Institut Tadbiran Awam Negara (INTAN)
Jabatan Perkhidmatan Awam (JPA)
National Institute of Public Administration
Public Service Department of Malaysia
Data Centre Security
& Control
Ashara Banu Mohamed
Perunding Latihan Kanan
Seksyen Perkhidmatan Operasi ICT
Kluster Inovasi Teknologi Pengurusan (i-IMATEC)
Objective
Introducing ICT security importance in
the Public Sector
ICT policies and standard in Data
Centre
Understand and implement different
types of control
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 2
Learning Outcome
Understanding the importance of ICT security in the
public sector
Understanding the role and responsibilities of civil
servants in aspects of ICT security
Identify the type of ICT security techniques and
methods of maintaining a secure data centre
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 3
Agenda
1 ICT Security
2 Data Centre
3 Data Centre Security : Procedures and Standards
4 Data Centre Security : Security Layer and Controls
5 Data Centre Security : Basic Principle For Data Centre
6 Data Centre Security : Physical Security in Data Centre
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 4
Security?
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 5
Definition: Security
• a state of being free from danger, threats
and risks
• a continuous process
• a periodical activity which has to be
schedule
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 6
ICT SECURITY CRITERIA
Confidentiality
Integrity
Availability
Authenticity
Accountability
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 7
YOUR ROLE
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 8
LAYERED SECURITY APPROACH
Hak Milik INTAN 9
Security is like an onions – it makes you cry
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 10
WHAT IS DATA CENTRE ?
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 11
DATA CENTRE IS
• A data centre (or datacentre) is a facility composed of
networked computers and storage that businesses or other
organizations use to organize, process, store and
disseminate large amounts of data.
• A business typically relies heavily upon the applications,
services and data contained within a data centre, making it a
focal point and critical asset for everyday operations.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 12
WHAT IS DATA CENTRE SECURITY ?
• Data centre security is the set of policies,
precautions and practices adopted
• It is to avoid unauthorized access and manipulation
of a data centre's resources.
• The data centre houses the enterprise applications
and data, hence why providing a proper security
system is critical.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 13
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 14
DATA CENTRE SECURITY
A. Procedures and Standards
Information Security Risk Assessment Guide
Security Standards, Policies & Systems
Common Data Centre Security Risk Signs
Security Audit Checklist
B. Security Layer and Controls
Physical (perimeter, building, data centre etc.)
Logical (network, servers etc.)
Administrative (people, process etc.)
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 15
A. Procedures and Standards
Information Security Risk Assessment Guide
Malaysian Public Sector Information Security
Risk-Assessment Guidelines
1. The Malaysian Public Sector Information Security High Level
Risk Assessment (HiLRA Guide)
2. The Malaysian Public Sector Information Security Risk
Assessment Methodology (MyRAM). Fully automated
http://www.mampu.gov.my/mampu/spa
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 16
Impact of the breach vs likelihood of the breach actually happening
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 17
A. Procedures and Standards
Security Standards, Policies & Systems
Requirements
Adopt ISO-27001 (replaces BS 7799 – Part 2)
Information Security Management System (ISMS)
Adopt ISO/IEC-27002 (replaces ISO-17799) Controls: Risk
Controls for Security Management Management and
BCM
BCC, Inc. Report GB-185R
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 18
A. Procedures and Standards
Security Standards, Policies & Systems
Policy : a course or principle of action adopted or proposed by a government, party, business or individual.
Security Policy
Aligns with business needs
security goals; and
defines how to implement them through processes and technologies.
An effective security policy results from collaboration among
all stakeholders in the Data centre,
various management teams,
executive board, and
user groups
The policy determines
security design,
management processes
technologies that enable policy to be implementation and
enforcement.
A security policy is not static; it should be refined and adjusted regularly
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 19
A. Procedures and Standards
Common Data Centre Security Risk Signs
Out-of-date physical wiring diagrams
Out-of-date logical equipment configuration diagrams and schematics
Infrequent testing of UPS
Failure to recharge UPS batteries
Failure to test generator and fuel levels
Lack of preventive maintenance on air conditioning equipment
Fire suppression system not recharged
Emergency power-off system not tested
Emergency power-off system not documented
Infrequent testing of backup generator system
Equipment not properly anchored
Evacuation procedures not clearly documented
Circumvention of physical security procedures
Lack of effective training for appropriate personnel
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 20
A. Procedures and Standards
Security Audit Checklist
• Facilities Security Audit Checklist
• Sample Internal Control Questionnaire
• Data Centre Review Program
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 21
Lesson Contents
A. Procedures and Standards
Information Security Risk Assessment Guide
Security Standards, Policies & Systems
Common Data centre Security Risk Signs
Security Audit Checklist
B. Security Layer and Controls
Physical (perimeter, building, data centre etc.)
