Case Study: Protecting the datacentre

Mercy Medical Centre’s security wish list is far from atypical. The Baltimore healthcare provider wants to make sure that users access only the services and servers they require and that its datacentre servers remain secure and problem free. Nevertheless, it hasn't yet found quite the right technology combination.

Network access control (NAC) gear from ConSentry Networks handles the user-access-control piece, but the technology doesn't give Mercy Medical a way to address the additional, server-level security it would like. "We want to segregate the servers in the datacentre from one another," says Mark Rein, the centre’s senior IT director. The organisation needs this separation because it opens its datacentre servers to third-party vendors handling certain management and maintenance duties. "We want them to access just that one server or application, and not be able to see or talk to any of the other servers. It's like we need NAC, but at the server level."

This is not an extravagance. "The server is the primary attack-point nowadays, which means that the server is also a great jumping-off point," says Joel Snyder, a senior partner with Opus One and a Network World product tester. "As organisations have heterogeneous datacentres - mixes of Unix flavours, Windows, old mainframes - there are going to be issues with older systems that might not be patched or closely protected becoming infected and turning into attack vectors for other servers."

That can be an especially brutal problem for enterprises whose security defences line up at the edge of the datacentre. If an attack gets through to a server and rides over unprotected high-speed, server-to-server connections, the enterprise quickly gets compromised. Never mind the problems encountered when these servers exist in a virtualised environment.

"Most of our servers are virtual servers sitting in blade chassis. When you start looking at how these virtual servers are potentially talking or co-mingling over the hypervisor to one another, that's a tough problem. At this point, available tool sets are not really great," Rein says.