Data centres invest heavily in layered physical security: fences, guards, card readers, mantraps, biometrics and cameras on every corridor. Yet the people who maintain them come and go all day, equipment arrives in large boxes through loading bays, and engineers from dozens of customers need access to their racks. Every one of those legitimate routes is a potential way in.
What an attacker wants
Physical access to a server or network device can bypass almost every digital control. An attacker might aim to plug in a small device, copy data from a drive, damage equipment or simply prove that they could have. For colocation providers, a breach of one customer’s space can undermine the trust of all of them.
How we test
Authorised testers attempt to pass through each layer in turn: the perimeter, reception and visitor processes, contractor and delivery routes, internal doors and mantraps, and finally cages and racks. Social engineering, such as posing as an engineer or a courier, is often the most revealing part.
Protecting operations
Testing is planned carefully with your operations team so that live services are never put at risk, with clear rules on what may and may not be touched.
Reporting
You receive a step-by-step account of each attempt, what worked, what failed and why, with recommendations mapped to each layer of defence.
Pair physical testing with technical penetration testing for a complete view. Scope a data centre test.
