Critical Facilities Summit

4  FM quick reads on Security

1. Networks Face External Threats


A data center's external campus is at risk for any number of security breaches, from inclement weather to burglary to maintenance mishaps. Protecting this vulnerable area is the first step in securing the mission critical environment.

Minimum requirements for safeguarding a data center's external infrastructure assets include creating redundant pathways and physically protecting the cabling within them. Most data centers with some level of reliability have dual path redundant cabling coming in from two different sources on separate parts of the mission critical site. Designed to create network redundancy, this technique also promotes information security and reliability at the exterior of the building.

Protecting the cabling within its pathways by building a concrete structure around the underground conduit from the perimeter of the facility to the end of the data center grounds will further protect the data pathways from external vulnerabilities, including third party maintenance and future site construction.

Beyond minimum requirements, the second tier of external risk mitigation includes monitoring maintenance holes, segregating the security system from the rest of the network, and providing a trained and educated support staff for IP-based surveillance systems.

Maintenance holes throughout the property should have proper surveillance coverage, with the intent being to eliminate infiltration. While the conduit below the data center grounds will be encased in concrete, the same conduit at certain locations in the pathway will be accessible through maintenance holes. Because these locations are physically accessible from the ground level, and therefore vulnerable, 24/7 video surveillance is recommended. In addition, similar to any portal in the data center, a mechanical sensor connected to the access control system should be installed at the maintenance hole cover in order to alert a security guard when the cover is removed or compromised.


2.  Immediate Responders Can Provide Swift Response to Crisis

This is Casey Laughman, managing editor of Building Operating Management. Today's tip is to set up a system of immediate response to a crisis.

Whether they are police, firefighters or emergency medical service personnel, first responders are the ones who arrive at a crisis scene to provide emergency assistance and protection. But as important as they are, first responders are not the first on the scene. Someone has to call them, and it will be several minutes or longer before they can reach the site. What's more, there are the rare horror stories of 911 dispatchers sending rescue units to the wrong address or responders taking an inordinate amount of time to arrive.

The question that facility managers have to face is this: Is it acceptable to wait for first responders to arrive, or should there be a plan for immediate response to a wide variety of emergencies?

More and more, that question is being answered with the recognition that immediate response and action are crucial to save lives.

For facility managers, that means developing a plan that empowers in-house personnel to make a conscious decision to do something, rather than waiting for someone else to tell them what to do or corroborate the need for action.

Facility managers should ask themselves: What other incidents occur that usually are over within the first three minutes before the first responders arrive? What they have in common is that a crisis occurs that has significant impact on the facility in a very quick timeframe with no build up or preparation. For example, in a bombing, police and firefighters would race to the scene and might soon arrive in overwhelming numbers. But the initial response would still depend on how close a roving patrol is to the site of the explosion. Until those first responders arrived, those on the scene would still be on their own for the first few minutes to assist victims.

3.  Be Ready When Security Questions Are Asked

I'm Casey Laughman, managing editor of Building Operating Management. Today's tip is to have a plan ready when asked about your security preparations.

If you are responsible for security, you know how difficult it is to justify funding for security measures — until a security breach happens. At that point, senior management gets involved and one question will be asked: "What do you need to prevent this from happening again?" This is your opportunity to make the most of a security event and obtain the resources you need to be proactive to help avoid future events. If you are not prepared with a solid answer, the opportunity may be lost.

It is always worthwhile to be prepared to explain what resources you need to address security risks. Even if a security breach doesn't occur, having information ready can help you justify needed measures. If an incident does happen, you probably won't have time to do all the homework required for a good security plan.

Having a plan is essential. The planning should adopt a holistic, all-security-risks approach. Although it may not be seen, the playbook needs to be well written as there is a chance senior management will ask to see it. If it is not available to be presented immediately, the implementation of the plan could be delayed.

Remember the old philosophical question, "If a tree falls in the woods and no one is there to hear it, does it make a sound?" It's much the same with security. How would anyone know that a security program is effective without an occurrence to test it? For instance, how do you show that the camera installed over the door acted as a deterrent to the person who was contemplating a violent act if the act did not occur? The answer is simple. You can't.

That is one reason why budget justifications are challenging for security. Compounding the problem is that security is a cost center and does not drive revenue. To top it off, security breaches are rare. It is easy for top executives to take security for granted, but complacency is a breeding ground for disaster.

4.  EMS Systems Need to Meet Today's Challenges

This is Casey Laughman, managing editor of Building Operating Management magazine. Today's tip is to understand that the emergency notification systems of the past may not be sufficient for your needs.

Emergency notification systems simply must work. When they don't, the results can be dire. To avoid unpleasant surprises, choose an emergency notification system that can cover as many different scenarios as possible.

To ensure success, messages have to be timely and intelligible. The systems need to be robust enough to work even during catastrophic events.

Today's approach to emergency planning recognizes that different situations call for different responses. But industry experts say that a uniform consensus over defining emergency notification hasn't been reached yet. National Fire Protection Association (NFPA) standards on which code might be based are still in development. Meanwhile, rapidly changing Internet Protocol (IP) communications are paving the way for new technologies.

Though the technology is still evolving, there are three general areas of development for emergency notification systems. They include Web-based telecommunications; public address systems that grew out of the military's "Giant Voice" program; and life-safety system circuitry based on NFPA standards.

The equipment used to communicate messages for these systems varies. Ethernet, wireless and cellular technologies, along with dedicated cabling systems and fiber optics, are among the options.

From there, emergency notification systems expand to offer many solutions: Strobe and siren systems and call boxes are still available, but today there are also smoke and heat sensors that trip emergency notification warnings, email dialers, Short Messaging System (SMS) dialers, LCD display screens, and many more.

What works best for any given organization depends on the systems already in place. With IP networks, organizations can often piggyback emergency notification systems on existing IP networks, which can reduce costs.


RELATED CONTENT:


Security , Data Centers



QUICK Sign-up - Membership Includes:

New Content and Magazine Article Updates
Educational Webcast Alerts
Building Products/Technology Notices
Complete Library of Reports, Webcasts, Salary and Exclusive Member Content



click here for more member info.