Physical security for data centers in LATAM: risks your firewall does not cover

Physical security for a data center is not an add-on: it is the first layer of defense. An attacker with physical access to the hardware has access to the data. In LATAM there are specific risks that the design must address.

The five layers of physical security

1. Perimeter: fence, walls, vehicle barriers. Single pedestrian and vehicle entry point. Periodic integrity audits are indispensable.
2. Building access: turnstiles, card readers or biometrics, reception area with visual separation. No one enters without prior accreditation.
3. Server room access: stricter control, usually biometric (fingerprint, facial, iris). Two-factor authentication in many critical operations.
4. Rack access: individual lock on each rack, separate keys or codes. External providers should not have access to racks that do not correspond to them.
5. Continuous monitoring: CCTV with analytics, motion sensors outside business hours, smoke and temperature detectors. Video must be retained for at least 90 days.

LATAM-specific risks the design must address

1. Prolonged power outages: in addition to UPS, the emergency plant must support the operation of physical security (locks, cameras, access controls).
2. Climate events: hurricanes (East coast of Mexico, Caribbean), floods (coastal and riverside areas), earthquakes. The DC must be built with the local risk in mind.
3. Theft and vandalism: copper and equipment have resale value. Perimeter protection must consider vandalism, not only unauthorized access.
4. Civil protection: periodic drills, signage, evacuation routes. Local civil protection regulations are mandatory.

CCTV with analytics, not only recording

A modern CCTV system does more than record: it detects perimeter intrusion, identifies abandoned objects, recognizes vehicle plates, and alerts in real time. Passive recording only serves to investigate after the incident.

Modern analytics work in low-light conditions and integrate with the access-control system: when an unauthorized face is detected in a restricted zone, access is blocked and an alert is triggered.

Layered access control

The principle: each layer requires stronger authentication. Card alone for perimeter, card + PIN for the room, biometrics for individual rack. If one layer fails, the following ones keep protecting.

In operations with external providers (OEM technicians, auditors), access must be limited in time and zone, with an escort when the policy requires it. Accesses must be recorded and auditable.

Physical incident procedures

A physical incident (intrusion, theft, vandalism, natural disaster) requires immediate response: activate protocol, notify corporate security, document evidence, preserve chain of custody, notify authorities if applicable.

The protocol must be written, tested in drills, and known by the entire team. Improvisation in physical incidents has operational and legal consequences.

Regulatory compliance

TIA-942 includes physical-security requirements by Tier level. PCI DSS, HIPAA, and ISO 27001 also have mandatory physical-security components for certain operations.

In Mexico, local civil protection standards and SAT provisions for data centers that process electronic invoicing apply. Compliance is per installation, not generic.

Sources

[1] ANSI/TIA-942-B — Telecommunications Infrastructure Standard for Data Centers — https://tiaonline.org/products/tia-942/

[2] ISO/IEC 27001:2022 — Information security management — https://www.iso.org/standard/27001

[3] PCI DSS — Physical Security Requirements (reference): https://www.pcisecuritystandards.org/