A third layer of physical security in a data centre is located after the reception/visitors area, but before the plant and computer rooms. It includes common and circulatory areas and we also include the introduction to the Security Operations Centre (SOC) as one of many Layer 4 areas accessed via this zone.
Layer 3 - Common and circulation areas and introduction to the Security Operations Centre (SOC)
The aim of physical security in this layer is to further qualify access through multiple forms of verification and monitoring methods, and a number of different security products and processes can be used to achieve this. These include:
Access Control
Access control for most datacentres will be automated and movements recorded on an electronic log. Various levels include:
- single-factor authentication – via a card or other ID token
- two-factor authentication – which requires additional verification through either a PIN or biometric details
- enforced automated access – additional solutions to prevent unregistered or unauthorised access or ‘piggybacking’
Biometrics are unique identifiers of human biology and characteristics that identify an individual. The most commonly used identifiers incorporated into security solutions include: fingerprint scanning; iris recognition; facial recognition; and voice recognition. Controls may be frictionless and contactless.
To enforce single access entry and avoid ‘piggybacking’ a security lock (also known as a mantrap portal, airlock, sally port or access control vestibule) can be used, which is a small space with two sets of interlocking doors, where the first set of doors must close before the second set opens.
Approved access may be given for particular areas/zones within the datacentre and can be restricted to particular time periods. Where datacentres are located in multi-level buildings (especially in cases of multi-occupancy) access should be restricted to the relevant floors and access to these can be controlled via designated lifts. Access control readers may also act as an early warning where refused entry has been issued, alerting the man-guarding team to investigate.
Video surveillance and monitoring
Video Surveillance and monitoring is at the heart of any integrated security programme and this is no less important in datacentres, from the perimeter fence through to individual racks and cages. For the common and circulatory layer video surveillance and monitoring works with access control devices, often with artificial intelligence to restrict access to authorised personnel only. Video systems continue to monitor individuals throughout their journey through the datacentre and we will be looking at this in more detail in a future blog.
PA Systems
PA systems, including voice messaging to keep datacentre occupants informed about important information, including what to do in an emergency and what proactive action needs to be taken in the event of a security breach.
Fire systems
Minimising the risk from smoke or fire damage is crucial in datacentre, therefore, fire systems need to be installed to ensure that personal safety is maintained, loss of assets (including data) minimised, and that the business can continue to run if a fire should occur. The level of protection (detection, alarms and suppression) required is determined by the type of internal space it covers in the data centre. For this inner layer, where there are no actual data racks, standards are akin to the highest conventional building regulations, consideration to Category L1 to BS5839 Part One, intended to give the earliest possible notification of a fire in order to allow maximum time for evacuation.
Security Operations Centre (SOC)
Accessed from the Circulatory Area, we find access to Layer 4 and some of the most critical areas in the datacentre. The SOC is the heart of data centre for physical security operations, with Command and Control to all of the security systems technologies adopted in the datacentre (CCTV, access control, visitor management system for example), in addition to management of the man-guarding/patrol and response teams deployed around the facility.
The SOC will manage pre-approvals for both vehicle and personnel access, with interaction to IT, Engineering, Facilities for compliance to Methods of Procedure, Rights of Way, but also identity verification.
The SOC may include cyber security where the information security team monitors, detects, analyses and responds to cybersecurity incidents, usually around the clock. The idea is to identify and thwart potential cyber security threats as quickly as possible, respond and plan so that similar occurrences do not occur in the future. The team will use a range of tools to undertake vulnerability analysis of both hardware and software and actively gather threat intelligence on known risks.
The security solutions to Layer 4 include access to Network Critical Physical Infrastructure and is commonly described as the white and grey space areas. The white space is generally the IT rack rooms, whilst the grey space is considered to be the plant and equipment rooms supporting the critical power, cooling and network equipment.
We will be considering the grey space in our next blog before we move in to Layers 5 and 6 in the white space of the rack areas.
Download our Datacentre brochure here to learn more about how G4S security services can support your business needs.