18

I have worked at a few hosting companies and seen two schools of thought on this

  1. Do not allow customers into the server room. The argument is basically it raises security (this news story is normally provided as a reason that security is only good if you know the people) and privacy and that if you provide a local terminal for them it is good enough.
  2. Allow customers into the server room because people need access to their machines and it makes a good show piece.

Is there any reasons (such as legal, compliance etc...) that you should not allow people into the server room?

13 Answers 13

13

Assuming that the hardware for each client is segregated in separate cages, etc. then I see no reason not to let people in to the server room. However for highly sensitive critical data, e.g. Banks, Police etc I would only ever what an extremely small number of qualified people in that room. When it comes to customers how do you know they are qualified and equally not malicious. Not worth the risk.

In these situations where the slightness downtime or loss of data would incur huge issues it is always safe to err on the side of caution.

23

enter image description here

says it all, really :)

5
  • 1
    Erh, it might if I could read it. Could you translate to English please, I don't posses the skill of multiple languages :-( May 6, 2009 at 12:54
  • 6
    that's part of the joke - it's not in real German! Just read the words as if they were in English and it'll start making sense ;-)
    – Alnitak
    May 6, 2009 at 14:17
  • 1
    And I'm pretty sure that's Swedish... Bork. Bork.
    – Even Mien
    May 6, 2009 at 19:43
  • I have that sign up in my little server room. It sure keeps them distracted while I get on with things. Aug 6, 2009 at 4:53
  • I've seen this on many occasions before, and only knowing what it says allows me to interpret it. The capital A's and small-case K's are particularly egrigious. Yes, I realize that this is written in proper German script (High German, perhaps?), which is the problem.
    – Ernie
    Dec 9, 2009 at 22:13
13

In my experience 75% of service/system outage is down to a 'layer 8'/wetware problem - people spilling drinks, pressing buttons they shouldn't, tripping over cables, even 'testing' RAID failover for no damn reason!

Keep people out, one way of doing this is to have a manual entry log with a 'reason for entry' field that they have to write themselves - that'll stop people without a good reason.

6
  • 11
    If your system went down because someone 'tested' the RAID failover, then doesn't that mean that the RAID wasn't really redundant at all and thus it was a good and valid test? Aug 6, 2009 at 2:23
  • 2
    Quite true. In fact we should all at some stage have performed exactly that test, preferably before the machine went live. +1 Aug 6, 2009 at 5:01
  • Depends if said person is technical and understands RAID levels. I've heard plenty of urban legends about middle management pulling more drives than logically permitted.
    – Dan Carley
    Aug 6, 2009 at 7:03
  • 2
    Of course you should test your RAID by pulling drives. You should however schedule a maintenance window for doing it on live systems. Just in case...
    – sleske
    Aug 6, 2009 at 8:27
  • 7
    A vendor was allowed into a machine room alone to service the (secondary) wet fire suppression system, which involves flushing pipes and other various plumbing tasks. First step: Bypass should be engaged, but under no circumstances should you trigger the charging circuit to effect the flush, because it will blow the ungodly huge fuse that cuts power to the server room before everything gets wet. Guess what the vendor did? All vendors must now have an escort. That's LITERALLY a wetware problem... Aug 7, 2009 at 4:23
7

Personally if I was host my equipment somewhere else, and they wouldn't let me in to work on it, I'd be pretty annoyed. I understand you need to keep your facility secure and letting anyone off the street in is a bad idea, but if I'm paying you to host my equipment, then I have a vested interest in the security of my system, I'm not going to do anything to compromise that.

There should be security, I should need ID or a password or iris scan to get into the DC, but stopping me all together would just make me take my business elsewhere.

6

Physical Access to a machine == opportunity to root the machine.

Do not allow anyone into the server room who you do not want to give access to the equipment on the machine. Or, have physical access (along with KVM or other local/console means) to the controls of the machine restricted if you are going to allow others physical access to the machine room.

The best practice in my mind is to either prevent access entirely to non-admins, to provide a security escort while someone's in the server room who is not authorized for global access (i.e. vendors), or to keep key-locked hardware in place and restrict keys to subsets of authorized users/admins. The last part is the best-practice for most colocation spaces where you as a customer will rent space.

