-2

In reading a little about cloud security on platforms such as Amazon Web Services (AWS) or Google Cloud, I realize they have to hire security guards in addition to having the software-level and hardware-level security. A quick search though on "how hiring security guards works" brings up stuff like this, about how you know if you can trust the security guards basically.

So my question is along the lines of that, how you know that you can trust the security guard. Specifically (to narrow down the question), I am wondering in regards to cloud data centers like one of Google's newer ones. Those things are huge (100k sqft per building, with multiple buildings per site), and they hire lots of security guards. Amazon briefly mentions their physical security in their perimeter section as well. But to do this, you don't just go put an ad up on the internet and bring someone in for an interview, meet them the first time, spend a few hours with them to judge their knowledge/skills, and then hire them like you would do many other common jobs (probably not a doctor or lawyer though). You have to trust them, and know they won't steal anything tangible or intangible, and that they will protect the place. I don't see how you can judge that in a day or a week or even a month. It seems like these people would have to be your best friends to really know for sure that they can be trusted with the job.

So the question can be summarized as, what techniques/thought-processes/standards cloud data centers put into the hiring of security guards. Just at a high level to be introduced to the topic. The broad categories of things. I am interested to know how "good" security is at this level.

closed as unclear what you're asking by jcmack, gnat, The Wandering Dev Manager, Dukeling, Michael Grubey Dec 10 '18 at 0:48

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    HI Lance and welcome to the Workplace! Unfortunately, your question is very likely to be closed as off-topic as you are effectively asking about corporate hiring policies rather than asking about dealing with a specific workplace issue. As such, your question is too broad for the Workplace. – Jane S Dec 9 '18 at 6:12
  • 3
    You can go through a trusted security contractor, implement a sophisticated internal hiring process, or hire a biker gang depending on your business needs – Victor S Dec 9 '18 at 6:18
  • This is a workplace issue if you are a hiring manager. – Lance Pollard Dec 9 '18 at 8:32
  • No I am wondering if I use AWS if they have good security all around. – Lance Pollard Dec 9 '18 at 13:41
  • 1
    @LancePollard Check out this datacenter security overview from AWS, including physical access controls: aws.amazon.com/compliance/data-center/controls – MLu Dec 10 '18 at 2:49
11

Simple solution: Separation of duties

Your security guards won't have keys from the racks. Your hardware guys do have the keys but won't be allowed in without an approved access request. Besides neither of these two groups will probably know what any of the servers do and where to go to steal anything interesting. The guys with this knowledge will probably sit in an office maybe in a different city and won't have physical access to the DC.

So in my opinion you hire data centre guards the same way as you hire anyone else: interview, reference check, background check, etc. Nothing special.

  • Most places hire out a security firm. They do not access the sensitive areas. – Dan Dec 10 '18 at 15:27
4

At least in the US many security guards are ex-military, or ex-law enforcement. So they do arrive with experience, and a background that can be checked.

Many companies or organizations hire an outside company to provide security. The outside company provides security guards to many organizations, and in many different environments. This means they provide security to places where interaction with the public is the focus, or where there are a lot of non-security employees, or where most of the focus is in protecting stuff. The outside company takes on the responsibility of finding and vetting security personnel. The data center company then investigates the security company.

For a data center the security guards are only part of the security posture; sensors, cameras and access controls are very important. This means that ere are security roles beyond people walking around.

  • This does depend on who owns datacentres the CIA/NSA GCHQ at will have much stricter vetting guidelines. – Neuromancer Dec 9 '18 at 19:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.