Data centre security at edge sites: small rooms, own risk profile

Lees dit artikel in het Nederlands

An edge site is often no more than a container next to a telecom mast, a server room in a hospital basement or a few racks on a business park. Nobody works there permanently, yet it runs equipment that customers rely on. The risk profile of edge sites is therefore determined not by their size, but by the location and the people who come there.

1Why the risk profile of edge sites is different

At a large data centre, security is built up in layers: site, building, hall and cage. There is a reception desk, security officers walk around and every step is recorded. With its tier classification, the Uptime Institute describes how available the infrastructure of such a facility needs to be. That expectation applies to a small site as well, but the security layers around it are usually missing. What remains is a door, a cabinet and a connection.

On top of that, an edge site is often located in someone else’s building or on someone else’s land. The owner controls access to their premises, but not to your room. You have to arrange that yourself and be able to demonstrate it.

2Three kinds of location, three risks

• Inside an existing building. A room in an office, hospital or school. The risk lies in shared access: cleaners, maintenance engineers and other tenants come close.
• In a container on open ground. Next to a telecom mast, at a wind farm or along a road. Here the risk lies in break-ins, vandalism and theft of batteries or copper, often in places where nobody sees it.
• On a business park. A small hall or a shared unit. The risk sits somewhere in between, behind an exterior that looks unremarkable.

For each kind you choose a different combination of access control, cameras and detection. A standard package that is the same everywhere fits none of the three well.

3Access for many parties

An unmanned site is mainly visited by technicians: from the operator, from the cooling supplier, from the network provider and sometimes from the building owner. They come at varying times and often alone. You need to be able to see afterwards who was inside and when, especially if your organisation falls under NIS2. The Dutch National Cyber Security Centre explains which organisations are covered. An access system that records every opening and a camera at the door are no luxury at a site like this.

4Fire and power in a small room

In a small room, servers, cooling and backup power sit close together. Batteries for the backup power are a well-known source of fire. Because nobody is present, nobody sees a fire starting either. Early detection with a direct alert to a monitoring centre therefore matters more than in a building where people are always around. Choose detection that meets the European standard EN54.

5An example from practice

Suppose a telecom operator places forty edge containers at existing masts within a year. During the roll-out, each location is a construction site for a few weeks, with cables, batteries and the container itself, before the permanent security is connected. A compact camera tower covers that period, and temporary fire detection goes into the container as soon as the batteries are inside. Once the permanent security has been tested, the temporary setup moves on to the next location. All locations appear in one overview, so the operator can see what is happening at each one.

6How Darwin supports the roll-out of edge sites

Darwin is mainly involved in the construction and roll-out of edge sites, and at locations where permanent security is not yet in place. We work with a fixed pattern for each kind of location, so the setup at the fortieth site is the same as at the first. For the construction phase we use the Darwin Mini, for the door Darwin Access Control and for the room itself temporary detection with Darwin FireProtection. Footage and alerts come in through Darwin Connect, together with Odido, our Global Connectivity & Strategic Partner, even where the signal is weak.

All locations fall under one managed system and one fixed project price for the technology. Alerts go to your own monitoring centre or to that of our regular partner. Read more under data centre security and telecom and 5G security.

7Frequently asked questions

Why does the risk profile differ from one edge site to another?

Because the location determines who comes near it. A room in a hospital faces different risks from a container along a motorway.

Who arranges access if my edge site is in someone else’s building?

The owner controls access to the premises, you control access to your own room. Agree who keeps which records and how you can request them.

Is temporary security needed if a location is only a construction site for a few weeks?

For each location that period is short, but a roll-out across many locations often takes a year or more. The same setup then moves with it from site to site.