To be effective in securing your IT infrastructure, you need to be familiar with the various aspects of security in and around that infrastructure. So, if you’re hosting your infrastructure in a data center, you should be familiar with the kinds and levels of protection your data center operator provides its customers. In this post, we’ll tackle the different aspects of data center security. You’ll find the information useful if:
- You’ve recently been tasked to secure company data, applications, and servers hosted in a data center, and are looking for an introductory guide.
- You plan on leasing data center space from an operator and want to be familiar with the various aspects of security in this kind of facility.
- You just want to learn data center security and don’t know where to start.
If any of these profiles describe you, you’ve come to the right place. In this article, I’m going to give you an overview of data center security. You’ll learn what it is, who needs it, the threats that may affect it, relevant best practices, security tiers, and more. We’ve got a lot to cover, so let’s get this ball rolling.
First, let’s answer the question: What is data center security?
What is data center security
Data center security is the combination of controls intended to protect your data center assets from natural and man-made threats. Your data center assets can include physical assets like servers, storage devices, routers, and other network devices. It can also include software assets like operating systems, applications, and data.
Consequently, security in a data center also comes in physical and virtual or software form. Physical controls include surveillance cameras, security guards, data center cages, etc. Software controls, on the other hand, include firewalls, intrusion detection systems, encrypted protocols, etc. We’ll talk about all this and more later in this post. In the meantime, let’s identify who exactly needs data center security.
Who needs data center security?
Every person or organization that leases data center space will have assets in that data center that need to be secured. Do you process or store sensitive data in your data center? You need to keep that information confidential. Do you run business processes there? You’ll have to ensure the services that support those processes are always up and running. Do you conduct business transactions through your data center? If so, you need to preserve the integrity of those transactions at all times.
All of these scenarios require secure data centers. As long as the data and processes you host in your data center require confidentiality, integrity, and/or availability, you will need data center security. These three attributes—confidentiality, integrity, and availability—are always at risk of being compromised due to various threats. Let’s discuss some of those threats now.
Common Data Center Threats
Your data center is always exposed to various natural and man-made threats. In order for you to avoid or minimize the impact of these threats to your business, you have to be familiar with them first. Here are some of the most common threats to data centers worldwide.
Natural threats
Natural threats or natural hazards are threats due to events in the natural environment that can cause destruction. Here are some of them:
| Natural threat | Adverse impact on your data center | Possible impact on your business |
| Earthquake | High-magnitude earthquakes can cause your data center walls and ceiling to collapse on racks, servers, and network equipment. | Downtime, damage to physical assets, data loss |
| Tsunami | Elevated water levels can inundate servers, network equipment, power generators, etc. | Downtime, damage to physical assets, data loss |
| Wildfire | Intense heat can damage electronic parts. In extreme cases, parts of your data center can catch fire. | Downtime, damage to physical assets, data loss |
| Hurricane | Can cause flooding, which can in turn inundate servers, network equipment, power generators, etc. High humidity levels can also damage certain equipment. | Downtime, damage to physical assets, data loss |
Man-made threats
As the term implies, man-made threats are threats caused by human beings. They can be carried out deliberately by a malicious hacker or happen by accident due to carelessness. Some of the common man-made threats include the following. I’m adding a brief description in case you’re not familiar with a particular threat.
| Man-made threat | Brief description and adverse impact on your data center | Possible impact to your business |
| Denial of Service (DoS) attack | A network-based attack that can overwhelm your servers or network devices. This attack can cause your services to go offline or prohibit users from connecting. | Downtime, reputational damage, and financial loss |
| Man-in-the- middle (MITM) attack | A network-based attack designed to intercept and steal confidential data, usually login credentials, from a network session. Those login credentials can be used to break into your servers. | Data breach, regulatory fines, reputational damage, financial loss, data loss |
| Malware | A malicious software that can infect your servers. Malware can corrupt files, degrade network performance, or cause your servers to fail. | Downtime, reputational damage, financial loss, data loss |
| Ransomware | A specific type of malware that can lock up your files, servers, or your entire network and then display a ransom note. | Downtime, reputational damage, financial loss, data loss |
| Data theft | A deliberate act that can be as sophisticated as a remote hack or as crude as a malicious data center engineer walking off with one of your hard drives. | Data breach, regulatory fines, reputational damage, data loss |
| Sabotage or Terrorist attack | Deliberate acts intended to destroy parts of your data center. The threat actor can be an active shooter, a bomber, an arsonist, etc. | Downtime, financial loss, damage to assets, data loss |
| Accidental data breach | An unintentional act that leads to a data breach. This is usually caused by misconfigurations or a missent file. | Data breach, regulatory fines, reputational damage, data loss |
Alright, now that you’re familiar with the most common potential threats to your data center, it’s time to discuss how you can mitigate these threats.
How to Secure Your Data Center Assets
To mitigate the threats we identified earlier, you need to secure your data center in two areas. You need to secure the physical aspects and the software aspects of your data center.
