Data Centre Security Breaches - 3:1 It's An 'Inside Job'
Submitted by Simon Bond on Fri, 09/03/2007 - 18:47.
"Acts of theft, fraud and vandalism in the data centre are three times more likely to be an ‘inside job' than perpetrated by someone who's unconnected with the company or Centre," according to data centre specialists Migration Solutions. Speaking at the Data Centres Europe 2007 conference later this month, Managing Director Alex Rabbetts will be discussing internal security processes to safeguard the reputation of the industry.
"Data is personal, we're talking about people's private information and, often, their money," said Rabbetts. "Last year's data centre robberies in London were widely publicised *. However this kind of external breach is still relatively rare and the principal threat remains the enemy within." Migration Solutions says that in its experience around 65% of data centre security incidents are driven by malicious intent rather than economic gain - of these the top two categories of perpetrators are disgruntled current employees and disgruntled ex-employees.
Therefore physical security and logical security need to go hand in hand. Processes for managing staff access to the centre and to the data itself are as important to data centre integrity as reinforcing the doors and windows against a break in. "Emerging security standards like ISO27001 (BS7799 or ISO17799) are helping to establish process and an audit trail in the data centre, but we need to push these harder if they are to become normal practice in our industry," says Rabbetts. "The truth is that for many organisations the price of not having the correct security processes in terms of corporate reputation and regulatory obligations, under SoX and FSA, will be far heavier than a burglary could ever be."
*Level 3 falls victim to data centre robbery
Richard Thurston ZDNet UK, 02 Nov 2006 17:38 GMT Global telecoms carrier Level 3 has fallen victim to a robbery at its London data centre. A number of router cards were stolen in the robbery, which took place on Wednesday, and which severely disrupted voice and data services to businesses in the capital. The theft is the latest in a line of break-ins affecting communications companies. Last weekend a BT exchange in Birmingham was broken into, causing 35,000 lines to be cut off. And just 10 days earlier, thieves walked into fellow carrier Easynet's London data centre, and drove off with a van full of equipment. Easynet's data centre is located just yards from Level 3, which is at Braham Street, near Aldgate East tube station. Level 3 sent an email to some of its customers following the robbery. It said, "There was a security breach in our Braham Street gateway early this morning. A number of service-affecting cards were removed without authority from live equipment. This has resulted in the loss of IP and voice services to a number of customers at Braham Street." Level 3 has two data centres in London, the other around a mile away in Goswell Road. The link between the two was severed by the robbery, and many businesses lost connectivity thoroughly. According to one report, the thieves at Easynet used staff swipe cards to enter its Brick Lane data centre. Easynet, though, has insisted that a forced break-in took place and that the thieves did not use swipe cards to gain entry. IT professionals contacted by ZDNet UK questioned the security levels at the major London data centres, saying the identity of visitors is often not checked. Level 3 refused to comment on the break-in
