Most, if not all, data centers hold at least some data that is considered sensitive. That data may be protected by law or by regulatory compliance programs. Data security is therefore a top priority for all data centers. Data segregation and access control play a key role in ensuring data security. Here is a quick guide to what you need to know.

Understanding security concerns in data centers

At a high level, data security in data centers is focused on protecting the confidentiality, integrity, and availability of data. In other words, data security is about protecting data from theft, loss, and damage (corruption).

The key security hazards are deliberate attacks, technological incidents, and natural disasters. Deliberate attacks can require physical access to the premises but can also be carried out remotely. Current popular strategies include DDoS attacks, ransomware, and variations of social engineering (tricking staff into breaching security).

The basics of data segregation

Data segregation involves separating data into distinct categories based on its sensitivity and usage. Its main benefit is that it helps to limit the potential damage in the event of a security breach.

Methods of data segregation

There are currently four main types of data segregation commonly used in data centers. Here is an overview of them.

Physical segregation

Physical segregation involves storing different categories of data on separate physical hardware. This can mean using distinct servers, storage devices, or data centers for different types of data.

Logical segregation

Logical segregation leverages virtualization technologies to create separate environments within the same physical infrastructure. Virtual machines (VMs) or containers can be used to isolate different data sets, ensuring that sensitive data is kept separate from less critical information.

Network segregation

Network segregation involves dividing the network into smaller, isolated segments, often using techniques such as VLANs (Virtual Local Area Networks) or subnetting. Each segment can be governed by specific security policies, restricting access based on the sensitivity of the data.

Data encryption

Data encryption is a software-based method that segregates data by converting it into an unreadable format, accessible only to those with the appropriate decryption keys. Encryption can be applied to data at rest (stored data) and data in transit (data being transferred).

The basics of access control

Access control is the process of regulating who can access data and what they can do with it. By limiting the number of people who can access data and restricting what they can do with it, data center operators can limit the data’s exposure to potential harm. This includes harm that is purely accidental as well as malicious damage.

Types of access control

There are five main types of access control commonly used in data centers. Here is an overview of them.

Role-based access control (RBAC)

RBAC is a widely used access control model that assigns permissions to users based on their roles within an organization. Each role is associated with a set of permissions that determine what actions the user can perform and what resources they can access. RBAC simplifies access management by grouping users into predefined roles, making it easier to administer permissions and ensure consistency across the organization.

Rule-based access control (RuBAC)

RuBAC is a variant of RBAC where access control decisions are based on predefined rules or conditions rather than user roles. In RuBAC, access control policies are defined using rules that specify conditions for granting or denying access to resources. These rules can be based on various factors, such as user attributes, resource properties, or contextual information.

Discretionary access control (DAC)

DAC is a decentralized access control model where data owners have the discretion to determine who can access their resources and what permissions they have. In DAC, access control decisions are based on the discretion of the resource owner rather than predefined rules or roles.

Mandatory access control (MAC)

MAC is a strict access control model where access decisions are determined by a central authority based on the security classification of data and the clearance level of users. Users are assigned security labels or clearances that dictate what data they can access and what actions they can perform. MAC enforces a hierarchical access control policy, where users with higher clearances can access data classified at lower levels but not vice versa.

Attribute-based access control (ABAC)

ABAC is a dynamic access control model that evaluates access decisions based on multiple attributes, such as user attributes (e.g., role, department), resource attributes (e.g., sensitivity level, location), and environmental attributes (e.g., time of day, network location). ABAC policies are defined using a set of rules that specify conditions for granting or denying access based on the attributes of the user, resource, and environment.