Re:Ask HN: What are the most paranoid security measures for ...
by mschuster91 on Tuesday April 23, 2013 @11:08AM
(#5595558)
Use servers with built-in batteries (they're rare!) to allow erasing of the RAM contents in case of power loss or intruder alerts (e.g. if malicious entities break into the data centers and cut the power, the disk encryption keys in the RAM can not be extracted by e.g. spraying the RAM with cool-spray to preserve the content.
Set up issue-alerts for events (like: email all admins when someone opens a rack or a server case to prevent rogue employees from unnoticedly manipulating hardware). If you host your own data center: strict multi-level biometric access controls, require the presence of minimum two or three people to enter the secure data center.
Give the "doorman" of the data center a remote "kill switch" for the servers (this also can be a PIN code for the doors), so that if the doorman is forced to give entry e.g. by being hold at gunpoint or by a judicial order, the servers can be disabled without anyone being able to prove it.
Record and store video and every other logs regarding datacenter access to assist in post-mortem analysis. Take care to have at least two, better three or four, dedicated power supplies for the DC, not including the diesel backup engine and the UPS systems covering the time between power outage and diesel kick-in. Same goes for the data uplinks (fiber interconnections to other DCs). Guide them through different paths in the building and make the fibers/powerlines exit the building on different sides to prevent accidental dig-up by construction workers.
Regularly have your datacenter inspected by firefighting department, building safety bodies and every other regulatory body. This provides certification for possible other customers of your data center, as well as preventing closure of the datacenter for violating obscure legal requirements.
Set up issue-alerts for events (like: email all admins when someone opens a rack or a server case to prevent rogue employees from unnoticedly manipulating hardware). If you host your own data center: strict multi-level biometric access controls, require the presence of minimum two or three people to enter the secure data center.
Give the "doorman" of the data center a remote "kill switch" for the servers (this also can be a PIN code for the doors), so that if the doorman is forced to give entry e.g. by being hold at gunpoint or by a judicial order, the servers can be disabled without anyone being able to prove it.
Record and store video and every other logs regarding datacenter access to assist in post-mortem analysis. Take care to have at least two, better three or four, dedicated power supplies for the DC, not including the diesel backup engine and the UPS systems covering the time between power outage and diesel kick-in. Same goes for the data uplinks (fiber interconnections to other DCs). Guide them through different paths in the building and make the fibers/powerlines exit the building on different sides to prevent accidental dig-up by construction workers.
Regularly have your datacenter inspected by firefighting department, building safety bodies and every other regulatory body. This provides certification for possible other customers of your data center, as well as preventing closure of the datacenter for violating obscure legal requirements.