Question
A network architect is designing a solution to place network core equipment in a rack inside a data center. This equipment is crucial to the enterprise and must be as secure as possible to minimize the chance that anyone could connect directly to the network core. The current security setup is:
- In a locked building that requires sign in with a guard and identification check.
- In a locked data center accessible by a proximity badge and fingerprint scanner.
- In a locked cabinet that requires the security guard to call the Chief Information Security Officer (CISO) to get permission to provide the key.
Which of the following additional measures should the architect recommend to make this equipment more secure?
- A. Make all engineers with access to the data center sign a statement of work.
- B. Set up a video surveillance system that has cameras focused on the cabinet. Correct
- C. Have the CISO accompany any network engineer that needs to do work in this cabinet.
- D. Require anyone entering the data center for any reason to undergo a background check.
Explanation
The existing controls are all preventive layers (building, room and cabinet locks); what is missing is a detective control that records who actually touches the cabinet. Cameras focused on the cabinet deter tampering and provide evidence of anyone connecting to the core. A statement of work is a contract document, not a security control, having the CISO escort every engineer is impractical, and background checks for everyone entering the data center do not monitor the cabinet itself.
