Introduction: The continuous development of the data center industry, the rapid increase of massive data, while promoting the development of the digital economy and facilitating people's lives, data security has become an increasingly serious problem. Internally, not only network data security, but also physical data security needs to be taken seriously.
In 2013, US CIA staff Edward Snowden disclosed thousands of copies of the US National Security Agency's confidential documents, making it the world's headline news. No matter how people evaluate him, I am afraid that it will be classified as an intelligence thief. This is unquestionable.
However, the scary fact is that Snowden is not the only one who tries to take secrets away. People must learn this lesson to prevent similar incidents from happening again.
Since the beginning of the digital age, organizations have used firewalls, encryption, strong passwords, anti-virus software, white hat hacking and other tools and measures to defend against and attack cyber attackers. However, because more attention is paid to preventing cyber risks, sometimes it is forgotten that the important data of the organization faces the risk of being physically removed from within.
The data center contains a lot of valuable data, so it has become a particularly vulnerable target. Studies have shown that accidental loss of data and malicious unauthorized access in data centers account for 9% to 18% of total data breaches, causing more than $400 billion in global losses each year.
Given the continuing risks of data breaches, data center requirements for efficient physical security systems are critical.
With this in mind, there are four main risks to physical data security:
Risk 1: Internal threats
Organizational employees steal data from their workplace because I saw the opportunity to make a profit, whether it was for personal grievances or for the sale of this information. This can happen in private companies and government agencies. Don't forget that Snowden was a former employee of the National Security Agency.
Risk 2: External Threats
In addition to worrying about the leaks of their employees, businesses and government agencies need to be alert to threats from outsiders.
External threats may occur in the form of corporate espionage - hired to impersonate a legitimate employee or private contractor to obtain information; orOpportunistic thieves - Contractors working in sensitive areas saw and seized the opportunity. Either way, it can cause damage to sensitive data.
Risk 3: seemingly innocent personal items
There are two types of personal items that can be used to steal data: commercial off-the-shelf (COTS) and deliberately disguised items.
Commercial off-the-shelf (COTS) equipment includes SD cards, hard drives, tape recorders, and even cell phones/smartphones, any of which can be used to transmit audio, video, and computer data inside and outside buildings.
The deliberately disguised item may be a recording device that looks like a car keychain, or a USB flash drive hidden in the bottom of the coffee cup.
The difference between commercial off-the-shelf (COTS) and camouflage equipment is that if a commercial off-the-shelf (COTS) device is detected, the security department will identify it and confiscate it. The camouflaged device may not be recognized and anyone can bring it into the workplace, which is difficult to prevent.
Risk 4: Bad or illegal channels of sales data
Even for data centers with strict network security protocols, there are deficiencies in the personnel who actually screen data transmission and recording media. This is a huge mistake, and the consequences can be very serious.
A few years ago, it was much more difficult for ordinary people to know where to sell stolen data. Now with a dark network, anyone using the Tor browser can access their forums and get specific information from spy agencies.
The good news for organizations is that all these threats can be avoided with the right measures.
Combining physical risk with data security
Not long ago, the Building/Physical Security Department and the IT/Network Security Department were also considered to be two completely separate entities of the organization, usually not There will be too much communication and interaction. Data center managers today realize that they must take a holistic approach to protecting data security.
For security policies that protect sensitive confidential assets from attacks, organizations must consider physical data security and network security consistently.
One of the most effective means of using physical detection is the Ferromagnetic Detection System (FMDS). itIt is a non-intrusive measure that senses magnetic field interference in the Earth's magnetic field and detects anything with magnetic characteristics, including hard drives, cell phones, SD cards, and recording devices.
The Ferromagnetic Detection System (FMDS) is the most reliable method for detecting and finding small electronic products (and other metal objects such as weapons) and should be part of the "trust but verification" model, and in this mode In this way, organizations can allow internal employees and others to enter the building, but still need to take the necessary preventive and safety measures.