Security - Physical Security

Physical security

When we are setting up new equipment and our network, one of the first things we need to think about is physical security: how we are going to physically secure our equipment.

What we are concerned about is confidentiality, integrity and availability, although a lot of the aspects we are going to talk about here really have to do with availability, and making sure our systems remain up and running.

A threat agent is obviously one of our top concerns, so I do need to mention it, but I cover that much more in depth elsewhere.

Hardware threats

There are hardware threats to our equipment. Whether we accidentally drop a piece of equipment, or it gets hit by something, or perhaps it gets submerged in water because we have flooding in the data center, we need to be concerned about what that looks like. So we would do things like bring the equipment up off the ground, so that if there is flooding we are protecting that equipment.

Environmental threats

There are also environmental threats, things that can happen to the environment that would affect our equipment. Humidity is one of those. Our equipment does not like extremes with the humidity, so we need to keep it within a certain range. Same thing with temperature: you cannot have a temperature that is really hot or a temperature that is really cold, we need something in between. But just as important is some sort of consistency with that temperature. Equipment does not like our temperature going up and down, so we want to maintain consistency. Then we also have things like fire that can happen to our equipment and obviously damage the equipment.

Electrical threats

There are also electrical threats to our equipment. Things like power outages, which would obviously bring our equipment offline, so we need a plan for that, a plan for blackouts, which just means the utility company does not have the power coming into us, there is no power service.

Then sometimes there are spikes on the line, a sudden surge of electricity that can damage our equipment, and this often happens after a power outage, so that is another concern we have with our equipment, especially the more sensitive equipment.

What could be just as bad for equipment is insufficient power. We call this brownouts. If we have enough power to power some of our equipment but not all of our equipment, if we just cannot get enough power to it, then what will happen is that some of our equipment will start coming online and offline and will go up and down, and that can be very damaging to equipment.

Then there is also unconditioned power, or what we call noise on the line. Your power actually has a frequency, it is a wave, and noise on a wave would look like this, and that can cause problems with certain equipment as well, especially things like communication equipment.

Limiting physical access

So the question is, how do we protect our equipment? One way is by limiting the physical access to our equipment, especially things like network switches and hardware that we have running within our data center. We are going to want to make sure that is a very controlled environment and that we are only letting certain people into that environment. I get more in depth into access management in another module.

Asset tracking

We almost always want some sort of asset management techniques, and part of that may be asset tracking. Things like keeping an inventory of the assets that we have on hand. Perhaps we have some sort of GPS system that actually tracks that, so we can keep track of where our assets are going. Perhaps we have some sort of barcodes or QR codes that get scanned in and out when we are doing audits, or when they pass by certain checkpoints. Or things that can happen automatically with things like RFID, where they have a little RFID tag on there that can signal when things pass certain lines or go past certain checkpoints.

Hardware monitoring and alerting

It is important to know when things go askew, so we have things like monitoring and alerting that can help out with that. We have protocols such as Simple Network Management Protocol, which is a protocol that can help us manage and gain insight into what our network is doing. There are also event logs on specific pieces of equipment that will track what is happening on that piece of equipment. We have got a syslog server, syslog triggers, and ways to record syslog events, which takes some of the events that happen on our servers and records them so that we can go and monitor that and look at it later. We also have different sensors, things like temperature sensors and moisture sensors, that give us additional information about what is happening within our environment and within the different equipment that we have.

What is nice to have is something like a dashboard, which puts it all together so we have a visual representation of what is happening on our network and with our different pieces of equipment. It uses things like log aggregation, where it takes the event logs and brings them all into one spot, so it aggregates all those logs so that we can identify if things are going awry on our equipment and on our networks, and take action.

Of course, we turn this all into some sort of alerting that actually alerts us when things go off, maybe sends us an email or a text message, so that we can do some research and find out what is going on. Typically what I will do is have it send me an email if it is not urgent, or a text message if it is urgent.

Or you can have a full network operation center. If you have a NOC, this is when people are actually staffed looking at those dashboards, looking at those places on your network, and doing some investigation when things are a little bit off, so that they can notify you or bring you on board if something is happening. That is the NOC. You could have an internal NOC where you have people sitting there watching your network, or perhaps you can use a third party to help you do the network operation center.

Environmental controls

We would also want to put environmental controls into place, things like fire suppression systems. There are a lot of different types of fire suppression systems out there, so choose the right fire suppression system for what you have.

We also need to be concerned about the environment from a moisture and temperature standpoint, so making sure we have good heating, ventilation and air conditioning, which we call HVAC. If you have an underpowered HVAC it cannot maintain a certain temperature and you will have fluctuations, which causes damage to your equipment. So we need an HVAC system that is going to cover your needs for the size of data center or network closet that you have.

We also want to plan against electrical threats, so we have some sort of power redundancy, some sort of backup generator if we have a blackout, or some sort of uninterrupted power supply. This can help out if there is a blackout, and it can also condition the power so you do not have noise on your line causing interference with your equipment.

Asset disposal

We have to think about the full life cycle: the choosing and purchasing of equipment, the rolling out and hardening of the equipment, the maintenance of it, and also the asset disposal.

A lot of equipment does not necessarily have a hard drive on it that is going to have a bunch of data on it that we are concerned about, but even the configurations can be used by a threat agent. As an example, if we were to just throw the firewall that we have into the recycling, somebody could go onto that firewall and start looking at the configurations and gain information about your network and how to leverage vulnerabilities on your network.

So before we threw something away, before we disposed of it, before we threw it in recycling, before we got rid of it, we want to make sure that we wipe any configurations off of it. We would want to perform some sort of factory reset on it to make sure that everything is wiped, or some sort of device sanitization. Perhaps we even just crush it, or send it off to somebody that will dispose of it correctly, to make sure that it is disposed of correctly.

Wrapping up

There are a lot more threats than just a simple threat agent out there. There are hardware threats, there are environmental threats, and there are electrical threats, things that can damage our equipment or cause it to come offline and cause those availability issues. So we are going to want to put some sort of protection into place: things like access control, asset tracking, hardware monitoring, environmental controls and asset disposal, the things that are going to safeguard our pieces of equipment and our network.