- In this Lesson 2.4,
we're gonna focus in on Environmental Impact.
Now, environmental imbalance
and environmental vulnerabilities or weaknesses,
can impact stability, availability,
and integrity.
Now, our computers, our electronic equipment,
and our transmission media are all really sensitive
to environmental factors such as heat, humidity, airflow,
and power quality.
Now, one of the real challenges though,
when we're dealing with environmental controls
and environmental systems
is that our environmental systems are very often,
and actually more often than not,
either provided by or managed by contractors.
So we wanna make sure
that our environmental system providers
are subject to due diligence investigations,
and absolutely included in our vendor management program.
And that environmental controls
and products should be included
in our vulnerability management,
in our patch management,
in our disaster recovery,
in our business continuity,
and in our assessment and audit programs.
So let's talk about some Environmental Baselines.
What works, what doesn't work?
What you should have,
don't wanna have,
in terms of temperature,
humidity, power, and fire.
So acceptable temperature
for an area containing computing devices
is between 18 to 27 degrees Celsius
or 64 to 80 degrees Fahrenheit.
Really the same type of temperature
that you and I like and feel comfortable in.
We also have to take into consideration
the circulation in the room,
because we could end up with hot spots and cold spots.
Now, humidity is bad on either end of the spectrum,
high humidity or low humidity.
Because high humidity can cause corrosion
and low humidity can cause excessive static electricity.
So relative humidity between 50 to 70% is acceptable.
Now it's a little challenging.
You pick up different books
and there might be 65 to 80
or 45 to 65.
It doesn't seem to be one standard
that you'll read about all the time,
but the numbers I'm using
are from the American Society of Heating,
Refrigerating, Air-Conditioning, and Engineering.
So they're really ranges.
But what you think to think about humidity is,
we don't want high humidity
and we don't want low humidity.
We want a midpoint.
And then for power,
we want continuous clean or filtered power
with very consistent voltage.
And then fire,
we wanna make sure that we have done everything we can
to prevent fires,
but that we also have really top-notch fire detection
and suppression capabilities.
We're gonna talk more about power and fire
in just a moment.
So we talked about temperature a moment ago.
I mentioned that we need to be cognizant of circulation.
And we need to be cognitive circulation
because we don't wanna end up
with any really hot pockets in our data center.
And I want you to imagine kind of
an old traditional data center
where we had rows and rows
and rows and rows and rows of devices
and they all face the same way.
And we know that devices take in cooler air in the front
and they exhaust warmer air out the back.
So imagine we've got five rows.
First row takes in cooler air
and it's a little bit warmer that it exhausts.
The next row takes in that warmer air
and what it exhaust is even warmer.
And the next row takes in that even warmer,
and what it exhaust is hot.
And by the time we get to the fifth row,
they're taking in hot air,
which they should not do.
And what they're gonna expel is even hotter.
So we don't like that design.
And the more common design we're gonna see now
is what's known as a Hot Aisle,
Cold Aisle Data Center,
where we've got Hot Air Returns on the ceiling,
we've got Cold Air Supply coming in from the bottom,
and our racks are staggered.
And you can see all that demonstrated in this picture.
Next, let's look at Power Protection.
We need to have clean, consistent power,
and we're protecting our devices from brownout,
sags, surge, spikes, and blackouts.
A brownout is a prolonged period of low voltage,
definitely not good for our equipment.
A sag is a moment of low voltage.
A surge is a prolonged period of high voltage.
Again, definitely not good for our equipment.
A spike is a moment of high voltage
and could be enough to fry our equipment.
And a blackout will be a prolonged period without power.
So what can we use for Power Protection Controls?
Well, voltage regulators,
surge suppressors, power line conditioners,
battery backups or uninterruptible power supplies.
All of those really help with brownout,
sags, surges and spikes.
And for a blackout,
well, we want Power Resiliency Controls,
which can include a battery backup
or uninterruptible power supply,
which, the caveat, it does have a limited life
'cause batteries only just go for so long.
Or we could have a generator, right?
To have a second supply of power.
But I want you to also recognize
that a generator does require fuel.
It require diesel or gas,
so you have to have that supply.
Or maybe supplier diversity.
Maybe we are connected to more than one power source.
Next step is Fire Detection and Suppression.
We know that fire is extraordinarily dangerous
to people and to equipment.
So Fire Detection, it being the identification
of a fire situation.
Fire suppression is once it's identified
to be able to quickly respond to
and extinguish a fire.
So when we're making our plans
about Fire Detection and Suppression,
we really, really, really wanna consult
with the local fire department.
Every local fire department,
pretty much worldwide,
is happy to help you out on this, right?
They don't wanna see a fire any more than you do.
You're gonna install good fire detection equipment,
you wanna have fire alarms with strobe lights.
So not just audio, but also lights.
We may have folks who are hearing impaired,
we wanna make sure that we're taking care of them as well.
