7 Steps to Secure Your Data Center

Data center security is evolving at a fast pace. The demand for comprehensive data center security solutions comes from ever-changing regulatory requirements, increased reliance on cloud computing, and an upward trend in sophisticated malicious attacks. In this post, learn about the types of cyberattacks you need to prevent your data center from. Then, follow the step-by-step approach to secure and protect your data center from the ground up. As you read, you’ll discover some tools to include in your security plan and see how critical your employees are to preventing and avoiding security breaches.

Common types of cyberattacks

Whether data centers hold your vast quantities of data or serve as the backend of your critical services, they’re a lucrative target for a variety of external attacks. Here are a few common types of attacks:

• Distributed denial of service (DDoS) attacks: Coordinate multiple computers to drain a data center’s server resources. They use a large volume of junk or crafted requests to keep the server occupied by handling bad data instead of responding to legitimate queries.
• Ransomware attacks: Deploy as soon as a hacker gains execution rights on a compromised server. The attack encrypts every accessible file on the system. Without data center backups, victims are forced to pay hackers a ransom to restore access to the files.
• External attacks: Target third-party services or tools, such as a DNS provider or cloud access security brokers that data centers might rely on. Here are a couple of examples:
  • NordVPN: The data center was compromised when their IT team installed a third-party remote access system. 
  • Dyn: When this former DNS provider (acquired by Oracle in 2016) was hacked, their DNS service failed, preventing access to several major corporations that used their services.
• Brute-force attacks: Gain a foothold within the data center through application dashboards or management panels. These attacks often happen when employees lack password security hygiene or they’re tricked by phishing techniques to provide access credentials.

At any moment, one of these attacks could take down your data center if it’s not well protected. The impact could cost your business in several ways, including operational disruption, loss of revenue, reputation, and stolen intellectual property. Keep reading to see what measures you must take to secure your data center.

7 Steps to Data Center Security

1. Secure the physical environment

The physical environment for your data center entails the location, underground, ground, building, and utilities that feed into it. 

a. Pick an optimal location

When constructing your own data center, pick a location with a clear historical record that shows the area is not prone to earthquakes, floods, fires, storms, or geopolitical intrigue. Also, stay clear of risky or dangerous locations such as chemical factories and electrical substations.

b. Establish redundancies

A data center is a power-hungry apparatus. Because electricity must flow reliably, your data center must have an alternative power source, such as an on-site generation (solar, wind, or diesel) and UPS battery packs. These alternatives are particularly necessary when the local utility provider is unable to supply the electricity you need. 

Based on the location, data centers may require a vast amount of water to cool their hardware. A redundant water supply source might be required to maintain operations when the water utility temporarily can’t supply services.

Finally, data centers require network connectivity. Investigate your options for redundant connectivity, server cabinets, and network routing. 

c. Raise your floor

Most data center designs use a raised floor. Having a raised floor makes wiring more accessible and reduces the heat load in the server room so you can maintain a more stable server.

d. Lockdown access and entry points

To simplify data center physical defenses and surveillance, limit access to your data center building to a single point of entry. Beyond “approved” access, consider other forms of physical access that a malicious actor might use to infiltrate the data center. For example, reinforce your data center’s walls against forced entry—such as from a sledgehammer or jackhammer—and any other entry points, such as the sewage system or roof.

e. Prepare for the worst

A natural disaster can devastate your data center, just as easily as a malicious actor or cyberattack. Here’s how you can prepare for the worst:

• Fire: The electronics in data centers generate a lot of heat and failing electronics can often lead to fires. To safeguard against the threat of fire, install an aspirating smoke detection system to alert personnel before a fire breaks out. Also install a double-interlock-zoned, dry-pipe sprinkler system to quickly extinguish fires while protecting the data center hardware.
• Water: Data centers often use water cooling solutions and water easily leaks when given the opportunity. Mitigate this danger by installing water leakage detector panels next to data center hardware.
• Pests: Rodents have an appetite for electrical wiring, and data centers are full of wires. Install a rodent repellent system, which is an electronic way to prevent pests from destroying servers and wiring.

2. Monitor, review, and restrict physical and remote access

Secure access is critical to your data center. To grant secure access, create multiple layers of protection that govern the level granted to each person.

a. Maintain vigilance

To safeguard the physical location of your data center, maintain continuous vigilance using closed-circuit TV (CCTV) and on-premises security personnel. Also, ensure network technicians are available around the clock to monitor network activity in real-time so you can quickly react to any virtual security issues.

b. Layer access

To defend against internal threats from an unruly employee or external threats from on-location visitors, grant layered access to each section, room, and equipment in the facility. Layered access ensures only personnel with the correct security level are granted access to a specific area of the data center, whether the perimeter, facility, server room, or cabinet.

