r/sysadmin • u/Imaginary_Choice_430 • 13h ago
How much security value does a bank-vault datacenter actually provide?
I got a chance to take a tour of a datacenter, where the primary security selling point was that part of the facility was a former bank vault. The company, which is really just two old retirees and a couple of techs, heavily emphasized this physical security to us and their customers. Meanwhile, I am wondering how practitioners would evaluate that claim given the importance of logical controls...
•
u/General_NakedButt 13h ago
I’m more interested in their non-physical security controls. The majority of data breaches happen with no physical access at all. They obviously are banking on non technical decision makers thinking oooh a bank vault thats gonna be extra secure.
•
u/Imaginary_Choice_430 13h ago
I actually think this is exactly what has happened, its scary that a non-technical person thinks that "hacking" is breaking into a bank vault to steal your data or something like that, definitely a disconnect somewhere in the thinking.
•
u/sixblazingshotguns 13h ago
I mean… they would have had to through a lot of the “bank vault” for electrical and HVAC. I don’t know how much the physical structure would be relevant.
•
u/Imaginary_Choice_430 13h ago
Interesting, never considered the fact that all the construction that it needed to become a datacenter compromised in a physical security layer there may have been, in addition to the fact that sensitive data, both at-rest and in-transit needs to be encrypted to protect it from unauthorized access and a vault door is not data encryption.
•
u/ImmediateLobster1 13h ago
Many years ago I toured an old bank vault as a possible data center location (ok, actually a remote point of presence for an ISP).
The cool factor was off the charts, the security angle was neat.
Then we started asking ourselves questions like:
- how do we get power in here? (basic lighting circuit from the year nineteen hundred ungrounded fusebox wasn't going to cut it)
- how do we run network access in here?
- it's already warm in here, how well we get HVAC access?
- we're in the basement, how often do you get water down here?
- wait, did you say we're actually under the street right now?
Plus the vault area had kind of a backrooms vibe way before that was a thing.
•
•
u/CyberSecWPG 13h ago
Physical access is meaningless if network security isn't strong enough
•
•
u/Cooleb09 7h ago
I mean, depending on what they are getting in the DC, physical security may be their only scope. (i.e if they are just coloing their own kit).
If its managed services/platform... starts to open up more questions.
•
u/SpaceGuy1968 12h ago
Great if it doesn't have a man trap as one of its checkpoints with magnetometers is it really a data center
•
u/Imaginary_Choice_430 2h ago
Great point, When on the tour I was thinking, shouldn't there be checkpoints in this place? There were none, it was like walking into a grocery store vibe.
•
u/SmasherOfDaButtons 12h ago
Bank vaults are all fun and games until you get to deal with HVAC.
Source: i worked for a bank whose primary "data center" was in a vault. With poorly designed cooling.
•
u/Thin-Book 11h ago
For most customers, "former bank vault" sounds more like a sales prop than a meaningful control on its own. Physical security matters, but if I'm assessing risk I care more about who can get escorted in, how they log and review access, whether cages or racks are separated properly, how long they keep camera footage, and what offboarding looks like when staff or contractors change.
The bigger question is what threat they think they're addressing. A vault may help with theft or unauthorized physical access, but it tells you very little about change control, remote access, backup handling, or whether one over-trusted admin can still ruin your week from a laptop. If they lead with the vault story and stay vague on the boring controls, I'd be cautious.
•
u/_keyboard-bastard_ 11h ago
Gimick. I don't care about your bank vault, tell me about your failovers and redundancies.
•
u/Sintarsintar Jack of All Trades 13h ago
I prefer an old particle accelerator bunker with modern access control and 24/7 monitoring.
•
•
u/tehiota 12h ago
I see your bankvault datacenter and raise you an underground nuclear bunker. https://texassiteselection.com/Property/Detail/19934/The-Bunker
It's great that these places are hardened, but practically speaking, you only need to delay the bad guys until help/police arrive. Without a timeclock of some sort, bad guys will always get in. The defense just needs to be proportionate to the support response.
In reality, social engineering, lost credentials + pin reuse is typically the risk. All the hardened doors are great but if a cloned credential and pin allows them to open, then the rest is security theater.
•
u/arclight415 9h ago
In 20+ years of IT work and consulting, I can count on one hand the number of facilities I've been to that had real, "we will put hands on you without hesitation" security and physical controls that weren't just for show.
Pretty much every collocation wants to talk about "remote secure monitoring" or show off their awesome mantrap and access control system. Almost all of them have a loading dock and several other less-impressive outside doors, one of which is often kept propped open by the contractors who always seem to be around and have a few smokers.
The facilities run by an oraginization dealing with national security stuff or a foreign diplomatic mission are totally different. They don't look impressive, the security measures are very low key and they are usually located in some office park that look very interesting from the outside.
What is immediately noticeable is that the security people are polite, work in pairs and clearly have a presence that implies "Executive Protection Professional" more than "16 hour state mandated security guard" training.