We wanna have an emergency power-off electrical switch.
So we wanna be able to shut down the power right away.
So maybe in our data center
there's a power switch that shuts everything down.
We wanna locate portable fire extinguishers
in places that are accessible
and we wanna train people on where they are.
We also wanna train people
on how to use a fire extinguisher.
'Cause I'm willing to bet,
that most of you have actually never used
a fire extinguisher.
It's worth knowing.
Then we wanna make sure we're using
clean fire suppressant agents such as FM-200 or Novec 1230,
or an inert gas that won't damage our electronic equipment.
Because if the fire isn't there, right?
With the fire out,
what we don't wanna have done is damage our equipment
by whatever fire suppression we used.
And then we wanna make sure
we maintain fire suppression equipment.
It has to be inspected on a regular basis
and whoever you got your equipment from
will help you with that.
We also wanna make sure that we are protecting our,
all of our components,
electronic components,
and our cables from ESD, EMI, and RFI.
Electrostatic Discharge,
Electromagnetic Interference,
and Radio Frequency Interference.
Now, Electrostatic Discharge or ESD
is the release of static electricity when two objects touch.
It's like, "Ouch," when you get a shock, right?
ESD can damage or can completely destroy
our electronic components.
Now, ESD can be minimized
by using antistatic grounding workbenches,
mats, bags, and wristbands.
And electrical storms can increase ESD risk.
It's like at home, whenever there's a lightning storm
I disconnect everything.
I don't just shut everything down,
I disconnect all my equipment.
Now, your equipment and your copper cable
is really sensitive to both EMI,
Electromagnetic Interference
and RFI, Radio Frequency Interference.
So equipment should have really limited exposure
to things that cause EMI and RFI like magnets,
fluorescent lights, electric motors, space heaters,
and actually wired access points
where you're putting them up in the ceiling.
And your copper cable should always be shielded.
Now, if you have fiber optic cable
it doesn't need to be shielded in your building,
but often, it'll be shielded in the ground
because critters really like to chew
on those fiber optic cables.
And that, my friends,
is all about environmental security.
So let's do our Three-Second Challenge.
Five challenge questions,
three seconds each.
You know how to do this.
Circulation pattern where rows of servers are oriented
so that the front of servers face each other.
What is this?
One, two, three.
That was our Hot Aisle, Cold Aisle.
So we have different configurations
but we're not all going the same way.
This environmental hazard can be minimized
by using antistatic grounding workbenches,
mats, bags, and wristbands.
One, two, three.
That's gonna be electrostatic discharge or ESD.
What's a prolonged period of low voltage?
Prolonged period of low voltage.
One, two, three.
That's gonna be a brownout.
Number four, clean fire suppression agent.
It's the one that's not gonna damage your equipment.
You're thinking, "Oh, oh, I remember what it is."
One, two, three.
FM-200 or Novec 1230,
or any of the inert gases.
And lastly, number five.
The act of researching and investigating
a vendor before entering or renewing
a business relationship or contract.
I use this term really quickly.
You may not have picked up on it.
We will be talking more about it a little bit later on,
but if you know it,
go ahead and shout it out.
One, two, three.
And that's due diligence.
Due diligence is the act of researching
and investigating a vendor before entering a contract,
before renewing a business relationship or contract,
and actually during the whole relationship
of the relationship. (chuckling)
So that is due diligence.
That brings us to a Security-in-Action case study.
This one's about Environmental Evaluation.
Your organization has decided
to move the in-house data center
to a colocation facility,
and you've been tasked with evaluating
the site's environmental controls.
So what are you gonna include on your Evaluation Checklist?
You're gonna create an Evaluation Checklist.
Things you wanna look at, right?
From an environmental security perspective
what's gonna be on that list?
Go ahead and put me on pause,
write up a list.
When you're ready, come on back
and we'll do an Evaluation Checklist together.
So things you might include.
First, your HVAC controls.
HVAC's heating, ventilation and air conditioning,
including temperature,
humidity settings, and monitoring.
The airflow, including the placement of racks and servers.
Remember we looked at hot and cold aisles,
as well as how the air comes in and goes out.
Power conditioning.
Power consistency.
Having a UPS, or do they have generators?
Do they have fuel for the generators?
Do they have supplier diversity?
Maybe being connected to more than one grid.
ESD, EMI and RFI protection.
Fire prevention, detection,
and suppression capabilities.
Infrastructure, management, monitoring,
and response capabilities.
Are they paying attention?
And are they using any third-party suppliers or providers,
which would, in fact, become your fourth parties.
So you wanna know who they're using as their vendors.
So being able to create this type of checklist
and then go out to that colo facility,
ask these questions, right?
Analyze, make a determination and a recommendation.
That, my friends, is Security in Action.
Okay, that brings us to our word cloud.
You know what to do.
When you're ready, I'll see you at the next lesson.