Safeguarding The Servers

1. Safeguarding The Servers Dr. NatheerKhasawneh Sara Ismail

2. This chapter will cover • This chapter presents access control options for a Data Center and recommends standards of operations for people working in the room. • The chapter also provides best practices for equipment installations and suggested guidelines when touring visitors through a server environment.

3. Physical access restrictions • It is important to physically protect your environment from intentional theft or vandalism, from accidental damage by personnel not trained to work in a Data Center, and from unauthorized personnel obtaining sensitive information. • The most fundamental way of physically protecting the items housed in a Data Center is control over who can enter: • Door controls: • Data center doors might be equipped with sturdy locks. Keep a log of who has such access and prohibit copies of the keys from being made or the combination from being further distributed. • Most businesses choose a more automated approach known as: a card reader or badge access system. • There are even biometric security features that scan the shape of a person's hand or fingerprints or focus on their voice, facial features, or iris patterns. • It is also possible to install a revolving door mechanism that allows only one person to enter at a time, this prevents tailgating.

4. Physical access restrictions (cont….) 2. cages: Pros: • It is an easy way to provide a restrictive barrier within a server environment. • Fencing prevents unauthorized personnel from entering a given space. • It is cheaper to build and generates less of a mess during construction than a traditional wall. Cons: • A cage still enables people to look in and know that something of value is inside. • It attracts more curiosity than a regular room with walls. • A cage also can't protect what it doesn't surround. • A break in the conduit or cabling can cause downtime to equipment within a cage, no matter where the damage occurs.

5. Physical access restrictions (cont….) If you do cage in a portion of a Data Center, take the following precautions: • Extend cage walls below the raised floor and above the false ceiling. • Cover cage walls with a hard, opaque surface. • The more electrical conduits, structured cabling, and source equipment feeding them that are located outside of a cage, the easier it is for someone to cut, break, or shut down power and connectivity into the space. 3. Locking cabinets: • These locks come in several forms—key, combination, or even card reader. • The use of locking cabinets requires you to administrate their access controls as you do the controls for the Data Center itself. 4. Closed-Circuit Television Coverage: • can be installed to monitor and record who enters and leaves the Data Center, and point at the room's most important servers and networking devices. • You might install cameras under a raised floor to view the condition of infrastructure there.

6. Physical access restrictions (cont….) 5. Access Policies and Procedures: • Establish a Data Center access policy that defines who is allowed to enter the room and under what circumstances based on job classifications. • Apply policies that distinguish between long-term and short-term access. • Among the questions that should be addressed by your company's Data Center access policy are: • What job functions qualify someone to enter a Data Center? • How does an employee request Data Center access? • Is badge access provided for vendors, contractors, or other non-employees? • How is access granted during an emergency? • How often are access privileges reviewed and by whom? • What are the penalties for access violations?

7. “Do’s” • The point is that, as valuable as the rules are, it is more important that anyone entering the Data Center simply understands the sensitivity of what is inside the room and treats those items accordingly. Requiring people to have a certain minimum knowledge of the server environment and its rules can reduce downtime caused by user errors. • Implement Change Management: Change management is a method of planning, coordinating, and communicating about activities in and around a company's vital facilities—the Data Center, Network Room, areas that house primary and standby electrical infrastructure—that are vital for the business to remain operational and serve its customers. • Change defined: Change is an alteration of any Data Center element—an infrastructure component, a server application, power availability, or connectivity status—that might affect a client or hamper the ability of a company to provide its regular services.

8. “Do’s” (cont…) • Typical Data Center-related activities that do require a change request include: • Any event known to require downtime by servers or networking devices accessed by customers • Work on major electrical infrastructure supporting the Data Center, be it a power distribution unit, uninterruptible power source, or standby generator • Work on a Data Center air handler, chiller, or other cooling component • Any activity involving Data Center emergency power off controls • Work on infrastructure within the network room where Data Center connections terminate. • Change Request Essentials: Under change management, plans for upcoming activity in a Data Center are spelled out in a document called a change request. The requestor must explain the work that is to be done, justify why it needs to occur, provide specific start and end times, define what systems are to be affected, state potential risk by doing the work, and provide a plan to stop and return things to their prior condition in the event a problem occurs. Write change requests in plain language and include as much detail as possible.

9. “Do’s” (cont…) • Examples: • Change request for infrastructure maintenance. • Change request for a server repair. • Change Request for Minor Electrical Infrastructure Changes.

