Cyber-attacks aimed directly at individuals or businesses are not the only way in which data breaches can occur. The data centres that store and transfer highly confidential data for countless businesses around the country, can also be targets for malicious activity.

In May of this year, for example, the University of York was hit by a serious data breach which saw the personal details of staff, students and supporters stolen, when cloud computing provider Blackbaud fell victim to a ransomware attack. Less obviously, however, data centres can also be vulnerable to break-ins and robberies.

As a result, in order to ensure data is as safe as possible, it is just as important that physical security measures are in place at data centres as it is for businesses to install robust cybersecurity processes.

Below are some of the main physical security threats faced by data centres today, and some advice outlining how these threats can successfully be overcome using a layered security approach that can help to disrupt and delay any potential attack.

Controlling vehicles access to the data centre

When it comes to data centre security it is vital to ensure that only authorised employees and vehicles have access to the area around the building, as well as the building itself. If the right impact-tested perimeter security measures are not in place, a vehicle may be able to break through any fencing or barriers and drive into the building with enough speed to cause significant damage, providing access to the information held within.

In order to prevent ram-raid attacks, data centres must restrict vehicle access with a thorough and layered approach to physical security. This should include a range of measures such as hostile vehicle mitigation (HVM) gates and bollards, as well as secure perimeter fencing.

At the first stage, perimeter fencing and gates provide the initial security layer to prevent unauthorised access. Fencing can have anti-climb features incorporated within its design such as mesh composition which not only prevents climbing but, aids visibility for CCTV systems and operatives.

Then, to prevent unauthorised vehicles from approaching the building, tested and certified bollards, road blockers or gates provide the next layer of defence. Depending on the circumstance, automated bollards can be operated by security personnel where they can be left in the raised position to immediately prevent access or can be lowered to allow an authorised vehicle to pass. If access is not granted, dynamic bollards, gates, or road blockers that use a ‘tiger-trap’ function can hold a car in place, where security personnel can carry out a stop-and-search process for any vehicle that tries to gain access.

Rethink how access to the data centre is allowed

After monitoring vehicle access at these sites, focusing on the internal access procedures into the data centre must also be a high priority.

If this is overlooked, data can be wrongfully taken should access be permitted. For example, in 2017 and 18, Iceland experienced its largest-ever crime spree, when around 600 bitcoin servers worth almost two million USD were stolen in four separate raids. Eleven people, including a security guard, were arrested in connection with the burglaries.

This shows the importance of installing thorough security at each ingress and egress point. Installing new access controls that make it extremely difficult for unauthorised individuals to get into the site can increase the amount of time that security operators have to react to a threat and reduce the consequent risk of damage.

Some of the options available include installing a simple visitor buzzer, followed by an inner door that can be used to grant access but also keep visitors separated from the general employee area. This allows for rigorous identification to take place and enables security operators to see who works for the data centre facility and who is an external, and potentially unwarranted, visitor.

After this, implementing a floor-to-ceiling turnstile door at each entrance point can reduce the chance of an individual tailgating behind an authenticated user. This can be supported by a ‘mantrap’ door that are separated by an ‘air lock’ where one door can only be opened once the first one is closed. If an unauthorised person does attempt to tailgate one of the data centre workers, these doors allow security operators to prevent the second door from being opened and they can then deal with the threat accordingly.

Ensuring that data centres are as physically secure as possible will help to protect against all potential damage, unwarranted access and even counts of terrorism. Whilst cybersecurity is often prioritised, and with much of the news focusing on successful cyber-attacks, a vast majority of businesses hold data in these physical sites. Therefore, ensuring a multi-layered physical security approach is installed, that accounts for both external and internal access, will help to minimise any data being wrongfully retrieved.