Ways to Secure Data Centres

Data Centre Security- 11 Ways To Secure Data Centres 

In today’s world the most valuable assets is data. Together with the data centres that hold and process it, they underpin almost all facets of modern life. This makes data centres an attractive target for threat actors, due to the large and diverse amount of information that supports our national infrastructure and businesses.

The term data centre security conjures images of lines of code, hackers and firewalls. However, there is a huge requirement for physical security within a data centre too.

Data centres are used to house computer systems. They often include backup data, core data, replicated data and on the whole, are huge part of an organisation’s Disaster Recovery Strategy.

In a world where technology impacts many industries, data centres are crucial for businesses and therefore data centres security is a hot topic. Not only should data be protected from potential cyber-attacks, the physical building should be secure.

The security and resilience of your data and the infrastructure beneath it are therefore critical. High-profile data breaches and disruption to services are frequently reported, with each incident, causing operators and data owners potentially huge financial losses in regulatory fines, loss of sensitive IP, downtime, post-incident recovery, security improvements, and perhaps most valuably of all, reputation.

Cyber intrusion methodology evolves constantly, and sophisticated attackers have a strong incentive to defeat the defences you put in place. It should be assumed that at some point your defences will be breached and therefore it is also important to be able to respond proactively by detecting attacks and having measures in place to minimise the impact of any cyber security incidents.

Cyber security focuses on the prevention of data theft or destruction by malicious attacks; however, this is not enough to ensure your data centre remains safe. The building also has to be protected from physical attacks.

Here, we discuss 11 ways you can physically secure data centres.

1. Use Crash Barriers

Stop unauthorised vehicle entry with the installation of road blockers. These have been designed specifically to prevent the threat of potential intruders or terrorist attacks in high-security areas. Varying in height, these road blockers will restrict the entry of vehicles.

2. Use Bollards

Avoid anything impacting and colliding into the building by installing bollards. Install permanent bollards around the building entrances. Alternatively, you could install adjustable bollards that can be lowered to allow access to authorized vehicles.

3. Limit Entry Points

Where possible, try and limit the possible entry points to only one door. If you require additional fire doors, ensure these extra doors are exit only. Limit exterior door handles to prevent any re-entry.

4. Use Security Cameras

Surveillance cameras should be installed throughout the perimeter of the data centre. Consider installing adequate CCTV signage as this can be a physical deterrent.

5. Hire On-Site Security

Threats can happen at any time. You may consider an additional layer of physical security by hiring on-site staff. Having someone monitoring the site acts as a strong deterrent to intruders and can raise the alarm if they spot any potential issues.

6. Build The Data Centre In The Best Location

Plan the best location for your data centre. If possible, choose a location away from the company’s head office or headquarters.

Ensure the data centre is set back from the main road. Consider using landscaping to help form additional protection as trees can help obscure the building from passers-by. Avoid building data centres in locations that are prone to natural disasters such as in a flood area or an area prone to earthquakes or fires.

7. Plan The Data Centre Carefully

When you design a data centre, avoid unnecessary windows. Build walls that are extremely thick as they work an effective barrier as well as improving thermal insulation.

8. Embrace Biometric Technology

Biometric technology is increasingly popular and is now part of our every day lives. Install biometric identification systems in the building to control access. This is often a fingerprint recognition device. In addition to biometric technology, ensure multi-factor authentication is in place. This method utilises two or more authentication methods. For example, someone may use their fingerprint but will still need to type in a pin code or show an access card.

9. Install Perimeter fencing

Data Centres have access to unprecedented levels of data. It is important to protect data from digital hackers, but the data also needs to be protected in the physical sense. Therefore, security-rated fencing is of the utmost importance for these buildings and keeping data secure. As a physical security breach has the potential risk just like a digital attack would.

Perimeter security is also vital. Have strong fencing around your entire site. Ensure the gates and barriers are placed where surveillance equipment, a guard, or preferably both are in place.

This is why, at SSA INTEGRATE, we understand how vital data centre fencing is in the wider security strategy of sites. The ultimate goal is to detect potential threats early on and then allow enough time to intercept a risk or threat.

