What would be a good way to guarantee security of theft and loss of sensitive data in a shared rack?

Question

Two of my servers are in a shared rack, we secure them by adding frontcovers to the machines.

The DC is always recording with a camera when one of the shared racks is opened and they write down what hardware goes in and out.

Are there any other factors we should take care of?

Answer 1

How have you assessed risk? I have seen datacentres ranging from

just a locked server room

to

stand alone unit with weight measuring man traps, dual keys, biometrics, time locks and remote video, as well as main and backup generators, fire suppression kit, water and air cooling

The first step is to calculate the value of your assets. How dependent is your business on the kit in that rack?

If losing it would destroy your business you need to think about mirroring it in an alternate location.

If the biggest risk to you is assessed to be from someone else in the datacentre then you do need to look at the physical security of the front and back of your servers, and check to see just what happens with those cameras. Does the data centre have a procedure to monitor the feed from the camera so they can check before letting individuals out?

Answer 2

What is your goal? What are you trying to accomplish? You want to know when someone has tampered with your system? What sort of assurances are you given at your co-location? Do you have continuous monitoring, good backups and logging enabled for these servers?

Through errors or malicious intent, I would make sure that you can recover these servers in the event of a total loss from scratch as part of your disaster recovery/incident response plan. Not just having something on paper, but practice it as best as you can.

Answer 3

It depends on how valuable the data is, to you and anyone else.

Family photos may be worth a lot to you, but nobody will want to steal that. The only benefit would be selling the hardware, and it seems like a lot of trouble to go through for just two servers.

If you store credit card data, and it's in any way known it's there, perhaps there are more measures you should take. Of course a disaster recovery plan, but perhaps also stuff like disk encryption. I think this should usually be enough:

1. Make sure basic security settings are right, like requiring a password when attaching a monitor and keyboard to the servers.
2. Encrypt the disks. Unfortunately this is not entirely safe, but it greatly increases the complexity of an attack.
3. Keep up to date, secure and off-site backups.
4. Have a server you can use in emergencies (assuming that you provide a service that is important to be online 24/7).

Besides this, I think there is basically little you can do without introducing much higher costs. But then again, it all depends on how much security you need.