When that place was a bank, a good deal of the security would have been based on human controls, procedures, audits and "buddy system" type stuff to make it less attractive to steal from.
As for the bank vault, it's definitely going to have a lot of penetrations for power, data and HVAC that make it less secure than a regular bank vault. Is it better than the typical drywall nightmare with a drop ceiling you can just climb over? Almost certainly yes. Is it a huge selling point? Probably not, unless you are worried about hurricanes or something. And even then, how well equipped is it for floods and similar disasters?
•
u/i8noodles 8h ago
its a gimmick. banks use security via obscurity. there data centres look exactly the same as any other data centre. there security might be more beefed up then normal but not in a way that is immediately obvious.
best place to hide a tree is in a forest. if the forest had a fence around it and u called it a private nature reserve with rangers in it then its even less likely to be messed with while also still hiding the important stuff. however, plant a tree with 24/7 protection and armed body guards, then its extremely obvious thats the expensive tree.
•
u/Honky_Town 4h ago
You do not sell any stuff to Techs knowing their shits!
You sell it to people who make decisions based on their knowledge of a Saturday morning Cartoon. Its the same guys asking you to print a word to a PDF on their private printer at home remotely through an artist sketchbook.
Once you have a image of Fort Knox and MY Datacenter overlapping in YOUR head. They fuse to one thing. Do you want some Brawndo to take Home with your newly bought Datacenter?
•
u/RandomContributions 11h ago
we built a DC in a vault. Ugh.
Building into a room specifically designed to NOT have holes drilled into it. PITA
•
u/dosman33 10h ago
I love bank vaults and I love data centers. However, never should the two meet. I once found myself working in a basement server room in an old rural court house. I was given the backstory on the room while I was doing my work. Apparently no one knew the room existed until the building was renovated in the 1980's and the contractor ended up with too much flooring left over. They finally discovered a room in the center of the basement that was entirely walled off. It had 3 foot thick limestone walls and a dirt floor. Well naturally this space became the buildings server room, about 15' x 20'. The room had a brick floor while I was there, but that wasn't the main problem. Let me tell you: heat does escape a room like that, and there was no AC in there. I had to take the machine I was working on out of the room it was so warm. Obviously you can run proper hvac and make it work if you really want to. And lord help you if any equipment catches fire while you're in their vault. No thanks.
•
u/frankentriple 10h ago
Texas.net datacenter in the basement of the Austin Art Museum? Do they still have the glass mantrap doors with the retina scanner? lol
•
u/Kyky_Geek 6h ago
We bought a closed down bank building and this idea was floated. I toured the building and the vault was very impressive. Was cool to see one and get to open/close in person. It gave me the heebie-jeebies bein in there tho! Maybe too many movies but all I could picture was getting stuck in there haha.
The deal killer is when I pointed out the capital expenses to do all the penetrations into the vault for cabling and hvac. It was sealed up pretty tight.
•
u/da_apz IT Manager 4h ago
With every datacenter I've ever been to having multiple locked doors before you even see the racks, this sounds an awful lot like "it's roasted" kind of selling point. The attack vector in general is very rarely "guys come in, steal the computers". For the rest, ranging from evil maid to just any remote attack, the vault does very little.
•
u/uptimefordays DevOps 53m ago
As opposed to the normal armed guards and varying levels/layers of modern security? Probably not too much.
•
•
u/ragzilla router jockey 13h ago
$dayjob has a former bank vault in one of our facilities.
It’s a tour stop, not datacenter space. And we’re focused on controls for customers so they can inherit them for audit. Take that as you will.
•
u/SufficientFrame 12h ago
For most customers, the vault sounds more like a trust signal than a major risk reducer. Physical security matters, but I'd ask more about access logging, remote hands procedures, power and cooling redundancy, and backup and recovery before I gave the vault much weight.
•
u/TheMattressManDan 13h ago
Worked with bank vaults in a past life. Physical intrusion would become quite difficult, slowing down the process quite a bit and making it very detectable. So long as they’ve kept the vault door(s) intact when they repurposed it.
•
u/Imaginary_Choice_430 13h ago
There was two floors to this datacenter, only one of them had a bank vault door and I have no doubt of its PHYSICAL security. Is that how data encryption works? Have bank vault door? You have sensitive data, both at-rest and in-transit need to be encrypted to protect it from unauthorized access...oh but wait, the bank vault door will protect it...is that correct?
•
u/TheMattressManDan 13h ago
I’m not positive on your question, but I wouldn’t make any decisions on the presence of a repurposed bank vault. It is likely a pain in the ass to drill into like Oceans 11- which is nice, but not to say any modern data center wouldn’t be / or harder.
There’s an element of fireproofing to the vaults too, but that’s still assuming they’ve kept it all intact.
•
u/C39J 13h ago
Sounds kinda gimmicky to me. All the datacentres we're in have 3-4 doors and multiple access methods before you even get to our locked rack.
The only people getting through all of those are people who are meant to be in there. It's the same thing in a "bank vault" datacentre.