FEATURE FEATURE

A Five-Layer View of Data Center

Systems Security

T
he data center is the central nervous inside data centers. Data centers are not like typical
system for any organization. As the hub workspaces that allow frequent access and casual
of servers that host business-critical data, visits. These first-level checks and controls are
the data center needs special attention. essential for data security.
There are some basic checks required for keeping IT
• Locking controls for server racks—It is necessary
systems safe in the data center. It is imperative for IT
to prohibit external device access to servers and
systems auditors and system maintenance teams to
guard against potential data leakage through
understand these checkpoints.
unauthorized cable connections. Locking controls
help prevent data theft and physical disruptions.
In addition to checking information security
practices and defensive mechanisms, it is equally • Checks for security breaches at the hardware
important to assess backup procedures and level—For remote monitoring of hardware, the
practices to strengthen the organization’s resilience usual practice is to connect base hardware to
following a security attack. The rule of thumb is
that information security audits should assess the
confidentiality, integrity and availability (CIA) triad.

There are five layers of data center systems security

(figure 1), and there are checks required in each of
the layers.

FIGURE 1
The Five Layers of Data Center
Systems Security
Physical
Logical
Network
Application
Information Security
R AV I S H A N K A R V E M U R I

The Physical Layer Is an IT infrastructure manager with ACT Fibernet, an India-based Internet
The perimeter layer meant for protecting the systems service provider. He has had multiple opportunities to implement state-of-
hosted inside the data center is the physical layer. the-art compute, storage and network systems. Vemuri has helped deploy
Practices of protection at the physical layer include highly efficient disaster recovery solutions and identity management
access controls for data center rooms, racks, servers and enterprise backup solutions for safeguarding critical data, managed
and entry processes. Protections also ensure checks for multiple operating system (OS) environments, and participated in complex
availability of data copies at different physical locations. application and storage migrations. Prior to ACT Fibernet, he worked in the
banking and telecom industries, primarily in IT and telecom infrastructure
• Data center physical access controls—It is management roles. In his 19 years of experience, Vemuri has managed
important to set up multifactor authentication diverse environments in IT infrastructure, IT development, telecom
(MFA) for accessing data centers and to maintain operations and project management roles.
surveillance controls at entry and exit points and

© 2022 ISACA. All rights reserved. www.isaca.org VOLUME 2 | 2022 ISACA JOURNAL 1
 generation defensive mechanisms to secure OS

