Although cyber threats are still the biggest risk factors in cloud technology, the physical security of the cloud servers – something the customer never sees – is at least as important.

Along with the decision to store their data and software in a cloud, customers lose access to the physical servers where that data is being kept. As a result, multiple theoretical threats appear, the most important of which are the risk that stems from the employees of a cloud service provider, and isolating the customer’s data. In addition to these threats, large cloud service providers also make sure to take care of all the physical aspects of server security, from complicated alarm systems and energy insurance to political regimes.

Access is more complicated to get than in a nuclear power plant

Although the end user, the one storing their data and applications in a cloud, has no access to the physical servers, there are other parties who do have such access, for example, the employees and partners of the service provider, who need to maintain, repair, update, and replace the servers. But how can a customer be sure that these tens and tens of people work honestly, while keeping the security of the customer’s data in mind?

The first thing that every cloud service customer should check are the security protocols of the service provider and whether they comply with ISO/IEC, NIST and other standards. Additionally, the employees of secure service providers have to go through background and security checks, they have trainings, they get licensed, and they have to go through regular audits and give routine updates to their customers. Every employee who wishes to enter a server room must first apply for a special permit to do so and explain their reasons for applying. All issued permits are time-limited and issued by a committee comprised of multiple people. Security is also enhanced by the different access permit levels that limit the employee’s access to only activities related to their tasks in the server room.

All third parties AKA the representatives of the companies that offer services for cloud services must go through even stricter checks and they must always be accompanied by a security guard while they are in the server farm. Dependent on the customer, these security measures could be even stricter. For example, the US government stores its data in a special Amazon cloud called AWS GovCloud and only those employees and service providers who have US citizenship have access to the AWS GovCloud’s physical server.

Of course, all secure server rooms are under 24/7 video surveillance, but in addition to CCTV, companies also use movement, water, fire, temperature and volume sensors, door sensors (as a general rule, server rooms do not have windows), alarm systems that have been doubled multiple times, entrances and exits that use multi-factor authentication, and a certified security team. Where necessary and possible, even the animal kingdom is being used to ensure security! This is the case in Google’s South Carolina data centre, where the cooling water is inhabited by water-cleaning tilapia and alligators who feed on the tilapia.

Every movement made inside a server room is monitored in real-time by a professional security team. Figuratively speaking, every opening and closing of a door is logged and those log files are then retained in different places on different carriers as carefully as the original copy of the United States Declaration of Independence.

Location, democracy and electricity

Large service providers such as Microsoft, Amazon, Google, and IBM host their customers’ data in secure server farms located all over the world. Before choosing a new location, they carefully research a potential location’s environment and geographical peculiarities to lower risks that could stem from extreme weather conditions (e.g. floods, storms, large temperature fluctuations) and seismic activities (earthquakes and landslides). A location’s political situation is also thoroughly analysed as no one wants their business to stop because of a sudden change in political regime.

As the electricity requirements of an average server farm are comparable to that of the city of Tartu, then the chosen location for a new server farm will usually be someplace close to an existing power station that has enough electric power for the long-term, including for the development plans and perspectives of the surrounding area.

This could possibly be one of the reasons why there are no global cloud service provider data centres in South American or Arabic countries.

Once a provider has found the best location for their new server farm and ensure that it meets not only all their security requirements but also other requirements, such as roadwork, accessibility, and internet connection requirements, then a new building will be constructed in that location or, if there is a pre-existing building there, it will be renovated and converted into the new server farm. Regardless of the type of building used, it must meet the above requirements (except for the alligators) and be guarded around-the-clock by a professional security company.

Do broken disks go in the bin?

The security of cloud servers is not limited to just the servers and rooms that are currently being used for them. Even though technology is constantly becoming more reliable, storage devices must still be occasionally replaced for one reason or another. However, old disks and devices are not simply thrown away. Instead, companies make sure that it will never be possible to restore the data that has been on them, not even in NCIS laboratories. Dependent on the service provider and the data, old devices are taken care of differently, but the most common method is to first rewrite the data on the disk multiple times and then destroy the disk according to the NIST 800-88 standard, which, for example, entails burning it completely to ashes, melting it, and pulverising it. Some service providers do all of this themselves, some buy the process as a service, but all of them must meet the highest standard for destroying data carriers and document all activities related to this process.

There is no such thing as complete security but…

Even a computer buried in the middle of an uninhabited desert will not be 100% secure in the long-term but ensuring the highest possible level of security while lowering risks as much as possible is achievable. All large cloud service providers understand that they are not only selling convenience and saved resources, but also reliability, and security or the knowledge that their data is always well taken care of by the provider. To guarantee this knowledge, the providers have to pass strict certification processes and audits, meet industry standards, and constantly improve their security measures. As a result of this, customers can be confident that in the case of large cloud companies, they are being provided with a much higher level of security than any company or state institution could provide on their own with their own resources.