Also: If you have the opportunity, make sure you have an "airlock" system that requires two forms of access, which prevents "tailgating". In our case, these are punch and card-scan locks. The entry into the foyer requires that you punch a code into a lock. Once you're in the foyer, you need to scan an ID card to enter the actual server room.

Beyond just "It's really a good idea", there's certain industry specific SAP's, laws, or regulations that might be involved. In an educational or government institution, I have specific laws I need to be sure are enforced in regards to access to student information. Similar requirements exist for companies who are publicly traded; they must comply with SOX. The medical industry, or any industry that handles associated identity information along with medical history, must follow HIPPA. Any company that stores credit card transactions must comply with their merchant agreements, which are usually VERY explicit about what the machines are allowed to store and who has access to the machines. Your industry's mileage may indeed vary.

2
  • +1: Security escorts are the obvious solution if you need to grant access, but not very frequently.
    – sleske
    Dec 16, 2009 at 9:33
  • It's probably better to require the ID card to get into the foyer, and only require the PIN to be typed in on the inside, where shoulder-surfing is harder Jun 6, 2010 at 16:26
5

Security has already been mentioned as a reason not to. Another is health and safety. DC's can be dangerous environments for the untrained. These can both be mitigated of course by policies such as "You must be accompanied by a trained member of staff for example. Our data center requires that staff are not given access unless they have done the appropriate course. And customers certainly are not allowed access unless accompanied.

2
  • 3
    If a data center is a dangerous environment that data center seriously needs to be redesigned. It should be a safer place than one's living room. Aug 6, 2009 at 5:02
  • 5
    The fire protection system is designed to remove all oxygen from the space, making it unviable for both fire and breathing. That's a major hazard all on its own, so in many such spaces you need to know how to get out alive if the fire alarm goes off. That's more than enough. Jan 24, 2010 at 12:39
5

I had a server coloc'd with a local data center that required an escort for access. Nothing like having a box down, having to stand around waiting for someone to become available so you can fix it. Then, that person gets to stand there bored, just watching. In that case, it was several hours. We do our servers in-house now...

2
  • +1 I have been there, done that. Never again!
    – KPWINC
    Aug 6, 2009 at 4:46
  • Well, if customers frequently need physical access, then installing cages probably makes sense. But at any rate, the conditions for physical access should have been part of the hosting contract, so you'd now the level of access possible.
    – sleske
    Dec 16, 2009 at 9:35
5

SAS70 Compliance if you are doing that or Sarbanes Oxley has a provision for IT Controls around Financial Systems.

5

Think about this: Does a bank allow its customers to go into the vault and deposit or withdraw money into/from their account? The answer is: Only if the account boxes are individually secured, and even then they may have a guard accompany you. But the best thing for high security scenarios would be that they bring out your box to you when you need it, which high security banks do.

1
  • 3
    Of course, security boxes don't have cables dangling from them... still, an interesting analogy.
    – sleske
    Dec 16, 2009 at 9:37
4

If the customers are accompanied by an authorized staff member, then that seems fine to me. I certainly wouldn't let a customer in the server room unattended. As for staff, stict controls should be enforced.

If you want to use the server room as a showpiece, then windows or glass walls are a great way to do that without walking countless people through a sensitive area.

0
4

Allowing customers access to their own kit seems like a fundamental 'right'. The colo's security should be observant and structured enough that rack-by-rack access by customers is safe.

If other customers feel they require more security, then they can go off and get their own cage or room.

2

To a very large extent it depends on just what sort of hosting you are providing. Some data centers will never need to allow visitors in, although it can be helpful to have windows through which the customers can see the hardware.

There are other data centers where customers absolutely must be allowed physical access. e.g. To restore from a tape using a local drive. This kind of access will be required if for example the facility offers disaster recovery/business continuity facilities. The customer's own premises may have been destroyed, so all functions are temporarily performed in the data center.

1
  • +1 for taking into account actual customer needs :-)
    – sleske
    Dec 16, 2009 at 9:36
1

Physical access to a machine is always the most critical part of security, and the one most often overlooked. Having escorted access should be fine, especially if you have logged access to the area. In a virtualized environment, physical access would not be an issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .