Security systems engineering and cyber-physical risk

Lesson 9 described the layers of physical security that protect a data center, from the perimeter fence to the locked cabinet, and the people and procedures that make them work. Behind those layers sit electronic systems: access control that decides who may open each door, video surveillance that records what happens, intrusion detection that raises alarms, and a security operations center that ties them together. These systems are themselves networks of computers, and they connect to the building management and electrical monitoring systems that keep the facility running. They can therefore be attacked through the network as well as in person, and a weakness in one can compromise the other. This lesson looks at how security systems are engineered: credentials and readers, video bandwidth and storage, detection probability, log analysis, operations, and the cyber-physical risks that arise when building systems are networked.

Access control system architecture

An electronic access control system has four main parts. Credentials identify the person: a card, a fob, a smartphone, a PIN or a biometric feature. Readers at each door read the credential and pass it on. Controllers, usually in secure rooms, hold the access rules for a group of doors, decide whether to unlock, operate the lock and monitor the door position, and continue working if the network fails. The head-end server manages users, rules and schedules, and collects events from all controllers for monitoring and audit.

The security of the whole chain depends on its weakest link:

• Credentials. Older 125 kHz proximity cards transmit a fixed number without encryption and can be copied in seconds with inexpensive devices held near the victim's pocket. Modern contactless smart cards (13.56 MHz, using standards such as ISO/IEC 14443 with strong cryptography) and mobile credentials authenticate cryptographically and are much harder to clone. Data centers should have retired proximity cards; where they remain, they are a well-known weakness.
• Reader to controller communication. The traditional Wiegand interface sends credential data unencrypted in one direction over a few wires, so anyone who can reach the wiring behind a reader can capture credentials or replay them. OSDP (Open Supervised Device Protocol), standardized as IEC 60839-11-5, provides two-way communication with supervision of the reader and, with Secure Channel enabled, encryption.
• Locks and door hardware. Electric strikes and magnetic locks must be specified as fail-safe (unlocking on power loss, used on egress doors) or fail-secure (staying locked), consistent with the egress requirements of the building and fire codes. Door position switches and request-to-exit sensors allow the system to detect doors that are forced or held open.
• Rules and data. Access should follow least privilege: each person has access only to the areas and times they need. Access must be removed promptly when people leave or change roles, which requires the access control system to be linked to human resources and contractor management processes, and reviewed periodically.

High-security areas such as data halls, cages and battery rooms use multi-factor authentication: something you have (a card), something you know (a PIN) and something you are (a biometric such as a fingerprint, iris or face). Additional rules include anti-passback, which refuses a credential used to enter an area again before it has been used to leave, preventing one card from being passed back to admit a second person; two-person rules for the most sensitive rooms; and escort requirements for visitors.

Biometric data is personal information, and several states regulate its collection. The Illinois Biometric Information Privacy Act requires written notice and consent, a retention schedule and limits on disclosure, and has led to large class-action settlements; Texas and Washington have their own laws. Many systems store a mathematical template rather than an image, and some store it only on the user's card.

Video surveillance

Video serves three purposes in a data center: live monitoring by security staff, investigation after an incident, and evidence for audits and customers that controls are operating. Camera selection follows the pixel density needed for each purpose, as described in Lesson 9. The engineering challenge is the network and storage load: hundreds of high-resolution cameras recording around the clock, with retention periods of 90 days or more commonly required by colocation customers and audit frameworks.

The bitrate of a camera stream depends on resolution, frame rate, scene complexity and compression. Modern cameras use H.265 (HEVC) compression, which roughly halves the bitrate of the older H.264 at similar quality, and smart encoding that lowers the bitrate when the scene is static. Recording only when motion is detected, or at reduced frame rates when nothing happens, reduces storage further in areas such as data hall aisles that are empty most of the time.

# Video surveillance bandwidth and storage for a data centre campus
# type, number of cameras, typical bitrate (Mbit/s, H.265 at 15 frames/s), fraction of time recording
cameras = [
    ("Perimeter 4K with analytics", 40, 6.0, 1.00),
    ("Entrances and mantraps 4 MP", 30, 3.0, 1.00),
    ("Data hall aisles 4 MP", 160, 3.0, 0.30),     # motion-based recording
    ("Loading dock and yard 4K", 12, 6.0, 1.00),
    ("Corridors and rooms 2 MP", 80, 1.5, 0.40),
]
retention_days = 90
raid_overhead = 1.25            # parity and spare capacity

total_live = 0.0
total_tb = 0.0
for name, n, mbps, duty in cameras:
    live = n * mbps                                  # network load when all stream
    tb = n * mbps * duty * 86400 * retention_days / 8 / 1e6   # Mbit -> MB -> TB
    total_live += live
    total_tb += tb
    print(f"{name:<30} {n:3d} cams  {live:6.0f} Mbit/s  {tb:7.1f} TB")
total_label = "Total"
n_total = sum(c[1] for c in cameras)
print(f"{total_label:<30} {n_total:3d} cams  {total_live:6.0f} Mbit/s  {total_tb:7.1f} TB")
print(f"raw storage with RAID overhead: {total_tb * raid_overhead:.0f} TB for {retention_days} days")
# Effect of retention policy
for days in (30, 90, 180):
    print(f"retention {days:3d} days: {total_tb * raid_overhead * days / retention_days:6.0f} TB")

Perimeter 4K with analytics     40 cams     240 Mbit/s    233.3 TB
Entrances and mantraps 4 MP     30 cams      90 Mbit/s     87.5 TB
Data hall aisles 4 MP          160 cams     480 Mbit/s    140.0 TB
Loading dock and yard 4K        12 cams      72 Mbit/s     70.0 TB
Corridors and rooms 2 MP        80 cams     120 Mbit/s     46.7 TB
Total                          322 cams    1002 Mbit/s    577.4 TB
raw storage with RAID overhead: 722 TB for 90 days
retention  30 days:    241 TB
retention  90 days:    722 TB
retention 180 days:   1443 TB

The result, about 720 TB of raw storage for a campus with just over 300 cameras, is typical. Storage scales directly with retention, so a policy decision (90 or 180 days) doubles or halves the cost. The live network load of about 1 Gbit/s requires a dedicated, well-designed security network with switches able to supply Power over Ethernet to every camera. Video management software indexes recordings, links them to access control and alarm events, and provides analytics such as line crossing, loitering and object left behind, which reduce the burden on operators watching hundreds of feeds.

Video of people is also personal information. US practice is to post signs informing people of surveillance, avoid private areas such as washrooms and change rooms, restrict access to recordings and define retention periods; some state laws also apply, particularly to audio recording and biometric analytics.

Intrusion detection

Intrusion detection sensors raise alarms when someone crosses a boundary: fence-mounted vibration or fiber sensors and buried cables on the perimeter, radar and thermal cameras with analytics across open ground, door contacts and glass-break detectors on the building shell, and motion detectors inside unoccupied rooms. Each sensor has a probability of detecting an intruder who passes it and a rate of nuisance alarms from wind, animals or vibration. Layering independent sensors raises the overall probability of detection:

where \(p_i\) is the probability that layer \(i\) detects the intruder, assuming the layers are independent.

Security operations and log analysis

A security operations center (SOC) receives alarms and events from access control, video, intrusion detection and the fire alarm system, often through a physical security information management (PSIM) platform that correlates events and presents them on site maps with procedures for each alarm type. Operators verify alarms using video, dispatch officers, and record outcomes. Good procedures prioritize alarms so that real events are not buried among the many routine ones, such as doors held open by staff moving equipment.

Access control logs contain patterns that reveal misuse or attack, and reviewing them is a routine control in audited facilities:

• Repeated denied attempts at a door, possibly followed by a forced door.
• Doors held open too long, which may indicate propping or tailgating.
• Anti-passback violations, which suggest a card has been shared.
• Access outside a person's permitted hours.
• The same credential used at two locations too far apart in too short a time, which may indicate a cloned card.

# Reviewing an access control event log for anomalies
# time (minutes after midnight), badge, door, event
log = [
    (410, "B1027", "Lobby-In", "granted"), (412, "B1027", "Hall2-In", "granted"),
    (415, "B2210", "Lobby-In", "granted"), (416, "B2210", "Lobby-In", "granted"),
    (430, "B3305", "Hall2-In", "denied"), (431, "B3305", "Hall2-In", "denied"),
    (432, "B3305", "Hall2-In", "denied"), (433, None, "Hall2-In", "door forced"),
    (540, "B1027", "Hall2-Out", "granted"), (541, None, "Dock-Out", "door held 95 s"),
    (1395, "B4410", "Lobby-In", "granted"), (1397, "B4410", "Battery-In", "granted"),
    (600, "B5120", "Lobby-In", "granted"), (603, "B5120", "Site2-Gate", "granted"),
]
allowed_hours = {"B4410": (7 * 60, 19 * 60)}        # contractor: 07:00 to 19:00 only
travel_min = {("Lobby-In", "Site2-Gate"): 15}        # minimum walking or driving time
inside = set()
denied = {}
last = {}
for t, badge, door, event in sorted(log):
    hhmm = f"{t // 60:02d}:{t % 60:02d}"
    if badge is None:
        print(f"{hhmm} {door}: {event} (no badge) -> dispatch officer, review video")
        continue
    if event == "denied":
        denied[badge] = denied.get(badge, 0) + 1
        if denied[badge] == 3:
            print(f"{hhmm} {badge}: 3 denied attempts at {door} -> alert")
        continue
    if door == "Lobby-In":
        if badge in inside:
            print(f"{hhmm} {badge}: entered lobby twice without exit (passback) -> alert")
        inside.add(badge)
    if door.endswith("-Out"):
        inside.discard(badge)
    if badge in allowed_hours:
        lo, hi = allowed_hours[badge]
        if not lo <= t <= hi:
            print(f"{hhmm} {badge}: access to {door} outside permitted hours -> alert")
    if badge in last:
        t0, d0 = last[badge]
        need = travel_min.get((d0, door))
        if need and t - t0 < need:
            print(f"{hhmm} {badge}: {d0} then {door} in {t - t0} min, minimum {need} -> cloned card?")
    last[badge] = (t, door)