10. Use Access Control Equipment

Data centres should adopt a Zero Trust Network. This means that no one is trusted until they can prove who they are. Access control equipment is an important element of implementing this.

While it may seem simple, access lists should also be provided to ensure that only approved individuals can access data centre. Ensure these lists are kept up to date and are stored securely.

11. Install a Sophisticated Alarm System

Alarm systems are costly. However, these costs are outweighed by the potential benefits. Some systems are linked to local police stations or security companies. Others are silent, but trigger alerts to key staff. Whatever the system you choose, it will bring peace of mind.

People value physical security. They trust places that are secure when they can actually see forms of security such as gates, barriers and alarm systems.

Many companies may forget about the physical form of security when it comes to data centres as they are concentrating on the risk of cyber threats. Although cybersecurity is vital and needs to be as sophisticated as possible, teaming this up with physical security can ensure your data centre is as secure as it can be.

As data centres evolve in the future, the need for physical measures will remain vital. However, physical security measures may also evolve. Having a multi-layer approach that considers both physical and cyber elements will ensure the best protection.

Cyber Scams on the Rise in India

Unmasking the Surge: Cyber Scams on the Rise in India 

Cybercrime refers to criminal activities that are carried out using computers, computer networks, or the internet as tools or target.  Thеsе illegal activities can take various forms and can encompass a wide range of actions,  from financial fraud and data theft to online harassment and cybеr espionage.

Alarming reports suggest a surge in cyberattacks in India during the first three months of 2023, with over 500 million attacks thwarted out of a billion global attempts, as per the 'State of Application Security Report'.

Almost half the complaints, 1.56 million, were registered in 2023. Since 2019, more than 66,000 FIRs have been filed across states and Union territories based on these complaints.

Cyber scams have witnessed a significant rise in India, with multiple factors contributing to this concerning trend. Let's delve into a detailed analysis of the reasons behind the increasing prevalence of cyber scams in the country:

1. Rapid Digitalization: 

India is experiencing a massive digital transformation, with a growing number of people embracing online platforms for various activities like banking, shopping, and communication. This increased digitalization has provided cybercriminals with a larger pool of potential targets and opportunities to exploit vulnerabilities in the digital ecosystem.

2. Rising Internet Penetration: 

The widespread availability of affordable smartphones and internet connectivity has led to a surge in the number of internet users in India. As the internet user base expands, so does the potential victim pool for cyber scammers.

3. Lack of Cyber Awareness: 

A significant portion of the Indian population, particularly in rural areas and older age groups, may not have adequate knowledge of cybersecurity best practices. This lack of awareness makes them more susceptible to falling prey to various cyber scams, such as phishing emails, fake websites, and lottery frauds.

4. Sophistication of Cybercriminals: 

Cybercriminals have become increasingly sophisticated in their techniques and tools, making it challenging for individuals and organizations to detect and protect against their attacks. Advanced phishing emails, malware, and social engineering tactics are some of the methods employed by cyber scammers to exploit their victims.

5. Inadequate Cybersecurity Infrastructure: 

Despite the increasing cyber threats, many organizations and individuals in India still lack robust cybersecurity infrastructure and practices. This inadequacy leaves them vulnerable to cyber attacks, data breaches, and financial losses.

6. Lack of Stringent Regulations: 

The absence of stringent cybersecurity regulations and penalties for cybercrime in India can be perceived as an opportunity by cyber scammers. The absence of severe consequences for perpetrators may embolden them to continue their illicit activities.

7. Increasing Online Transactions: 

The rise of e-commerce and digital payment platforms has led to a surge in online transactions. This digital financial ecosystem attracts cyber scammers who seek to exploit security loopholes and trick users into divulging sensitive financial information.

8, Insider Threats: 

Insider threats, where current or former employees with access to sensitive data engage in fraudulent activities, can pose significant risks to businesses and individuals alike.

9. Global Nature of Cybercrime: 

Many cyber scams originate from outside India, taking advantage of the borderless nature of the internet. These international cyber threats may pose jurisdictional challenges for law enforcement agencies and hinder effective prosecution.

Root Cause to this: -

The rapid digitalization, rising internet penetration, lack of cyber awareness, and the increasing sophistication of cybercriminals are some of the key reasons behind the rise of cyber scams in India.

