SQL Clone
SQLServerCentral is supported by Redgate
Log in  ::  Register  ::  Not logged in

Security Basics: Physical Security

 In IT security, we spend so much time trying to protect servers and computers on the wire (or on wireless) that we look at OS patches, firewalls, anti-malware, etc., to protect our systems. We typically assume our physical security is sufficient. But the real question is: "Is it really?" I enter into evidence the following tale:

  Ministry of Defence Admits Losing An Entire Server

There's a couple of disconcerting facts that are in that article:

  • They cannot account for the server.
  • The server was in a secure building.
  • The personal data of 1.7 million people was lost in another breach.

We tend to take our physical security for granted and we shouldn't. It really doesn't matter what we do as DBAs and system administrators if someone can get physical access to our servers. And that's obviously what happened here. Someone had physical access to the server. So despite the fact that you have a secure government facility you still have a missing server. We'd expect such a location would be more secure than most data centers. Hopefully it turns out that server was misplaced and it wasn't actually stolen. But even with that as a possibility, the question comes up on how it was moved unknowingly. But this raises the question of how good is the physical security where our systems are?

We can say that it's good. We can point to controlled entry systems, cameras, physical locks on the racks, etc., but the truth is, until we put it to the test, we don't know. There are plenty of tales out there of pen test teams being hired and doing any of the following to gain access to the servers:

  • Pretending to be part of the cleaning crew.
  • Tailgating someone with access.
  • Walking right on in an open door and acting like they belonged.

And that's for environments that had all of these types of measures in place. They were there, but due diligence wasn't being maintained. And as a result, those pen test teams were able to get into the servers without so much as opening up a laptop. So if you haven't looked closely at your physical security lately, now is a good time to do so. If you have never hired knowledgeable people to come test your physical security, it should be considered. If you can't afford to hire out, get permission to do so and test it yourself. Pick a down time like a weekend or at night and see how far you can get before you get challenged. You may be unpleasantly surprised.


K. Brian Kelley - Databases, Infrastructure, and Security

IT Security, MySQL, Perl, SQL Server, and Windows technologies.


Posted by Steve Jones on 22 July 2009

Very good points. Most places I've worked have had good physical security infrastructure, but people don't like it. They allow tailgating, and they're hesitant to question someone like a delivery person.

Posted by TimothyAWiseman on 27 July 2009

You have an excellent point.  Aside from the loss of of the value of the hardware itself, most standard IT security can be bypassed by someone with unfettered access to the hardware.  Strong encryption is one exception, but sufficient time with access to the hardware will almost always let a skilled attacker get admin priveleges and that will immediately bypass most other security.

One point though is that the DBA in most organizations is normally not the one responsible for physical security.  They may pound the drum to remind management and the actual security people of its importance, but they can do little about it directly.

Leave a Comment

Please register or log in to leave a comment.