The Building That Runs the Cloud
Six Doors Into the Uptime Chain
An attacker doesn’t need your server rack if they can reach what keeps it running.
The front door has guards, badges and cameras. The
thermostat has none.
The doors in this chapter are like that. Nobody guards them, because most people don't know they're doors.
Door one: The vendor who never left
The HVAC contractor needed remote access during the install. So did the UPS vendor and the generator service team. Years later, those connections are still live. Some still use the original password. Nobody remembers who approved them.
A maintenance path becomes an unmanaged way in.
Door two: The controller on the internet
A building controller gets a public address so a technician can check it from home. Now anyone can find it. Chapter 4 showed how common that is.
Direct reach to the systems that control the room.
Door three: The shared password
Two hundred sensors. One password. It came from the factory, or from the installer who set them all up in an afternoon.
One stolen credential opens the whole fleet.
Door four: The flat facilities network
Cooling, power monitoring, cameras and badge readers all share one network. Sometimes it touches the office network too. Every device can talk to every other device.
One weak camera becomes a stepping stone to the cooling plant.
Door five: The alarm nobody checked
Security blocks a suspicious connection. Good. But that connection also carried temperature readings to the monitoring screen. Now the room looks calm because the numbers stopped coming.
The team loses sight of the building while believing everything is fine.
Door six: The fix that caused the outage
Someone isolates a controller in a hurry. It turns out that controller managed half the cooling units in Hall B. The attacker is out. The hall is heating up.
The security response becomes the uptime incident.
Closing the doors
Look closely at doors five and six. The danger there comes from the defense itself. That's what makes data centers different from an office.
One rule runs through the rest of this book. A response is complete when two things are true. The unauthorized path is closed. And the physical service still works.
Blocking an address is step one, never the finish line.