Protecting the facility and its systems.
WHAT PHYSICAL CONTROLS COVER
Perimeter, building, zone, hall and rack Access logging, in both directions Surveillance Escorting of visitors
WHAT LOGICAL CONTROLS COVER
Segmentation Filtering at every boundary Management network isolation Authentication and authorisation Logging and monitoring
WHAT TO SEPARATE ABSOLUTELY
Management from production Customer environments from each other Facility systems from customer systems
WHY THAT LAST POINT
Building management systems have been an entry route into networks.
WHAT TO RESTRICT MOST TIGHTLY
Administrative access to hypervisors, storage and management networks.
WHY
They provide access to every customer's data at once.
WHAT TO REQUIRE FOR THAT ACCESS
Individual accounts, never shared A second authentication factor Access through a controlled path Logging of every session
WHAT TO REVIEW
Who has that access, regularly.
WHAT TO DO WHEN SOMEONE LEAVES
Revoke immediately, and rotate anything they knew.
WHAT TO MONITOR
Administrative actions, and access outside normal hours.
WHAT TO PREPARE
A response procedure for suspected compromise of the management layer.
