Re: Server Room Physical Security

["David L. Wasley" <david.wasley () UCOP EDU>]

I think you need to start by asking what you are protecting.  Is it your campus web server, or your central email 
server, or your paycheck printer?

I'm old enough to remember when, as a student, I could walk into the machine room and feed in my own card deck.  Then 
the student protests happened and they locked up The CPU room.

My last experience with a campus data centers was one where they had a swipe card entry system but no exit control.  
The operators propped open the back door so they could take a smoke break without having to come back thru the entry 
control.  When things began to disappear from the data center CPU room, there was no way to know who was in there at 
the time.

My current recommendation would be to have multi-tiered physical access control where the most sensitive systems are 
behind entry/exit control inside the less sensitive perimeter space.  Less sensitive systems might be behind "entry 
only" if that makes risk management sense.  In all cases, video surveillance is a good thing to cover cases which 
haven't been anticipated.

Also consider non-human incidents.  We had a 4" water main that fed the air conditioning system on the roof break 
inside the riser.  The machine room got several inches of water before it could be shut off, and of course the main 
systems had to be shut down as well.  The equipment in the riser, mostly network stuff, was soaked.  We subsequently 
put sloping "roofs" over it on each floor.

Don't neglect logical (v.s. physical) access control.  That's likely much more important overall.

        David Wasley
        UC (the one in California :-)
-----
At 9:31 AM -0400 on 5/29/03, Walsh, Brian R. (Information Services) wrote:

> Without giving away any secrets, can others share what type of physical
> security is being used at Colleges and Universities? I'm interested to know
> what safeguards are appropriate such as swipe card entry, video
> surveillance, alarms, etc. Thanks.
>
> Brian Walsh
> Connecticut College
>
> **********
> Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
> http://www.educause.edu/memdir/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/memdir/cg/.