Physical Data Center Security
Physical data center security refers to controls designed to protect your physical assets. Normally, it’s the duty of your data center operator to provide physical security. Why then do you have to know them? Well, you can add these controls as part of your criteria in choosing secure data centers. Here are some examples of physical data center security controls.
| Security Control | Description | How it secures your data center assets |
| Location | This is the location of your data center. | The location of your data center can help eliminate certain threats. For example, let’s say your data center is located inland, far from any vegetation. That means you can eliminate tsunamis and wildfires as potential threats. |
| Surveillance cameras | A network of cameras used for monitoring the data center’s premises. | Cameras serve as deterrents for acts of terrorism, arson, and physical theft against your physical assets |
| Security guards | People responsible for security in data center premises. They enforce your physical security policies. | Security guards serve as deterrents for acts of terrorism, arson sabotage, and physical theft against your physical assets. They can also respond if these acts are underway. |
| Multi-factor authentication for physical assets | A selection of authentication methods like biometric scans, PINs, IDs, badges, etc. | Helps ensure only people who are authorized to access your physical assets can gain physical access to those assets. |
| Cages | Metal enclosures that segregates servers, racks, and other devices owned by different customers | Prevents unauthorized access to your servers and other physical assets |
| Fire suppression system | A system designed to prevent fire from spreading | Prevents your assets from being destroyed by fire. |
| Seismic server racks | Racks that are specially designed to withstand earthquakes | Prevents your assets from getting damaged by an earthquake |
Software Data Center Security
Software data center security refers to controls designed to protect your software assets like your applications and data. Here are some examples of software data center security.
| Security Control | Description | How it secures yourdata center assets |
| Backup system | A system that allows you to creates copies of your data and then store them in another facility. | Ensures you still have copies of your data that you can use in the event your data center is incapacitated by an earthquake, tsunami, terrorist attack, etc. |
| Firewall | A security tool that controls the flow of traffic into your network. | Helps prevent undesirable network traffic from reaching your servers. |
| Intrusion Detection System | A system that detects potential intrusions in your network. | When used by trained security staff, an IDS can help you detect threats and prevent them from causing further harm. |
| Intrusion Prevention System | A system that prevents intrusions in your network | Automatically blocks potential threats from reaching your network or hosts. |
| Multi-factor authentication for software assets | A selection of authentication methods like passwords, one-time passwords (OTPs), PINs, private keys, etc. | Helps ensure only people who are authorized to access your software assets can gain remote network access to those assets. |
| Antimalware | A security solution that detects and acts on malware | Prevents malware from infecting your software assets. |
| Encrypted protocols | Network protocols like HTTPS, SFTP, and FTPS that prevent MITM attacks | Prevents malicious individuals from stealing confidential data from your network connections. |
The more valuable your assets are, the higher the level of data center security you’ll require. That said, is there a faster way of determining the level of security of a particular data center than scrutinizing its list of controls? Actually there is. They’re called data center tiers. Let’s talk about them now.
Data Center Security Tiers
Data center tiers are standardized classifications of data centers based on their degree of complexity. The higher its tier classification, the more complex a data center is. Higher tiers also equate to higher levels of security. That’s why data center tiers can also be known as data center security tiers. It goes without saying, higher tiered secure data centers are also more expensive. You should therefore take that into account when choosing a data center.
There are four (4) tiers all in all. Let’s go over each one.
Tier 1
This is a facility with single-capacity components. Single capacity is capacity that meets a computer or network equipment’s minimum requirements. This tier will suffice if you’re running a small business and your operation is only slightly dependent on security and uptime.
Tier 2
This is a facility that has redundant capacity components. Redundant capacity is capacity that goes beyond the minimum required for a particular computer or network equipment. So, for example, Tier 2 has backup systems for power and cooling. Tier 2 has better provisions for minimizing disruptions than Tier 1. You’ll want to consider going for a data center with this classification at the minimum if threats to security and uptime can significantly impact your business.
Tier 3
This type of data center also comes with redundant capacity components but has better provisions for minimizing disruptions than Tier 2. It’s built to withstand most natural threats. You should consider this class of data centers if you have stringent security and uptime requirements.
Tier 4
In addition to having redundant capacity components, Tier 4 data centers also have complete fault tolerance. This means it’s designed to continue operating without interruption even in really bad situations. If you can’t afford to suffer any amount of downtime and you have the financial resources to pay for it, a Tier 4 data center is right for you.
You can still do more to improve security in data center environments. Here are the top 3 data center security best practices that I recommend.
Top 3 Data Center Security Best Practices
These data center security best practices require additional effort from members of your organization. But it’s all worth it. They can go a long way in enhancing the security controls provided by your data center as well as the other controls mentioned earlier.
1. Have a disaster recovery plan in place
While backups are important, you need to have a disaster recovery plan (DRP) in place to make use of those backups. A DRP combines backups with other key elements like risk assessment, inventory of business-critical assets, testing, and others to enable you to get back into operation as quickly as you need to after a disaster.
2. Cultivate IT security awareness in your organization
Most threat actors will attempt to compromise your systems through the most vulnerable points. It’s in those points where they’ll encounter the lowest level of resistance. Since your weakest link is going to be your end users, you must increase IT security awareness throughout your organization. This will reduce the chances of users putting their guard down.
3. Beef up your network security
Chances are, many of your servers and applications are going to be reachable from the internet. Those servers and applications may also be connected to other hardware and software assets in your internal network. This makes your entire IT infrastructure susceptible to network-based threats or threats that enter and operate on networks. You can mitigate these threats by beefing up your network security. Strong network security can make it economically infeasible for a threat actor to attack your network or its components.
Before we end I’d like to share with you a couple of security software that can help you improve your data center security.
Putting it all together
Your data center assets need to be protected from natural and man-made threats that may compromise the confidentiality, integrity, and availability of those assets. This is the reason why you have data center security—the collection of physical and software controls that protect your assets from various threats.
Each data center is classified according to the level of security and uptime they provide. These classifications, ranging from the lowest to the highest levels of security, are Tier 1, Tier 2, Tier 3, and Tier 4. In choosing the right data center for your business, you need to match your security requirements with a data center that can meet those requirements. Data center tiers can help simplify that undertaking.
In addition to your existing controls, you can further enhance your data center security by applying certain best practices. This may include: developing a disaster recovery plan, cultivating IT security awareness, and beefing up your network security.