Control physical access through multiple factors such as video content analytics (VCA) that are trained to detect suspicious behavior and tailgating. Also consider smart cards, facial recognition, biometric scans (fingerprint, iris scan, or vascular patterns), or any combination of these security measures. 

c. Secure remote access

The recent pandemic and increase in the global workforce have enabled many employees to work off-premises with virtual access. To ensure employee access remains secure even when used remotely, consider adopting cloud security solutions like service edge (SASE), extended detection and response (XDR), or Zero Trust networking technologies.

3. Train employees for security awareness

Malicious entities often employ phishing attacks and business email compromise attacks (BEC) to infiltrate an organization. Such attacks intend to trick employees into performing an action or series of actions to give hackers unauthorized access to your data center systems. Hackers also employ social phishing by using in-person and voice communication techniques to gain unauthorized access. The key to prevent employees from being tricked and minimize phishing attacks is to train, train, and train them some more by providing security awareness training. 

Osterman Research conducted an in-depth survey of organizations during May and June 2019 and found security awareness programs that don’t continuously challenge employees have little to no effect. This finding is not surprising because past studies have concluded that effective training works best through repetitive tasks that challenge a person. Security awareness training is no different. 

To effectively train your employees on security awareness, skip the long lectures and tiresome reading materials. Instead, provide Continuous Awareness Bites and analytics. This approach offers these advantages:

• It incorporates regular security awareness training and phishing simulations customized according to each person’s language, role, and experience. 
• The short bites of information engage employees in real-time right in their workflow. 
• It collects analytics so you can adjust, train, improve, and gauge your overall employee awareness training program. 
• The analytics collected from the bite-size training modules enable you to evaluate how security awareness evolves over time for each employee, team, department, and company. 
• The collected data also determines which employees are struggling to understand the information and require additional resources to learn it.

4. Secure your data and network

Securing your data center means you must also secure the data within it and the networks that lead in and out from it. 

a. Assume a Zero Trust posture

The Zero Trust security model assumes every piece of network traffic is potentially dangerous. Based on defined security policies, a Zero Trust network reduces the chance of a successful breach. When a breach occurs, the Zero Trust model mitigates some of the damage by using a smarter mechanism to limit access across the network.

b. Use the right tools and services

To protect your data center against most external attacks, make sure you have the right tools and services in place. These supports might include intrusion detection, firewalls, DDoS protection, or IP address monitoring. 

c. Review security policies

Govern access policies by roles within the data center. Over time, roles may shift and people might leave for other employment. To ensure access is available only to the personnel who require it, periodically review your access policy and revoke access as needed.

5. Update and maintain your data center

Updating the hardware and software that run your data center is essential to its security.

a. Update your hardware

Data centers commonly replace their server hardware every 2–6 years. The rationale is that new hardware improves performance. However, for data center security, new hardware can mitigate hardware-specific vulnerabilities that can lead to future exploits. Other than replacing hardware, keep up with security fixes that manufacturers release as firmware updates for their hardware.

b. Patch your software

Knowing hackers breached your organization by using a vulnerability that was patched months ago can be devastating. But, it happens repeatedly to major corporations that didn’t have the right safeguards in place to ensure their software infrastructure was patched with the latest security fixes. Update and patch your software as soon as you’re alerted that a new one is available.

6. Establish a data backup

Almost daily now, the news reports a new ransomware case that’s shut down corporations, services, and even hospitals. Ransomware attacks encrypt their victims’ files and extort money in return for decrypting the data. 

Run regular backups of your data center. Use strong controls on how backups are accessed. By keeping a backup with tight access controls, you can prevent a ransomware attack from turning a possibly organization-ending event into a manageable incident. To boost support for controlled access, conduct regular and frequent employee security awareness training.

7. Segment your network

Segment your data center network to limit the extent of a data breach, so it doesn’t affect the entire network. By taking this step, you gain time to secure the rest of your network. As an added benefit, you get stricter access control by segmenting your network.

Take the next step

Securing a data center requires extensive measures to monitor and protect it around the clock, both physically and virtually. Follow the steps in this post and invest in the recommended tools to avoid and minimize risk to your data center. Most importantly, invest in a security awareness training program backed by science and analytics to help you maintain a secure and stable environment.