face such as a data breach and crime activity. To patch any vulnerabilities that may occur through current physical security.
Introduction This paper will present a survey to raise awareness of physical security issues in the data center environment of Cyber Defence Operation Center (CDOC), MINDEF. Cyber Defense Operation Center is a facility where enterprise information systems such as web sites, applications, databases, data centers and servers, networks, desktops and other endpoints are monitored, assessed, and defended. Cyber Defense Operation Center also is responsible for protecting networks, as well as web sites, applications, databases, servers and data centers, and other technologies.
Therefore, Cyber Defense Operation Center and the physical security operations center should be coordinate and work together. The physical system of Cyber Defense Operation Center is a facility in large organizations where security staff monitor and control security officers/guards, alarms, CCTV, physical access, lighting, vehicle barriers and other significant infrastructures.
Current Physical Security of Data Center Physical Strategy System Components Entrance & Exits Department Entrance Inside Data Center Stairs Corridors Outside Data Center Parking Lots Lightings Fencing Visible / Clear Pathway No Hidden Corner / Dead Areas Smoke Detector Fire Sprinkler Electronic Access Control Security Camera (CCTV) Fire Alarm Intrusion Detection Alarm Security Guard Patrolling
SURVEY: PARTICIPANTS OF SURVEY All participant was selected among of the CDOC officers which is the total of them is 10 personnel and having an ICT education background. Among them, there are only one officer is a Data Center Administrator, three officers are IT Managers and the other six officers are Cyber Operation Officers and have a technical background and skill in Computer Science, Computer Engineering and Information Security.
SURVEY: SURVEY QUESTIONS Section 1: Site Location Section 2: Site Perimeter Section 3: In Data Center Room Section 4: User Awareness
DISCUSSION AND RESULTS Man made risk is low and the data center buildings is located inside the military camp. Eventhough, the building is shared with other’s department office, they had maintain a well locked at all building’s entrance. Most of the staff did not aware that the building doesn’t have any fence. They assumed other department fence is including to operation center building. the current practice of duty officer task which is providing the security check between hrs every day. Thus, some of the employees may not aware that the right procedure of patrol and assuming that security check is one of the patrol activity. Patrol guard and duty officer have a different roles and responsibility and also different objectives.
DISCUSSION AND RESULTS Data center room is very small and not suitable to support and locate a lot of rack. It needs more space and bigger room. Most of the staff did not receive proper rules briefing Most of responder did not know all sensors inside the data center
Recommendation Due to sharing buildings issue, the organization should enhance enhance the security layout of restricted area to improve access control by using Access Control Barrier and Biometric Access Door CCTV Control room must be separated with tight security monitoring for suspicious activities monitoring because of the space in data center is very small and limited. Enforced Policy must be followed and understood by employee upon entry. All staff must be conversant and understand the security plan and procedures.
CONCLUSION Further enhancement on security should be performed to increase the security by upgrading the access control system and provide biometric access door. To plan and provide an effective security, organization should always implement broad range solutions based on the identification principles of what you have, what you know, and who you are. By combining an assessment of risk tolerance with an analysis of access requirements and available technologies, an effective security system can be designed to provide a realistic balance of protection and cost.