I work in higher education, and we have a server room with various server cabinets, mostly APC and Belkin. The room is secured via card swipe access, however each server rack has the same lock, which presents a problem as this room serves the college. I have searched high and low, and cannot seem to find a straight forward solution. There are a few racks we would like to ensure are secure only to our department, by changing out all of the locks on the server racks. What is the best, easiest, quickest, most cost effective way to go about this? They all have swing handled locks on the front and back of the rack doors, and a lock on each side panel. Thanks for you input!

  • 3
    The easiest thing to do would be to move your cabinets to a different room, under a different swipe card. However you have to consider your thread model; just about every 'hacker' type I know is also reasonably proficient at picking locks, and server cabinets have pretty terrible locks. – lynks Mar 28 '13 at 17:09
  • 4
    Easiest, quickest, most cost-efficient way is to call a locksmith and ask him to change the core of the lock. Last time I checked, they go under $10 each. – Adi Mar 28 '13 at 17:38
  • The answer to this will be different depending on what type of locks are installed on the server racks, and the manufacturer of the locks/racks. More detail will be needed to make this an answerable question. However, as @lynks points out, threat modeling is also important. Locks on the server cabinet are like picket fences - they keep the honest people honest, but do little against a determined and skilled attacker. – Iszi Mar 28 '13 at 17:39
  • 1
    Who currently has access to this room via swipe card and why do they have access? That is the first question I would be asking. – Wayne In Yak Mar 28 '13 at 18:50
  • 1
    Then, as @lynks said, I would definitely recommend moving them to a different room. I wouldn't want critical production servers anywhere near an area that college students have access to - "supervised" or otherwise. – Iszi Mar 28 '13 at 19:46

From a security standpoint, most locks are very easy to bypass. The design for Pin-tumbler locks date back to 4000 BC in Egypt. Although server locks are easy to purchase. I am not aware of a "high security" locks for servers.

The BEST approach is to limit access to the data center. If you cannot do that, then move sensitive servers to the cloud.

  • I spoke to my boss about having a locksmith change the locks, since we are in a Univ, clearly there is a locksmith available. We recently had rewiring down to allow cable access to a host for an election study, and that cost the department over $600.00. He is leaning towards replacing the locks simply at a hardware store and installing them ourselves. Our main servers are housed in our office where only we have access, but it's simply impractical w/ the amount of room/ips to host more in our central location. We may just take our chances. These servers aren't essential for dept function. – Maureen Mar 28 '13 at 22:52
  • Again, it is not that these hosts need massive security, it is to prevent any standbyers idling with our equipment. If you work in govmt or education, you know how hard it is to get something approved through the budget committee... this is simply to alleviate our worries that curious students would tamper with our racks in attempt to mirror their projects, but VM's for student courses are not as essential as our operations, and can always be restored w/ backups if need be. Maybe we'll buy a bicycle lock and wrap it around the rack :) – Maureen Mar 28 '13 at 22:56
  • 2
    Using the cloud for security just trades known security problems for ones the cloud provider doesn't tell you about... – cpt_fink Mar 29 '13 at 4:36
  • I would not put much faith in a PCI assessment. As a provider of services, that would not necessarily mean your app sitting on top is coded securely, etc. When hosting providers becomes have a ROC issued, it might not always cover all areas completely, it just a convenience to streamline some of the network stuff for when clients want to certify. I believe Amazon may have some type of SOC2 which they share with only their biggest clients. And yes, most universities have just learned about security never. – Eric G Mar 29 '13 at 4:53
  • I hate answers like these. I want to +1 for "limit access to the datacenter" but -1 for "move sensitive servers to the cloud". – Iszi Mar 29 '13 at 14:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.