Physical protection of your servers?

Question

Here is a scenario.

You are a small startup company that makes a video game. In your video game, you can exchange money for items. You are not dealing with the credit card/debit card directly but instead outsource it to third party service.

Still, even if you are not dealing with the credit card/debit card directly, your database might contains thousands/millions of dollars in item from the game.

How do you protect that information?

My question is more related to the physical protection of your servers. For example, stopping someone from walking into your server room and tinkering with your data. Is it better to manage those servers yourself or use one of the popular cloud hosting solution? When using a cloud solution, you might wonder if the administrators are playing with your data.

Note : I know that big companies prefer to have their own dedicated servers in their own server room with security guards on watch 24/7 but it is probably not in the budget of that small company.

Answer 1

Ensuring good physical protection of your equipment is easy. Well, not "easy", but straightforward. Put the servers in a facility with a secure perimeter, multi-factor access control, security guards, intrusion-detection alarms, a whole bunch of security cameras that are constantly monitored, etc. But as you pointed out, the rub is whether you can actually afford to put those measures in place.

If you're a company that doesn't have the resources to do things like that (and, really, few companies do) and you are strongly concerned about physical security, going with a hosted or cloud solution from one of the big guys is (to me) definitely the answer. And, for myself, I would take some comfort in thinking about the huge number of big, big name tech companies--who could even afford to build high-security datacenters themselves, actually, if they wanted to--who go with that route. Heck, even the CIA is letting some (unclassified) stuff be managed by one of the big cloud providers.

That said, I certainly understand the impulse behind wanting to have your stuff hosted on your equipment that you directly operate in your facility. And, if physical security is important but not ultra-important, there are certainly plenty of access-control devices, security/alarm systems, etc. that can help make a small server space moderately secure at costs that are fairly affordable.

But even you're in the "moderate security is enough" category, you're still going to have to make the larger decision about starting to build your game on equipment you buy & manage vs. turning to the cloud. That's a more complicated decision that's going to involve many significant factors. Having physical security managed by someone else would certainly be one of them, though. (In favor of the self-service side or the cloud side you'll have to determine.)

Answer 2

You don't need your own server room to run your own server. There are companies offering "server housing" which means that you buy your own server and administer it on your own but they provice the space in the rack and the Internet connection. Many of these comanies implement physical security measures that can protect you data.

Additionally you should encrypt your Harddrives to prevent the exposure of your data in the case of a physical theft. This is relativly unlikely but there are open source tools that provide appropriate security for free so its not an expense factor.

To prevent the loss of your data you should schedule a daily backup of the data. You should store this backup on another server which in the best case is located in another building so a fire cant destroy both your productive server and your backup.

// Running your own servers does not necessarily cost that much money. The cloud can be cheap in the beginning but when your company grows there is most likely a point where using the cloud becomes a waste of money and thats just one downside. The most cloud services are made to fit the needs of the average company. So if your want to do somenthing special it often simply cant be provided by a cloud service. Also cloud services often compromise the integrity of your data by the terms of buissnes. In some countries like germany its even illegal to store some kind of data in the cloud if you can't assure that the comany is keeping your data inside the European Union.