Logical (network, servers etc.)
Administrative (people, process etc.)
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 22
B. Security Layer and Controls
Physical (perimeter, building, data centre etc.)
building security layers Data centre security layers
* Environment * Perimeter Security
Design
*Access Control * Facility Controls
* Intrusion * White Space
Detection Access
* Personnel * Cabinet
Identification
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 23
B. Security Layer and Controls
Physical (perimeter, building, data centre etc.)
Threats to physical security include:
Interruption of services
Theft
Physical damage
Unauthorized disclosure
Loss of system integrity
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 24
B. Security Layer and Controls
Physical (perimeter, building, data centre etc.)
Potential for damage or loss can be categorized into 7
categories of threats to objects, persons and intellectual
property:-
Temperature sunlight, freezing, fire & excessive heat
commercial vapors, humidity, dry air,
Gases suspended particles, smoke, cleaning fluid
Liquids water & chemicals
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 25
B. Security Layer and Controls
Physical (perimeter, building, data centre etc.)
7 categories of threats to objects, persons and intellectual
property:-
contamination from virus, bacteria,
Organisms people, animals
Projectiles falling objects, wind, explosions
Movement collapse, shearing, shaking, vibration,
Energy electric surges/failure, magnetism, static
anomalies electricity, radiation, sound, light
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 26
B. Security Layer and Controls
Physical (perimeter, building, data centre etc.)
(i) Prevention
To prevent unauthorized personnel from entering
computing facilities.
(i.e., locations housing computing resources,
supporting utilities, computer hard copy, and
input data media)
To help protect against natural disasters.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 27
B. Security Layer and Controls
Physical (perimeter, building, data centre etc.)
(i) Prevention
Examples:
• Backup files and documentation.
• Fences.
• Security guards.
• Badge systems.
• Double door systems.
• Locks and keys.
• Backup power.
• Biometric access controls.
• Site selection.
• Fire extinguishers.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 28
B. Security Layer and Controls
Physical (perimeter, building, data centre etc.)
(ii) Detection
Warn protective services personnel that physical security
measures are being violated.
Examples: Motion detectors
• Motion detectors.
• Smoke and fire detectors. VESDA
• Closed-circuit television monitors.
• Sensors and alarms.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 29
CAMERA NVR
DIGITAL DISK RECORDER
SECURITY MONITORING SCREEN
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 30
DDR/NVR
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 31
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 32
B. Security Layer and Controls
Physical (perimeter, building, Data Centre etc.)
Data Centre PHYSICAL SECURITY CHECKLIST
1. Data centre Physical Security Checklist
(SANS Institute)
2. SAS 70 Compliance Data centre Physical
Security Checklist – Best Practice
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 33
B. Security Layer and Controls
Physical (perimeter, building, Data Centre etc.)
What other things that we need to identify before setting
up a DC (
1. Site Location 2. Site Perimeter
a) Natural Disaster Risk a) Perimeter
b) Man made Disaster b) Surveillance
Risk c) Outside Windows &
c) Infrastructure Computer Room Placement
d) Sole purpose d) Access Points
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 34
B. Security Layer and Controls
Physical (perimeter, building, Data Centre etc.)
What other things that we need to identify before setting
up a DC (
3. Computer Rooms 4. Facilities
a) Access a) Cooling Towers
b) Infrastructure b) Power
c) Environment c) Trash
d) Fire Prevention d) Network Operation Centre
e) Shared Space (NOC)
5. Disaster Recovery 6. Ousiders
a) Disaster Recovery Plan a) Guards
b) Offsite Backup b) Cleaning Staff
c) Redundant Site c) Service Engineers
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 35
B. Security Layer and Controls
Physical (perimeter, building, Data Centre etc.)