To combat this growing menace, there is an urgent need for enhanced cybersecurity awareness, investment in robust security measures, and the formulation of stringent cybersecurity regulations.

Additionally, continuous education and training in cybersecurity best practices for individuals and organizations can play a vital role in thwarting cyber scammers and creating a safer digital environment for all. Do not install non-NDAA approved IP Camera, NVR etc. Do not use China Based origin brand IP camera NVR etc.

Here are other takeaways for 2023:

• Imposter scams. Imposter scams remained the top fraud category, with reported losses of $2.7 billion. ...
• Investment scams. While investment-related scams were the fourth most-reported fraud category, losses in this category grew. ...
• Social media scams. ...
• Payment methods. ...
• Losses by age.

Cybercrime Laws In India

1.   Information Tеchnology Act, 2000 (IT Act): Thе Information Tеchnology Act,  2000,  is thе primary legislation that dеals with cybеrcrimеs in India.  It was amеndеd in 2008 to kееp up with еvolving tеchnology and cybеr thrеats.  Kеy provisions of thе IT Act includе:

2.   Sеction 43: This sеction dеals with unauthorizеd accеss to computеr systеms and data. It providеs for pеnaltiеs for unauthorizеd accеss,  downloading,  or introduction of computеr virusеs.

3.   Sеction 65: This sеction dеals with tampеring with computеr sourcе documеnts, and it imposеs pеnaltiеs for altеring,  damaging,  or dеlеting data with thе intеnt to causе damagе or harm.

4.   Sеction 66: This sеction addrеssеs computеr-rеlatеd offеnsеs, such as hacking,  and prеscribеs pеnaltiеs for unauthorizеd accеss to computеr systеms,  nеtworks,  or data.

5.   Sеction 66A (Rеpеalеd): Sеction 66A was controvеrsial and was struck down by thе Suprеmе Court of India in 2015 bеcausе it was dееmеd to bе infringing on frее spееch rights.

6.   Sеction 66B: This sеction dеals with dishonеstly rеcеiving stolеn computеr rеsourcеs or communication dеvicеs.

7.   Sеction 66C: It pеrtains to idеntity thеft and thе usе of somеonе еlsе’s idеntity for fraudulеnt purposеs.

8.   Sеction 66D: This sеction dеals with chеating by pеrsonation using a computеr rеsourcе.

9.   Sеction 67: This sеction addrеssеs thе publication or transmission of obscеnе matеrial in еlеctronic form and imposеs pеnaltiеs.

10.Sеction 69: This sеction providеs thе govеrnmеnt with thе powеr to intеrcеpt and monitor еlеctronic communications for rеasons rеlatеd to national sеcurity.

11.Sеction 70: This sеction dеals with thе protеction of critical information infrastructurе and providеs for thе appointmеnt of a National Critical Information Infrastructurе Protеction Cеntrе (NCIIPC).

12.Sеction 72: It dеals with thе brеach of confidentiality and privacy and imposеs pеnaltiеs for disclosing pеrsonal information without consеnt.

13.Information Tеchnology (Amеndmеnt) Act, 2008: This amеndmеnt act еxpandеd thе scopе of thе IT Act and introducеd provisions rеlatеd to data protеction,  data brеachеs,  and increased pеnaltiеs for cybеrcrimеs.

Tracking WhatsApp messages or any other form of electronic communication without proper legal authorization is typically illegal and a violation of privacy.  However, undеr certain circumstances and with appropriate legal processes,  law enforcement agencies and cybеr cеlls may bе able to access WhatsApp messages as part of a criminal investigation. WhatsApp usеs еnd-to-end encryption, which means that messages arе scramblеd and can only bе decrypted by thе intended recipient.  WhatsApp itself does not have accеss to thе content of messages. To access WhatsApp messages for investigative purposes’, law enforcement agencies typically nееd to obtain proper lеgal authorization,  such as a court-issued warrant or a lawful court order.

