Our web servers and databases are in an open room. Anyone can enter whenever they want. I find this insecure.
Should we lock the server room? What other security measures are needed?
How many people should have access? What about emergencies (fire)?
The server room should be a critical security zone. Only authorized personnel should enter — IT manager and technician.
Protocol: Keypad or card-locked door. Keep an access log. The fire exit (emergency) must remain open.
Temperature and humidity must be controlled (A/C system). Add a UPS (backup power) and a security camera.
we used to leave it open too but after we did some cable management we locked the room. much easier on the security side
Edit: asked below, I wrote the answer in the second message.
Server room security: 1. Locked door (keypad lock is enough) 2. Access log (who entered) 3. CCTV camera 4. A/C system 5. Exit sign (emergency)
A UPS (Uninterruptible Power Supply) and surge protector are mandatory in the server room. Servers need to keep running during power outages.
physical security is super important, don't leave the server room open then if everyone can get in, there's a risk of sabotage like cutting cables
Doki · Server maintenance contract · 2023
Steps: 1. Install keypad lock 2. Keep access log 3. Install CCTV 4. Add UPS 5. Find fire procedure
I completely agree. Trying to do this alone is the most expensive way.
An automated scan report is not the same as a penetration test. That's all, sorry if I went on too long.
Doki · Log management setup · 2023
I'll try it. An automated scan report is not the same as a penetration test.
I'm also curious if anyone does it differently.
I have no experience with server room so I'm asking. If the notification path is long notifications don't arrive; missing notifications mean delayed incident detection.
Correct me if I'm wrong.
There's one point I'm curious about. An automated scan report is not the same as a penetration test.
Proven by experience.
Three different views emerged, they all complement each other. Having backups accessible on the same network and with the same identity makes them part of the target.
I went through the same thing two years ago. The harder it is to reverse a decision, the slower you should make it.
Good luck with that.
Following. Forgotten test environments are more often the entry point than live systems.
The biggest time-waster for us was not knowing who had the final say. This is my opinion, I'm not claiming it's absolute truth.
I agree, and I'd like to emphasize that. Everyone rushing into server room gets stuck at the same point.
Proven by experience.
It's rare to find an explanation this clear. Everything goes well for the first three months; problems arise in the fourth.
That's all, sorry if I went on too long.