What other things that we need to identify before setting
up a DC (
7. Users 8. Disaster Recovery (people)
a) Education a) Organizational Chart
b) Policy b) Job Function Documentation
c) Cross Training
d) Contact Information
e) Telecommuting
f) Disparate Locations
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 36
B. Security Layer and Controls
Logical (network, servers etc.)
Use software and data to monitor and control access to
information and computing systems.
(E.g. passwords, network and host based firewalls, network intrusion
detection systems, access control lists, and data encryption)
Level of access granted is limited to certain task that need
to be perform by an individual, program and systems.
Logical Security Best Practices
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 37
B. Security Layer and Controls
Logical (network, servers etc.)
(i) Prevention
to prevent unauthorized personnel or programs from
gaining remote access to computing resources.
Examples:
• Access control software.
• Antivirus software.
• Passwords.
• Smart cards.
• Encryption.
• Dial-up access control and callback systems.
• Authentication
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 38
B. Security Layer and Controls
Logical (network, servers etc.)
(ii) Detection
To warn personnel of attempted violations.
Examples:
• Audit trails
• Intrusion Detection Systems (IDS)
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 39
B. Security Layer and Controls
Administrative (people, process etc.)
Also called procedural controls
Consist of approved written policies, procedures,
standards and guidelines.
Form the framework for running the business and
managing people.
Inform people on how the business is to be run
and how day to day operations are to be conducted.
Laws and regulations created by government bodies
is also a type of administrative control
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 40
B. Security Layer and Controls
Administrative (people, process etc.)
Form the basis for the selection and implementation
of logical and physical controls.
Used to control individual behavior towards access
of facility, equipment, resources and information.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 41
B. Security Layer and Controls
Administrative (people, process etc.)
Insider
Poor Passwords.
Physical Security.
Insufficient Backup and Recovery.
Improper Destruction.
Social Media.
Social Engineering.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 42
B. Security Layer and Controls
Administrative (people, process etc.)
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 43
B. Security Layer and Controls
Administrative (people, process etc.)
(i) Prevention
Personnel-oriented techniques for controlling
people’s behavior to ensure the confidentiality,
integrity, and availability of computing data and
programs.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 44
B. Security Layer and Controls
Administrative (people, process etc.)
(i) Prevention
Examples:
• Security awareness and technical training.
• Separation of duties.
• Procedures for recruiting and terminating employees.
• Security policies and procedures.
• Supervision.
• Disaster recovery, contingency, and emergency plans.
• User registration for computer access.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 45
B. Security Layer and Controls
Administrative (people, process etc.)
(i) Detection
To determine how well security policies and
procedures are complied with, to detect fraud, and
to avoid employing persons that represent an
unacceptable security risk.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 46
B. Security Layer and Controls
Administrative (people, process etc.)
(i) Detection
Examples:
• Security reviews and audits.
• Performance evaluations.
• Required vacations.
• Background investigations.
• Rotation of duties.
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 47
BASIC PRINCIPLE FOR DATA CENTRE
• Low-key appearance
• Avoid windows
• Limit entry points
• Anti-passback and man-traps
• Hinges on the inside
• Plenty of cameras
• Make fire door exit only
• Permanent security staff
• Test. Test and test again
• Don’t forget the layers
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 48
Ways to Build Physical Security into a Data Centre
Build on the right spot.
Have redundant utilities
Pay attention to walls
Avoid windows
Use landscaping for protection
Keep a 100-foot buffer zone around the site
Use retractable crash barriers at vehicle entry
points
Plan for bomb detection
Site layout
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 49
Ways to Build Physical Security into a Data Centre (cont’d)
Limit entry points
Make fire doors exit only
Use plenty of cameras
Protect the building's machinery
Plan for secure air handling
Ensure nothing can hide in the walls and ceilings
Use two-factor authentication
Harden the core with security layers
Watch the exits too
Prohibit food in the computer rooms
Install visitor rest rooms
Hak Milik INTAN KURSUS PENGURUSAN PUSAT DATA : PENGOPERASIAN 50
NETWORK SECURITY WORST PRACTICE
Source: Gartner, Avoid these
“Dirty Dozen” Network Security
Worst Practices, by Andrew
Lerner, Jeremy D’Hoinne,
January 8, 2015.
Hak Milik INTAN 51
THANK YOU
Hak Milik INTAN 53
Hak Milik INTAN 54
Hak Milik INTAN 55