06:56 B2210: entered lobby twice without exit (passback) -> alert
07:12 B3305: 3 denied attempts at Hall2-In -> alert
07:13 Hall2-In: door forced (no badge) -> dispatch officer, review video
09:01 Dock-Out: door held 95 s (no badge) -> dispatch officer, review video
10:03 B5120: Lobby-In then Site2-Gate in 3 min, minimum 15 -> cloned card?
23:15 B4410: access to Lobby-In outside permitted hours -> alert
23:17 B4410: access to Battery-In outside permitted hours -> alert

Each finding should be investigated with the corresponding video and resolved: the forced door may be a contractor who lost a card, the impossible travel may be a cloned card or a data error. Recording the outcome of each investigation is part of the evidence that auditors look for, and trends (a door that is often held, a contractor company that often attempts after-hours access) point to procedures or training that need attention.

Cyber-physical risk

Modern access control, video, intrusion detection, building management, electrical power monitoring and fire alarm systems run on embedded computers and servers connected by Internet Protocol networks. This connectivity brings the benefits of central monitoring and analytics, but also the risks of any networked computer: default passwords, unpatched firmware, insecure remote access and malicious software. Two well-known incidents illustrate the danger. In 2013, attackers who breached the US retailer Target entered its network using credentials stolen from a heating and ventilation contractor with remote access, and went on to steal payment card data. In 2021, attackers gained administrator access to the cloud platform of the camera vendor Verkada and viewed live feeds from about 150,000 cameras in hospitals, prisons, schools and companies.

In a data center, the consequences can be physical as well as informational. An attacker who controls the building management system could change cooling setpoints or disable alarms; one who controls access control could unlock doors or erase evidence; one who controls the electrical monitoring system might open breakers. For this reason, operational technology (OT) networks are designed with the same discipline as IT networks:

• Segmentation: security and building systems run on networks separate from corporate IT and from customer networks, divided into zones with controlled connections (conduits) between them, as described in the IEC 62443 series of standards.
• Hardened devices: default passwords changed, unused services disabled, firmware kept up to date, and devices chosen from vendors that provide security updates and disclose vulnerabilities.
• Controlled remote access: vendors connect through monitored jump servers with multi-factor authentication and time-limited accounts, never through direct connections to devices.
• Monitoring: OT network traffic is monitored for unusual activity, and logs are sent to a security information and event management system.
• Supply chain: equipment provenance and vendor security practices are reviewed, and some products are prohibited for national security reasons.

Section 889 of the 2019 National Defense Authorization Act prohibits federal agencies and their contractors from using video surveillance and telecommunications equipment from certain Chinese manufacturers, including Hikvision and Dahua, and the Federal Communications Commission has barred new authorizations of their equipment. Many data center owners apply similar restrictions to all their facilities.

Physical and cyber security teams must therefore work together. A camera is both a security sensor and a potential entry point into the network; a server room door is both a physical control and a protection for cyber assets. Joint risk assessments, shared incident response procedures and regular exercises bring the two disciplines together.

Insider threat

The people with legitimate access to a data center (employees, contractors, cleaners, customer staff) pose risks that perimeter defenses cannot address. Insider incidents include theft of equipment or drives, sabotage by disgruntled staff, accidental damage, and staff coerced or bribed by outsiders. Controls include background checks appropriate to the role, least privilege, two-person rules for sensitive work, separation of duties so that no one person can both make and approve a change, inspection of items leaving the building, secure destruction of drives, and a culture in which staff report concerns. Logs and video provide accountability, and their existence deters misconduct.