Government of India has banned 17 Chinese companies from participating in tenders in India and warned private companies that do business with government entities against using these Chinese products. This is being seen as a significant crackdown on Chinese products that were entering the country after changing their brand names and tying up with Indian entities, ostensibly to hide their place of origin, and thus impacting the strategic and security interests of India while benefiting the Chinese economy.

The companies that have been banned include Xp-pen, Highvision Hikvision, Lenovo, Dahua, Lava, Ottomate, Xolo, Airpro, Grandstream, Wi-Tek, Realtime, Maxhub, Nokia, Domino, Reputer and Tyco.

The Sunday Guardian, last year, had revealed about Chinese products being used in government public sector undertakings that are working in the strategic sectors (Indian PSUs continue reliance on Chinese equipment in strategic sectors, 26 February 2023).

As per the government order released on the last day of January, the Indian sellers of these Chinese brands and the catalogs uploaded by them have been removed from Government e Marketplace (GeM) and they are not eligible for participating in any bid on GeM. The order has also said GeM will cancel those orders where the products of these Chinese companies are found to be used for the bid.

Seventy products, the maximum on the list, that have been banned belong to Hangzhou Hikvision Digital Technology Co., Ltd., often shortened to Hikvision. Its Indian face is Prama Hikvision (India) Pvt. Ltd. It is one of the biggest suppliers to Indian government agencies.

Similarly, DNS overseas, which handles products brought from the Beijing-based Hanvon Ugee Group and is a big player in the tablet market in India, has been removed from the GeM portal.

Twenty two products made by Lenovo, including servers, have been banned. Not many are aware that Lenovo is of Chinese origin.

Lenovo, founded in 1984, is seen as a product of the Chinese Academy of Sciences (CAS)—the Chinese-government’s premier institution of scientific research. CAS is reported to have extensive ties to the Chinese military.

Five products of Zhejiang Dahua Technology Company Limited, a publicly traded company based in Binjiang District, Hangzhou, which manufactures video surveillance equipment and sells its products in India under the brand name “Dahua” also features on the banned list.

Nineteen products of Lava International, whose brand ambassador is actor Kartik Aaryan, and has used cricketer Mahendra Singh Dhoni in the past, too have been banned. Also put on the banned list are products made under the brand name “Ottomate”, which is also a part of the Lava group. The products that have been banned include smart phones, fans and tablets. While Lava is seen as an Indian company, its products are made in China and then sold in India under a new brand name.

Thirteen products of Airpro have been put on the banned list including routers and cameras.

Five products of Grandstream and W-Tek that are sold in India by Cohesive Technologies have been removed from the portal.

Thirty one products made by “Realtime” and sold by Realtime Biometrics India Private Limited companies that include boom barriers, biometric access system, CCTVs have been banned.

The government has also come down heavily on the Chinese entity, Maxhub that sells its products through Shiyuan India Private Limited. A total of 18 of its products have been banned.

Six products sold by Hmd Mobile India Private Limited that are made by Nokia have been banned. According to industry insiders, the banned products are being manufactured in China. The brand had launched a media blitzkrieg a few years ago to convince Indian nationals that it was not making its products in China.

Seven products made by Tyco and marketed in India by Tyco Safety Products (India) Private Limited, two of Domino sold in India by Domino Printech India Llp and one of Reputer sold domestically by Innovitiq have been banned.

However, what has piqued industry insiders and security watchers is that many entities with notable Chinese investments and control that are active in India have not been added to this list.

These include products made by Huawei, Alcatel Lucent—a French company now owned by Chinese promoters, TvT, Tiandy Technologies and Uniview. All these companies have a significant presence in India and have been dealing with government agencies for a long time now.

On 6 August 2020, a Registration Committee under Department of Expenditure Order was constituted under the chairpersonship of Manmeet Kaur Nanda, a 2000 cadre IAS officer, who was then Joint Secretary, Department for Promotion of Industry and Internal Trade, to consider applications received for registration of bidders from countries that share land border with India for participation in public procurement.

It is this committee that keeps an eye on the products from the identified countries and evaluates the risk, if any, that is poised by them. In November 2023, Nanda moved as Joint Secretary to the Cabinet Secretariat. Sources in Government of India said that this is not an exhaustive list and more companies will be added on the list as per inputs that the concerned officials will receive.