Risks for Servers and How to Protect Against Them

The IT infrastructure ensures that things work for most companies today - and in many cases, that work can be done at all. Many companies feel very secure because they have securely housed their network servers in their own server room. However, this attitude largely underestimates the actual risks that servers face in reality. This attitude is also often responsible for important security measures being taken too lightly or even omitted altogether.

In our article, we inform about the main risks for servers, underestimated sources of danger, and effective and sensible measures for risk prevention.

Various Risks for Servers

When it comes to hardware servers, it is important to remember that they are physical devices in a data centre. Servers are also very sensitive devices as computers, which can be severely affected by various damaging events. As a possible consequence, one should not only consider hardware failures, but also potential data losses and revenue losses if work cannot be done or is not done correctly. By the way, you can find more information about server failures here.

Do Not Underestimate Natural Events

The ever-advancing climate change has brought us a steadily increasing number of natural disasters in recent years, against which we must prepare:

• massive thunderstorms
• storms, hurricanes, and spring tides
• frequent heavy rainfall events, often leading to floods and inundations
• massive hail events, avalanches, and mudslides

All of these natural disasters can not only lead to direct destruction (flooding, lightning strikes) but also indirectly cause hardware failures: a complete power outage for several hours or even days ("blackouts"), occurring power surges, or the collapse of entire supply lines (electricity, water, heating, internet connectivity) in whole areas. Finally, fires and blazes also belong on the list of potential secondary hazards.

Sabotage Acts and Cybercrime

On the human level, our world has become significantly more insecure in the last two decades: According to a study by Bitkom, in the years 2020/21, nine out of ten, precisely 88% of all German companies were affected by cyber attacks. Cybercrime is on the rise - and the damage it causes is enormous. It amounts to over €220 billion - every year.

Ransomware attacks, DDoS attacks, or hacker intrusions are very real threats to servers, and they have now become common sources of danger in our daily lives.

By the way, you can find some practical tips to protect your website from malware and hacker attacks at this link.

Aside from the increasing cybercrime, direct targeted attacks and sabotage acts by individuals or groups pose a significant risk today. This now affects not only "controversial" companies, but almost all businesses. There are almost always individuals who have something against what a company is doing or trying to achieve. This ranges from dissatisfied employees post-termination to various radical or extremist groups.

Accidents and other non-intentional damaging events

Human error or negligence often leads to hardware destruction, data loss, or an accident: this could be an unintentionally triggered fire in the premises, or the accidental installation of malware. In other cases, the negligence of a member may enable individuals with harmful intentions to enter the premises or server room.

The number of potential sources of danger in this area is enormous, and in practice, it is often complex to fully protect against such damaging events.

Measures to prevent dangers

Given the numerous potential sources of danger, it is necessary to take comprehensive security measures to minimize the risk of damaging events and threats to servers as much as possible. If protection concepts fail, there is a risk of serious data loss and significant revenue losses as consequences. The actual physical destruction of hardware often fades into the background compared to the extent of the damage. The danger is very real.

Comprehensive fire protection measures

Today, efficient fire protection measures are already required for commercial buildings to minimize possible damage to people and property in the event of a fire and to prevent fires as much as possible. Fire protection and fire prevention regulations in Germany are extremely strict.

When it comes to protecting the server room from fire and other incidents, it is essential to go well beyond these legal minimum requirements. The occurrence of fires in server rooms must be prevented at all costs and by all means possible. This requires powerful, individually tailored fire protection concepts that should be developed in collaboration with the relevant experts.

Comprehensive Prevention against Power Outages

Power outages are one of the primary causes of downtimes. The causes of power outages can include natural disasters, lightning strikes, as well as careless excavator operators in the vicinity or disruptions in the internal electrical system. It is crucial to be aware of all these sources of danger and to try to secure oneself as much as possible.

In many cases, a powerful uninterruptible power supply (UPS) can be a very effective protective measure. It protects against:

• Power outages
• both undervoltage and overvoltage
• frequency variations and harmonic distortions

Depending on the individual risk, the additional installation of an emergency power supply system (EPS) may also be advisable. An EPS is not a substitute for an uninterruptible power supply, as switching to emergency power usually results in (to be avoided at all costs) interruptions in the supply.

Security Concepts for IT Security

IT security concepts are not a one-time task but require ongoing adjustments to address threats. It is essential to protect against attacks on software, network protocols, and the network structure itself. This includes robust protection against possible brute-force attacks and so-called social engineering methods, as well as safeguarding against potential DoS and DDoS attacks.

Equally important is the physical protection of the server room, such as highly restricted access ideally under constant strict surveillance. Effective access control often acts as a strong deterrent and frequently discourages thoughts of potential sabotage acts. The psychological effect also plays a significant role here.

Other possible measures include reducing the complexity of the network as much as possible. At the same time, one should always be aware of the risks of edge computing ("networking to the edge") and address these risks as effectively as possible.

Protection against Human Errors and Failures

Human failures and errors still pose significant risks to servers, data integrity, and networks in the end. Accidents or configuration mistakes can happen from time to time - these risks can be significantly reduced through appropriate security training. Ideally, security training should also extensively cover the correct response to any damage already incurred, in order to minimise the risk of further damage in case of emergencies.

Additional Important Measures

By implementing the above-mentioned measures consistently and professionally, the most critical risks to servers can be effectively mitigated. However, it is also important to always consider a number of more general recommendations:

• Protecting the server room from dust, moisture, and temperature fluctuations
• Regular, adequate, and reliable data backups, with regular checks on the usability of backups
• Continuous and thorough retraining of all employees on security-conscious behaviour and existing risks
• Developing inspection routines to ensure correct installations and maintenance
• Especially in highly distributed infrastructures, ensuring constant control over the entire network (Out-of-Band Management instead of In-Band Management)

Image credit: Gerd Altmann on Pixabay