In IT security, we spend so much time trying to protect servers and computers on the wire (or on wireless) that we look at OS patches, firewalls, anti-malware, etc., to protect our systems. We typically assume our physical security is sufficient. But the real question is: "Is it really?" I enter into evidence the following tale:

  Ministry of Defence Admits Losing An Entire Server

There's a couple of disconcerting facts that are in that article:

• They cannot account for the server.
• The server was in a secure building.
• The personal data of 1.7 million people was lost in another breach.

We tend to take our physical security for granted and we shouldn't. It really doesn't matter what we do as DBAs and system administrators if someone can get physical access to our servers. And that's obviously what happened here. Someone had physical access to the server. So despite the fact that you have a secure government facility you still have a missing server. We'd expect such a location would be more secure than most data centers. Hopefully it turns out that server was misplaced and it wasn't actually stolen. But even with that as a possibility, the question comes up on how it was moved unknowingly. But this raises the question of how good is the physical security where our systems are?

We can say that it's good. We can point to controlled entry systems, cameras, physical locks on the racks, etc., but the truth is, until we put it to the test, we don't know. There are plenty of tales out there of pen test teams being hired and doing any of the following to gain access to the servers:

• Pretending to be part of the cleaning crew.
• Tailgating someone with access.
• Walking right on in an open door and acting like they belonged.

And that's for environments that had all of these types of measures in place. They were there, but due diligence wasn't being maintained. And as a result, those pen test teams were able to get into the servers without so much as opening up a laptop. So if you haven't looked closely at your physical security lately, now is a good time to do so. If you have never hired knowledgeable people to come test your physical security, it should be considered. If you can't afford to hire out, get permission to do so and test it yourself. Pick a down time like a weekend or at night and see how far you can get before you get challenged. You may be unpleasantly surprised.