If you run a data center, every dollar you have spent on physical security was spent to keep people out. The fence, the lobby, the mantrap, the cage locks, and the biometric readers all assume the threat is approaching from outside. That is a reasonable assumption for part of the risk. It does nothing for the data center insider threat, which is the person who has already been badged, enrolled, escorted, and trusted, and who now has a reason to use that trust against you.
I have investigated enough internal cases across my career to know that the insider is rarely a spy in the dramatic sense. The insider is more often a technician with money trouble, a contractor who was told his contract will not renew, a customer’s engineer who is angry at his own employer, or an employee who simply decided the rules were for other people. The perimeter you built cannot see any of them because it already let them in. This article is about how to think about that population and what you can do that actually works.
Who Is Actually Inside Your Perimeter
Start by counting. Most operators think of insiders as their own employees, and that group is the smallest part of the problem. On any given day your floor holds your staff, the guard force from a contract company, your customers’ engineers who have cage rights, the cabling and cooling contractors, the equipment vendors, the cleaning crew, and whoever the general contractor sent for the expansion project. Contractors and vendors are the largest population of non-employees in your building, and they hold more active credentials than most operators realize until someone pulls the full list.
Each of those groups was vetted by someone else. Your employees went through your hiring process. Everyone else went through their employer’s process, which you have probably never seen. The guard company did its own background checks. The contractor’s foreman decided who came on site. The customer decided which of their engineers gets cage access. You inherited all of those decisions and you are accountable for the result, whether or not you ever reviewed any of them.
How the Insider Threat Forms
Insiders are made over time, not hired that way. The pattern I have seen repeatedly begins with access that was appropriate when granted and then outlived its purpose. A technician who moved to a different team still holds cage rights on his old customer’s equipment. A contractor whose project ended six months ago still badges through the mantrap because nobody sent the revocation. Access permission drift is the soil the insider threat grows in, because it creates a population of people who can go places they no longer have any business going, and nobody is looking.
The second ingredient is the absence of observation. Cameras record everything and are reviewed after the fact, if at all. Visitor logs are kept for the auditor. Escort requirements are waived for familiar faces. The person who is thinking about crossing a line notices that nobody is watching long before they act. The third ingredient is a trigger, which is usually personal and outside your control: a financial problem, a grievance, a termination notice, an offer from someone outside. You cannot control the trigger. You can control the first two ingredients entirely.
Why Your Current Controls Miss It
Badge plus biometric access proves that the person at the door is who the system thinks they are. It does not ask whether they should still be there. The mantrap stops tailgaters, when it is enforced, but the insider does not need to tailgate because his own credential works. The escort policy exists for visitors, and the insider is not a visitor. Every control in the layered perimeter was designed to answer the question of identity, and the insider passes every identity check honestly.
The controls that catch insiders are different. They ask whether the access still makes sense, whether the pattern of use looks like the job, and whether anyone noticed. Those controls require a person whose job is to review, and in most data centers physical security reports to facilities or to a network-focused CISO, and neither has anyone assigned to that work. The gap is a leadership gap before it is a technology gap.
What a Serious Program Does Differently
A serious insider threat program starts with the access list. Every active credential, at every layer, is tied to a named sponsor who has to reaffirm the business reason on a fixed schedule, and any credential without a current sponsor is disabled by default rather than kept by default. Contractor access is issued with an expiration date matching the statement of work and cannot be extended without a new request. Customer cage rights are reviewed with the customer, in writing, so that the customer’s own staffing changes flow back to you instead of staying inside their HR system.
Then the program looks at behavior. Someone reviews badge activity for patterns that do not match the job: cage entries at hours the person does not work, access to areas that have nothing to do with their assignment, repeated attempts at doors that deny them. Camera footage gets reviewed on a schedule with specific questions in mind rather than only after an incident. And the program builds a quiet relationship with HR and with contractor management so that terminations, non-renewals, and disciplinary actions reach security the same day they happen, because the window between a trigger and an act is often short.
What to Do This Month
Pull the full active credential list for every layer of the facility and sort it by the date each credential was last reviewed. If that field does not exist, you have your first finding. Then take the list of people who separated, changed roles, or whose contracts ended in the last year and check every one of them against the active list. Most operators find at least a few live credentials that should have died months ago. Disable them the same day.
Next, sit down with your HR lead, your procurement lead, and your largest contractor’s site manager and agree on how a separation or a contract end reaches security, by name, within one business day. Write it down and test it with a real case. Finally, assign someone to own the insider question as a standing duty rather than a project. My doctrine is that security should be tested rather than assumed, which I lay out in Until Tested: Security Is Only Assumed, and the insider threat is the clearest case of a risk that operators assume away because the perimeter looks strong from the outside.
Go Deeper
For a full explanation of how a part-time executive security director fits into an organization like yours, start with What Is a Fractional Security Director? The Complete Guide. My book Fractional Security Director makes the case that most mid-sized organizations have exactly this leadership gap and shows how to close it.
Commissioner William Epps is a former elected Fire Commissioner, federal law-enforcement supervisor, and firefighter since 2006, with instructor credentials in Hazardous Materials response, Active Shooter preparedness, and Stop the Bleed®. He spent seven years in federal law enforcement in physical security, executive protection, and incident command, and now serves organizations as a Fractional Security Director. He is the author of The Spirit of Saul, The Spirit of Pharaoh, and other practical books on security, leadership, and faith, built around one idea: knowledge should be practical enough to use when it matters.
Leave a Reply