“Because not much outgoing traffic is expected instances, and adoption of best practices and
processes related to the work OS footprint.
from the virtualization layer, Internet access can
• Virtualization layer security—This layer is easy
be restricted for the most part.” to handle. Version updates, port hardening and
Internet blocking usually require only a few services
running on top of the virtualization layer to control
the network. However, revalidation of the ingress traffic. Simple Network Management
connectivity requirements is necessary for Protocol (SNMP) and some limited specific
proper access control. services are required for monitoring. Therefore, it
is easy to implement restrictions on ingress loads.
• Firmware upgrades—Original equipment
Because not much outgoing traffic is expected
manufacturers (OEMs) are the best judges to
from the virtualization layer, Internet access can be
advise on firmware upgrades. Infrastructure teams
restricted for the most part. Organizations should
should take manufacturers’ recommendations
keep virtualization software updated to avoid
to upgrade firmware to safer and more stable
security bugs common in older versions.
versions.
• Regular patching and removal of old and
• Process checks for exiting employees—Removing
unsupported operating systems—As a security
physical access must be included in the exit
defense mechanism, patching is a nonnegotiable,
formalities for all employees leaving the organization.
regular operating activity for data center teams.
Human resources (HR) and IT teams must coordinate
For example, Microsoft releases security patches
to regularly reconcile the access list.
for Windows operating systems on the second
• Access to external agencies—Temporary access Tuesday of every month. Operations teams must
to hardware vendor support teams must be closed complete these patches in a timely manner, as they
immediately after the support ends. In the case of the fix all known bugs. Many leading OS manufacturers
cloud, there is a higher scope for such measures given sunset older versions and stop releasing security
the scale of operations and client audits. patches for them. Thus, organizations need to be
• Disaster recovery strategies, off site backup ready to move away from older OS versions. This
procedures and business continuity plans—Building requires advanced planning and execution.
resilience is important to counter disruptions such • OS installation—It is always better to start with
as earthquakes, fire accidents or other catastrophic safe installation practices. This approach helps to
events. Factors such as degree of criticality of data, avoid both vulnerabilities and downtime once the
recovery point objective/recovery time objective instance is put into production. Some of the key
(RPO/RTO) and regulatory compliance requirements practices are changing default security settings
are important elements of disaster recovery (DR) and passwords, avoiding unnecessary packages,
design strategies. These strategies should include secure shell (SSH) hardening, and server hardening
such considerations as location of the DR site, practices. The principle of least privileges should
scope of applications, size of hardware, bandwidth be adopted when providing user access. This
requirements between the data center and DR sites, means that only appropriate privileges are given
data replication methods, and frequency of DR to users based on the requirement. A casual and
failover/failback activities. The main focus here is on liberal approach to this process is not safe.
physical availability of a data copy in a cross-location
• Secured login through PAM tools, two-factor
site. In the case of a natural disaster, the goal is to be
authentication—Logical access controls primarily
adequately equipped to recover critical data.
help to counter brute-force attacks and guard
against unauthorized access. Privileged Access
Logical Layer
Management (PAM) tools are useful to establish
The logical layer refers to the operating system (OS)
single sign-on requirements, and they offer strong
environment. Protecting the logical layer addresses
password management features. These tools
security of the virtualization layer, optimization
make it easy to maintain access logs and help
of the OS footprint, use of traditional and next-
ensure audit compliance requirements.

© 2022 ISACA. All rights reserved. www.isaca.org

2 ISACA JOURNAL VOLUME 2 | 2022
• Password management practices—Though PAM threat if they are not secured properly. Up-to-date
tools help achieve best password management patches, antivirus updates and the use of data loss
practices, it may not be possible for all organizations prevention (DLP) tools need to be mandatory basic
to implement such tools for all instances. Still, checks for these systems.
every organization should define and implement a
• Untrusted software—The entire data center
password management policy comprised of best
environment will be at stake if untrusted software
practices such as password expiration settings and
is introduced to the system. Regular audits on all
complex password requirements.
systems must be mandated for identifying such
• OS configuration backups, snapshots—It is deviations. Defensive systems such as antivirus
safe to have snapshots enabled on critical legacy programs need to be fine tuned to detect
systems. In case of any negative incidents or untrusted software.
data inconsistency issues, it would be tedious to
recreate complex installations. Snapshots and
configuration backups can come in handy. “Usually a neglected area,
• OS footprint optimization—“Less luggage,
less risk” is a good principle when it comes to
restricting outbound traffic is
optimization of the OS footprint. Optimization as important as regulating
should be an ongoing process that is part of
regular operations. To achieve this, infrastructure inbound flow.”
teams need to work closely with application teams
to consolidate and reuse application processes.
This approach will not only mitigate risk related Network Layer
to OS and application vulnerabilities, but it also
The network layer comprises elements such as
lessens maintenance workloads. It also helps
switches, firewalls and routers. These critical
improve the utilization of hardware and
gateway elements must be properly configured to
software resources.
safeguard against attacks. Securing the network
• Process checks—Some process checks may seem layer requires placing restrictions on inbound and
obvious, but it is important to ensure that they are outbound traffic, optimizing network interfaces,
foolproof and automated. A typical example is applying microsegmentation, and using safe firewall
removing logical access for exit employees. configuration methods. LO O K I N G F O R
M O R E?
• Traditional defense mechanisms—Mechanisms
• Optimization of Internet access for OS
such as antivirus and antimalware protection for • Read Achieving
instances—Usually a neglected area, restricting
servers and patching of operating systems are Data Security and
outbound traffic is as important as regulating
nonnegotiable. Their use must be ensured 100 Compliance.
inbound flow. During a ransomware attack,
percent of the time on all relevant systems. Some www.isaca.org/
the attacker’s central command center tries to
built-in OS mechanisms, such as SELinux, can be data-security-and-
establish a connection with the attacked instance.
checked and implemented as appropriate. compliance-2020
Internet restrictions help to prevent this connection
• Next-generation defensive systems—New tools, and thwart further development of the attack. As a • Learn more about,
such as products from FireEye or Carbon Black rule, Internet restrictions need to be applied at the discuss and collaborate
by VMware, to counter advanced persistent firewall level for all the subnets. “Deny all” should on information and
threats (APT) are being created and organizations be the first policy, and then exceptions can be cybersecurity in
should consider implementing them. These tools applied on a case-by-case basis consistent with ISACA’s Online Forums.
are smarter when it comes to early detection the application requirements. https://engage.isaca.org/
of attacks based on unusual behaviors and onlineforums
• Removal of unused network interfaces—It is
pattern changes.
important to remove unused paths as a part of
• Special focus on endpoints of system regular operational activities. Continual changes
administrators—Laptops of system administrators and developments will render some network paths
require special focus. System administrators redundant. Regular audits and optimization of
regularly log in to servers for maintenance such paths are recommended. Examples of such
activities, and their machines pose a bigger cases include:

