Physical Security in Mission Critical Facilities

Overview

The paper cites studies that people are directly responsible for 60% of data centre downtime through accidents and mistakes, so limiting who gets in matters even when malicious threats are low. The recommended first step is a security map rather than a product: site perimeter, building perimeter, computer area, computer rooms and equipment racks form concentric zones. Each inner zone also inherits the outer controls, and access rules are written by identity, purpose and need to know.

The map should include physical infrastructure areas such as HVAC, generator starting batteries and management consoles, not only IT spaces. Identification methods are grouped as what you have (cards, tokens), what you know (PINs) and who you are (biometrics), with reliability rising in that order. The example scheme uses swipe card plus PIN at building entry and keypad code plus biometric at the computer room. Proximity cards work within about 10 cm and vicinity cards up to about a metre.

Biometric thresholds trade false rejection against false acceptance: lowering one failure rate raises the other. Against piggybacking and tailgating the paper recommends mantraps, a one-person airlock between two doors, optionally with a footstep-detecting floor or overhead camera tracking. CCTV, guards, sensors and visitor handling complete the layer. An appendix lists building-design measures: the data centre room should not abut outside walls, openings wider than 12 inches get tamper-proof grills, doors are solid-core steel, concrete bollards keep vehicles back, and sites beneath or next to kitchens, parking or heavy traffic are avoided. The paper dates from 2011 and ties itself to no tier or standard level; it offers a method.

Key points

1. Studies cited show people directly cause 60% of data centre downtime through accidents and mistakes.
2. Depth of security: concentric zones from site perimeter to rack, each inheriting outer controls.
3. The security map covers HVAC, generator starting batteries and management consoles too.
4. Reliability order: what you have, what you know, who you are; example: building entry card + PIN, computer room keypad + biometric.
5. Proximity cards read within about 10 cm, vicinity cards up to about 1 m.
6. Biometric thresholds trade false rejection against false acceptance.
7. Mantraps address piggybacking and tailgating.
8. Openings wider than 12 inches (about 300 mm) get tamper-proof grills.

Using it in design

• Assign each room a security zone level and verify every path into the white space crosses zones in increasing order, with no direct door from a low zone to a much higher one.
• Warn if the data hall shares an exterior wall.
• Flag duct or vent openings over 12 in (about 300 mm) that lack security grilles.
• Place a mantrap at white-space entry for higher tiers and put generator, UPS and chiller rooms in a controlled zone.

Who should read it

Engineers laying out data-centre rooms and access control, and facility security owners.

Related standards

• ANSI/TIA-942
• EN 50600-2-5

Publication details

Authors

Suzanne Niles

Publisher

Schneider Electric

Year

2011

Document number

WP 82

Document language

English

Source type

Manufacturer

Access

Free to read

Licence

Copyright retained; citation only — the publisher’s terms apply to the original document

Citation