4.3.2 Server room

Description

The server room primarily serves to accommodate a server, e.g. a LAN server, a Unix host computer or a server for a PBX facility. In addition, server-specific documentation, small numbers of data media, additional hardware (star coupler, logging printer, air conditioning system) may be kept in that room.

A server room is not occupied by regular staff; it is used only sporadically and for short-term assignments. However, it must be borne in mind that, on account of the accumulation of IT devices and data, significantly greater damage may be caused in a server room than, for instance, in an office room.

Threat Scenario

The following threats (T) are assumed as regards IT baseline protection of a server room:

Force Majeure:

• T 1.4 Fire
• T 1.5 Water
• T 1.7 Inadmissible temperature and humidity

Organisational Shortcomings:

• T 2.1 Lack of, or insufficient, rules
• T 2.6 Unauthorised admission to rooms requiring protection

Technical Failure:

• T 4.1 Disruption of power supply
• T 4.2 Failure of internal supply networks
• T 4.6 Voltage variations / overvoltage / undervoltage

Deliberate Acts:

• T 5.1 Manipulation/destruction of IT equipment or accessories
• T 5.2 Manipulation of data or software
• T 5.3 Unauthorised entry into a building
• T 5.4 Theft
• T 5.5 Vandalism

Recommended Countermeasures (S)

For the implementation of IT baseline protection, selection of the required packages of safeguards ("modules") as described in chapters 2.3 and 2.4, is recommended.

When selecting and planning the layout of a server room, a number of infrastructural and organisational measures which are described in S 1.58 Technical and organisational requirements for server rooms should be implemented.

In the following, the safeguard package for "Server Room" is set out:

Infrastructure:

• S 1.3 (1) Adapted segmentation of circuits
• S 1.7 (2) Hand-held fire extinguishers
• S 1.8 (2) Room allocation, with due regard to fire loads
• S 1.10 (2) Use of safety doors (optional)
• S 1.15 (1) Closed windows and doors
• S 1.18 (2) Intruder and fire detection devices (optional)
• S 1.23 (1) Locked doors
• S 1.24 (3) Avoidance of water pipes (optional)
• S 1.25 (2) Overvoltage protection (optional)
• S 1.26 (2) Emergency circuit-breakers (optional)
• S 1.27 (2) Air conditioning (optional)
• S 1.28 (1) Local uninterruptible power supply [UPS] (optional)
• S 1.31 (3) Remote indication of malfunctions (optional)
• S 1.52 (3) Redundancies in the technical infrastructure (optional)
• S 1.58 (1) Technical and organisational requirements for server rooms
  

Organisation:

• S 2.14 (2) Key management
• S 2.16 (2) Supervising or escorting outside staff/visitors
• S 2.17 (2) Entry regulations and controls
• S 2.18 (3) Inspection rounds (optional)
• S 2.21 (2) Ban on smoking