© 2022 ISACA. All rights reserved. www.isaca.org

VOLUME 2 | 2022 ISACA JOURNAL 3
 • Checking IPS signature updates on firewalls—
Due to network or support issues, firewalls
“Organizations need to ensure prompt renewal may stop getting intrusion prevention signature
of SSL certificates and change encryption (IPS) updates. Organizations need to implement
monitoring checks on this.
keys periodically.”
• Configuration backups of network elements—
Configurations of central elements such as
firewalls, load balancers and switches are critical,
– Network interfaces at virtualization and bare- and there should be a mechanism to extract these
metal OS levels backups to a place that network administrators can
– Unused but activated ports on network easily access.
switches, routers, firewalls and load balancers • Segregation of production and backup data—
– Redundant policies and routes on firewalls, It is important to guard against the spread
routers and load balancers of attacks from production environments to
backup instances. Based on business criteria,
• Denial of public IP assignment at the OS level—
organizations can resort to older backup
Avoid assigning public Internet Protocol (IP) at
methods (e.g., tapes and offsite backups), newer
the OS level as far as possible. Though there are
technologies such as airgap solutions or
firewall features at the OS level, network firewall
hybrid approaches.
appliances that are intended for this purpose
are better suited to protect at the central level.
Application Layer
Preference should be given to Network Address
Reviewing the processes at the application layer is
Translation (NAT) and proper restrictions should be
critical for safekeeping applications and database
applied at the firewall level. It is easier to manage
systems. At this layer, emphasis is placed on
these controls at central devices. There can be
secure methods for maintaining application and
exceptions, such as with Domain Name System
database instances, segregation of production and
(DNS) instances, that require applications with
test environments, use of robust data encryption
built-in advanced security features.
methods, and implementation of code and database
• Removal of VPN access for exit employees—A backup systems.
virtual private network (VPN) is the entry point for
sensitive internal networks. Controls at the VPN • Data encryption mechanisms— Encryption of
level are simple to apply and very effective. These data at rest and data in transit is critical to avoid
processes are nonnegotiable and must be carried data leakage. Applications and database systems
out religiously. should be designed to ensure compatibility with
the latest and most stable Secure Sockets Layer/
• Microsegmentation of networks—Though
Transport Layer Security (SSL/TLS) methods.
complete blocking of cyberattacks is the goal,
Organizations need to ensure prompt renewal
there would be some situations where just
of SSL certificates and change encryption
containing the spread is critical. Smart design and
keys periodically.
microsegmentation of data center networks helps.
• Defense mechanisms such as web application
• Conservative approach— “Deny all” first, and then
firewalls—Web application firewalls (WAF) add
“allow” only required traffic. This should be the
protection from layer seven attacks, including
mantra for firewall policy makers.
HTTP flooding and web security vulnerabilities
• Firmware upgrades on network equipment— such as Structured Query Language (SQL)
Central network elements, such as firewalls, are injection. Typical network perimeter firewalls are
critical devices; therefore, infrastructure teams not capable of dealing with such attacks; therefore,
typically hesitate to apply major changes to these additional security must be added through a
boxes. However, it is important to install firmware web application firewall (WAF). Because WAFs
upgrades promptly to avoid future downtimes and are a relatively new technology, their use adds
out-of-control situations. complexity to operations. Security teams need to
gain good understanding of this technology and

