Earlier this week a cabinet in one of the data centers I work in suffered a power failure when a fuse melted.
Please note, that’s melt not burn. This tiny little fuse had clearly been slowly getting warmer. Over the several years, its been in operation and the metal had finally separated and seeped out the fuse caps.
The whole cabinet was dead.
It didn’t take long to diagnose.
Thankfully it was out of hours.
So the service was returned to normal before anyone really noticed. Thing is though – it was avoidable. Almost all of the equipment in all the cabinets I work with are either redundant or have many redundant components. Yet this one 20mm x 5mm tube managed to kill the lot.
I can quite happily point out that I was not the designer of this cabinet. Also, I have been pushing to get two independent power rails put in all of the cabs. It wouldn’t be too difficult to have one power rail support one half of the redundant switches etc and one of the two PSU’s that’s in all the servers. I guess it’s down to personal taste and experience. But I can’t help but think that power is a pretty significant part of computing infrastructure. therefore we should be considering it just as significant.
You will be pleased to know that we are in the process of addressing this to prevent it from being an issue in the future. Anyway – that’s a lesson learnt!
A few years ago I went to London to sit a week long intensive course to learn all I needed to know ready to take the ISC2 CISSP exam. Unfortunately the trip cost me more than I was expecting and I didn’t have enough money to pay for the exam. I have decided its about time I sort something out about this and so I am studying towards it again.
So first up is one of the basic principals of security. You can remember it as C.I.A.
- Confidentiality
- Integrity
- Availability
Confidentiality is about making sure the private information within an organisation remains private. Whether that be whilst the information is in transit, for example an encrypted VPN tunnel or by controlling access to the resource that hosts the information, I.E. access control lists on a firewall.
Integrity is about knowing that the information you are processing has not been altered either accidentally or intentionally by any automated system or person. This ranges from hashing techniques to ensure the data hasn’t changed to least-privileged access policies.
Availability is the defense against downtime. And lets be clear thats not just against classic Distributed Denial Of Service attacks, thats also against users not being able to access the resources they require to fulfill the task they set out to.
The premise is, if the matter at hand doesn’t fit in at least one of these three categories, its not security. Interestingly enough though, the reverse is also true; most people only think about the bits that fit into confidentiality.
