Académique Documents
Professionnel Documents
Culture Documents
Previous screen
Gilbert Held
Payoff
The data center stores information necessary for the effective and efficient operation of the
entire organization. Loss of this data, conveyance of it to a competitor, or unauthorized
alteration of it can harm or even destroy the organization. Therefore, the data security
manager should employ data center security measures that do more than just protect
equipment. This article outlines such measures.
Problems Addressed
This article examines a core set of methods, procedures, equipment, and techniques to help
secure data center operations. No measures can completely secure these operations.
However, by appropriate planning and the implementation of methods, procedures, and
techniques to increase the level of security and security awareness within an organization,
the data security manager can minimize the number and severity of security breaches.
The data security manager must provide three types of security:
Physical security.
Personnel security.
Communications security.
To provide physical security, the data security manager must have the personnel,
equipment, and procedures necessary to bar unauthorized personnel from the data center.
To provide personnel security, the manager must ensure that the organization hires suitable
applicants and periodically reviews their eligibility for employment. To provide
communications security, the data security manager must enforce procedures and
techniques that control the use of communications equipment or line facilities to access the
organization's information systems. This article focuses on each of the three categories of
data center security and their components, as illustrated in Exhibit 1.
Building Access
In most organizations, building access is controlled. Personnel must pass a guard
station at the main entrance, where they show the guard the badge or other type of
Previous screen
identification to prove they are eligible to enter the building. In small organizations,
building access may be controlled by a badge reader, cipher lock, or simple door key.
Many, if not most, of an organization's visitors never require access to its data center,
nor do many of its employees, and many buildings house more than one firm's processing
or communications equipment. The data security managers of such organizations must
employ methods to limit access to their organizations' data center facilities.
Previous screen
Personnel Security
Although the use of some personnel security procedures, such as drug testing and lie
detectors, is determined by corporate policy, the data security manageror other IS
managerscan still implement a basic personnel security policy. To do so, the data
security manager should check job applicant references, possibly asking the corporate legal
department for a release form that applicants can sign to allow the organization to obtain
their transcripts, proof of college degrees, and other verification of attendance at schools.
One of the frequently overlooked aspects of personnel security is controlling contractor
personnel. Data security managers should exercise as much care in reviewing backgrounds
of full- or part-time contractors as they do for permanent employees.
Personnel Review
Once an employee or contractor passes an initial screening or investigation, most
organizations forget an important characteristic of lifethings rarely remain the same! An
employee's personal circumstances can change through marriage, divorce, bankruptcy, or
other factors (e.g., chemical dependence or another form of substance abuse). People who
were hired a few years ago might not be eligible for employment if an updated screening or
investigation were periodically performed. Therefore, a key to avoiding personnel
problems is periodically updating personnel investigations. Doing so alerts managers to the
need to refer employees to a counseling service or to the fact that an employee or contractor
has become a potential threat instead of a valuable resource.
Communications Security
Communications security involves the use of hardware, software, policies, and procedures
to control the use of communications facilities to access the organization's information
systems. Although passwords, which govern this type of access, are generally considered
the primary component of communications security, their use is only a small part of an
effective communications security effort. Other aspects of communications security that the
data security manager should consider include:
Packet filtering.
The manner in which telephone rotary numbers are ordered and changed.
Previous screen
Policies and procedures that govern the duration of unattended access to online
application programs.
Packet Filtering
The growth in the number of corporate connections to the Internet involves both an
opportunity and a threat. With access to a network of networks containing more than 25
million computers, an organization's employees can send electronic mail messages to users
throughout the world. Employees with Internet access can use theFile Transfer Protocol to
download files from tens of thousands of file transfer protocol (FTP) servers with
programs and data bases on a wide variety of topics. Employees can use Telnet to obtain a
remote connection to other computers on the Internet, and they can use such Internet
applications as Archie and Gopher to perform information searches.
However, Internet access is a two-way street, and Internet organizations that do not
implement packet filtering expose themselves to the good or bad intentions of millions of
Internet users. Exhibit 2 suggests some of the security exposures of a LAN connected to the
Internet. In this example, a bus-based Ethernet LAN links 50 workstation users to a
mainframe and, through a router, to an Internet service provider. Without implementing
packet filtering, the organization's data flow is bidirectional. Any person connected to the
Internet can try to access the organization's computational facilities on the Ethernet LAN,
including its mainframe and LAN workstations.
Previous screen
Because Internet applications occur on well-defined port numbers that represent logical
connections, an effective firewall filters by source and destination address, as well as by
port number. For example, if a data security manager wanted to permit bidirectional E-mail
by means of SMTP, he or she, because the SMTP application used port 25, would set the
following filter:
Action
allow
Inbound
yes
Outbound
yes
Port
25
A filter should be set to allow both inbound and outbound communications for an
Internet application because, with most firewalls, all that is not expressly permitted is
prohibited. Thus, if the manager does not specify the prior filter, most firewalls will
preclude E-mail in both directions.
If the data security manager wants to permit network users to use file transfer protocol
(FTP) to download files from servers on the Internet but preclude Internet users using file
transfer protocol (FTP) from accessing network facilities, he or she would establish the
following filters:
Action
allow
allow
Inbound
no
yes
Outbound
yes
no
Port
21
20
These filters permit network users making control file transfer protocol (FTP) requests
to access the Internet, but they accept only files transferred due to those requests as
inbound traffic.
Callback Modems
If an organization has a network that supports dial-in calls from terminals and
microcomputers, anyone who can access the switched telephone network can
intentionally or unintentionallydial a number that accesses the organization's computer.
To reduce this threat, the data security manager can install callback modems instead of
conventional modems at dial-in ports, which are connected to the communications
equipment that provides access to the network's information systems facilities.
A callback modem is programmed to contain a table of user names or user code and
corresponding telephone numbers. A dial-in user who calls a callback modem is initially
prompted to enter the user name or user code. The modem then displays a message
instructing the user to hang up and wait for a callback. The modem then disconnects and
dials the telephone number associated with the caller. The callback modem thus restricts
calls to those originating from known telephone numbers.
Unfortunately, a callback modem cannot be effectively used when an organization's
employees travel and must access the organization's central communications facilities from
numerous locations. In additon, the cost of the second telephone call constitutes the greater
part of the cost of billed communications. Charging these costs to the departments of those
employees who originated the long-distance calls is usually difficult.
Encryption Devices
Several communications vendors manufacture encryption devices that are compatible
with the National Institute of Standards and TechnologyData Encryption Standard
algorithm. Although the use of encryptors provides secure communications, the data
security manager must develop a policy to govern both the generation and distribution of
encryption keys. The policy should address the need to change these keys periodically.
However, unless the organization transfers funds or very critical information, the use of
Previous screen
encryptors may not be justified because of the cost of the equipment and the labor required
to change keys.
Author Biographies
Gilbert Held
Gilbert Held, an internationally known author and lecturer, is the author of more than
25 books and 200technical articles on computer systems and communications. He is the
director of 4-Degree Consulting in Macon GA.