4 ISACA JOURNAL VOLUME 2 | 2022 © 2022 ISACA. All rights reserved. www.isaca.org
 ensure blocking mode is used for all critical public-
facing applications under WAF.
“The five-layer view covers all
• Safe coding and database installation practices—
It is always best to do things right in the initial aspects related to the security
stages of application building. of data center systems and it
• Application code backups and database backup
procedures—Keeping at least two backups is
consolidates them all into one
recommended (one in the same location and one comprehensive guide.”
cross-location copy).

• Segregation of production, development

and testing environments—Segregation is
important primarily to ensure that the production Information Security Layer
environments are secured. A similar concept to Security checks on the physical, logical, network
microsegmentation, this helps avoid the spread of and application layers are mostly managed by
attacks from test setups to production setups. Test system administrators and application development
setups are more vulnerable given the high scope of teams. Further governance checks come under the
experimentation there. responsibility of information security teams. These
• Restrictions on production environments— responsibilities include:
Access restrictions are required to avoid negative
• Reviewing cyberthreat intelligence systems and
impacts on production environments. In the case
operations of the organization’s security operations
of smaller organizations, if it is not possible to have
center (SOC)
segregated teams, segregation of networks will
help prevent mistakes. • Reviewing defense mechanism tools such as
firewalls, antivirus and WAFs
• Process of log capturing for critical application and
database changes—Easy tracking of changes and • Reviewing information security operations,
quick turnarounds are helpful in case any issues arise including vulnerability assessment and penetration
due to changes in production environments. testing (VAPT) activities and external and
internal audits
• Password management of application and
database users—Best password management • Checking the information security awareness
practices should be followed in application and quotient of the organization (i.e., reviewing
database management, similarly to OS user cybersecurity awareness programs, providing
password management. information security training to system admins)

• Secured connectivity for interapplication • Checking standard operating procedures, change

dependencies—Infrastructure teams should take management procedures and documentation
all the necessary information from application
• Reviewing the IT security policy
and database teams and ensure that only required
ports are opened for interapplication and • Checking data privacy terms and conditions in
database connections. nondisclosure agreements (NDAs) with
vendor partners
• Consolidation of database instances and
reduction of database footprint—The “less • Reviewing agreements with employees to
luggage, less risk” principle also applies in strengthen the privacy of the organization’s
database consolidation and footprint reduction, sensitive data
similarly to the OS footprint. • Providing a 360-degree view of the robustness
• Special focus on public-facing applications— of the information security of the organization,
Public-facing applications are inherently more including internal controls, system robustness,
vulnerable to attacks. More focus and security controls on partners, risk from customers and
are necessary for web, mobile and third-party additional controls for cloud hosting
applications because there is less control
over them.

© 2022 ISACA. All rights reserved. www.isaca.org VOLUME 2 | 2022 ISACA JOURNAL 5
 Conclusion At the application level, the focus is two-fold: how
to secure applications from attacks and how to
Basic checks are required for keeping IT systems
secure business-critical data. At the information
safe in a data center. These checks can be viewed
security layer, critical governance checks should be
from five different perspectives: physical, logical,
undertaken by information security teams.
network, application and information security.

The five-layer view covers all aspects related

At the physical level, the focus should primarily be
to the security of data center systems and it
on process controls rather than technical aspects.
consolidates them all into one comprehensive guide,
At the logical level, the focus should be on security
making it easier for practitioners to implement
of operating systems. At the network level, the focus
effective security.
should primarily be to optimize and secure inlets and
outlets of the data center network.

6 ISACA JOURNAL VOLUME 2 | 2022 © 2022 ISACA. All rights reserved. www.isaca.org