Re: Physical Security During Construction?

[Charlie Prothero <Charlie.Prothero () KEYSTONE EDU>]

UPS units and phone/voicemail cabinets make great workbenches, too, don't they!  We have a crew in our place now, 
installing a new AC unit.  I kept close watch on them for a while, but once it became obvious that they know how to 
behave in a data center, I backed off...

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Maloney, 
Michael
Sent: Thursday, August 27, 2009 9:24 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Physical Security During Construction?

We just went thru this last summer when our Halon system was changed
out.  Despite assurances from our facilities department and the GC doing
the work that they had experience working in a data centers, we elected
to keep a staff member in the NOC when they were present.

Which was a good call we felt after catching them standing on top of
server racks to gain access to the ceiling and using the metal computer
furniture as a ladder.


-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Michael J. Wheeler
Sent: Saturday, August 22, 2009 12:30 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Physical Security During Construction?

We will be undertaking a construction project in our datacenter. The
doors
to the data center are currently protected by PROX-locks.  Walls will be

built, new A/C system installed, as well as new electrical wiring.
Obviously, this will be a project that runs over a relatively long
period
of time -- especially with the requirement that we maintain operations
during the construction.

Has anyone gone through a similar project while keeping the data center
up
and running? How do you handle the physical security while construction
workers are coming in and out?

We had planned on issuing them PROX-cards that were only good during
business hours and making them swipe every time they came in. But, what
about while they are in there working? We do not have cameras in the
data
center, and I can't imagine having an FTE dedicated to sitting in there
and
'babysitting' them for the duration of the project.

Do you just intrinsically trust your contractors, their sub-contractors,

and sometimes their sub-contractors? General security practices say
"heck
no!", but I was wondering what others have done in this scenario.

--
Michael J. Wheeler
Assistant Director, Systems and Networking
Pittsburg State University
Phone:  620-235-4610
E-mail: mwheeler () pittstate edu