10. “Do’s” (cont…) • Example: Change request for a server repair. CHANGE TITLE: Replace faulty CPU on PRODSERV1 CHANGE REQUESTOR: Jane Systemadministrator NOTIFICATIONS: systemadministrators@company.com, clientgroup1@company.com CHANGE REQUEST ID#: 000002 START TIME: Tuesday, Aug-16-2005 14:00 STOP TIME: Tuesday, Aug-16-2005 16:00 HOSTS AFFECTED: PRODSERV1 APPLICATIONS AFFECTED: APP4, APP6, and APP8 DESCRIPTION OF ACTIVITY: PRODSERV1 has a faulty CPU that caused the machine to crash recently. We have arranged for the manufacturer to come out and replace the failed component. It will take about an hour to replace the CPU and boot the machine back up. Once this is done, we will confirm that the system is functioning normally. RISK ASSESSMENT: This work requires bringing PRODSERV1 offline, but no other hosts in the Data Center will be affected. BUSINESS BENEFIT: The new CPU will restore the server to its normal working condition and reliability. INSTALLATION IMPACT: The server will be off line while the CPU is replaced. Downtime for this event has been scheduled with the client group, so they are prepared to not have access to this machine and its applications for two hours. BACKOUT PLAN: If a replacement CPU is unavailable, this work will be postponed. NOTES: None.

11. “Do’s” (cont…) • When to Make Changes: • One approach is to conduct all work outside of traditional business hours. This has the advantage of eliminating intentional downtime during peak usage hours for customers. The main drawback of this approach is that it can significantly increase the labor costs for a project. Contractors for certain trades need to be paid time-and-a-half or even double-time to work late or weekend hours. If all Data Center activities are restricted to after business hours, company employees might also face long workdays during times of great activity. • The second approach is performance of Data Center work during the regular business day. If a company has customers around the world, there aren't really any off hours during which downtime is more palatable. This approach has the benefit that, if something unexpected occurs during the work, the company's normal personnel are at the site and able to respond immediately. Employees might be harder to reach after business hours, potentially lengthening downtime that occurs.

12. “Don'ts” • the things that they aren't supposed to do: • Don't Leave Trash in the Data Center: A clean Data Center can also reduce confusion and the loss of valuable items. Prohibit food and drink. • Don't Steal Items or Infrastructure:. No one should take data ports, electrical receptacles, and other tools without permission. • Don't String Cables Between Cabinets: • Stringing cables between cabinets unintentionally binds them together. If someone needs to relocate one cabinet, they are unlikely to know that devices from other cabinets are tethered to it. When they move the cabinet, they can easily yank the connecting lines free and cause unexpected downtime. If cables crisscross among multiple cabinets, this can affect dozens of servers in a row.

13. “Don'ts” (cont…) 2. If the cables that are strung to another cabinet are plugged in to the infrastructure at that second location, there is an additional danger of overloading the provided components. If the practice involves patch cords, the problem is simply one of occupying data ports that should be available. 3. Stringing cabling across cabinets leads to unanticipated vulnerabilities. • The best way to prevent Data Center users from stringing cables between cabinets: is to make sure that an adequate amount of electrical receptacles and data ports are provided at each cabinet location and that anyone working in the room is thoroughly educated as to what is available.

14. Good Installation Practices • A fundamental way to protect both the Data Center itself and the servers and networking devices it hosts is equipment installed deliberately and strategically. That is, reduce exposure to accidental downtime by following good installation practices. • Manage cabinet space: For example, If a server environment has limited floor space, servers should be installed as tightly as possible to maximize how many can fit in to cabinets. Finally, reserve space at the bottom of server cabinets for the largest devices. Putting the most weight at the bottom of a cabinet makes it more stable. This practice can also save a Data Center user's back, because it is easier to install or remove a bulky item that is closer to the ground than one that is at eye level or above.

15. Good Installation Practices(cont…) • Properly Use Rack Units: No matter how you want to install equipment into server cabinets you need to understand how the screw holes on a cabinet's vertical rails are configured. The screw holes on most server cabinets and Data Center devices follow a deliberate pattern, an Electronic Industries Alliance (EIA)standard that delineates rack units. A rack unit is the measurement of installable space within a server cabinet. Figure. Screw Hole Pattern on a Cabinet Mounting Rail

16. Good Installation Practices(cont…) • The Balance of Power: when you install multiple servers into a cabinet, don't plug all of their power cables into one power strip, Alternate between the two strips. When a server cabinet contains only servers with single power supplies, balancing power between its power strips reduces the number of devices that go off line in the event that a power strip, electrical receptacle, or power distribution unit fails. Only half of the servers can be affected when power cables alternate between power strips. • Route Cabling Neatly: Threading cables—both patch cords and power cables—so that they are well organized and carefully arranged eases troubleshooting. When plugging a server in to cabinet power strips, connect them to the power strip outlets that are at the same height as the device. Plugging cords in to outlets that are significantly higher or lower leads to tangled cables.

17. Good Installation Practices(cont…) • Label Thoroughly: is essential when equipment is inventoried and can greatly reduce the time it takes to find a machine's owner in the event of a problem.

18. Data Center Tours • customers or employees might be interested in touring your server environments. Whatever the reason and whoever the guests, follow a handful of guidelines when conducting Data Center tours: • Keep visitors together, preferably in main aisles— don’t allow people to wander throughout the room without supervision. • Don't touch. • Designate a demonstration area: If you consistently highlight certain Data Center features during a tour, consider creating a dedicated area to showcase these details. • Use tacky mats: The mats are meant to stop dirt from being tracked in.