Some of the main topics in this chapter are
Security Issues As operating systems and hardware grow more complex, it's easy to overlook the most basic aspects of running an IS department. The environment you create for your servers can literally make or break your department. The last thing you need is downtime caused by an environmental flaw. This is especially tragic because you can avoid this problem completely with proper forward planning of the environment. This chapter points out the most common areas of failure due to environmental problems while showcasing examples of how a lack of planning can cause real-world disasters.
The computer room is sometimes viewed as the catchall room by corporate management. In an effort to conserve resources, many companies place anything that even remotely resembles a computer in the computer room. Because the computer room is usually the most expensive room in the building, the cost is offset by offering a corner for the air-conditioning controls, a table for the security equipment, and a wall for the phone switch. This is especially true for smaller companies with tighter budgets and limited space.
This shared environment raises some new political and functional issues. For instance, if the air conditioning controls are located in the computer room, you have to alter your security policies to allow maintenance workers access to their system. If the security system is in the computer room, you might inherit the additional responsibility of changing videotapes along with your backup tapes each night. On the functional side, placing the phone switch on one wall might affect the placement of racks and patch panels. You might also need to reserve a space next to your servers for the voice mail system. These types of considerations need to be introduced in the earliest planning stages of your computer room. This section introduces you to some of the most common equipment you can expect to see in the computer room.
The patch panel is the heart of a structured cabling system. In most new offices, each desk has a small box below the desk that contains a number of RJ-45 ports. The cables connected to these ports converge to a common point. Depending on the design of the structured cabling system, these cables are eventually routed to a patch panel, a big panel full of RJ-45 ports. The ports are labeled with the corresponding port under one of the desks. This enables you to patch one of the ports under an employee's desk to a desired piece of equipment, such as an Ethernet hub or the phone switch. The patch panel enables modularity in the cable system. In a small office, there might be only one patch panel, but larger installations might choose to place patch panels in wiring closets on each floor. The patch panel is a common sight in most computer rooms.
NOTE: Category 5 cabling is generally used in a structured cabling system. This is data grade cable and can be used for a network connection, a phone, or even a serial connection.
A punch-down block is another type of wiring hub used in a structured cabling system. Rather than using RJ-45 ports, the punch-down block attaches directly to the exposed wires. A punch-down block is a small plastic chassis with several exposed leads sticking out. The Category 5 cables that run to the punch-down block are not fitted with RJ-45 connectors. Instead the individual wires are exposed and "punched" into the corresponding leads on the punch-down block. Punch-down blocks are not modular like patch panels and typically are used to wire permanent connections. They're attached directly to the wall and can easily dominate an entire wall of the computer room.
Hubs are the heart of any 10BaseT network. Depending on the size of your installation, you can see as many as ten or as few as one in the computer room. In an office with multiple floors, you'll undoubtedly have a wiring closet on each floor with hubs routed into your network backbone. Single level installations will place all the hubs in one location. The two types of hubs are passive hubs and smart hubs. Passive hubs simply act as a physical wiring center, enabling signals to travel from one cable to another. Smart hubs add features such as signal regeneration and segment monitoring, which enables the administrator to monitor activity on each port without having to install management software on the client PC. Most hubs can be managed with Simple Network Management Protocol.
Routers perform intelligent routing of network packets between two networks. They enable machines on the local network to communicate with machines at another site or on the Internet. The router uses a routing protocol that enables it to forward packets to find the most efficient path to the remote network. The router also receives packets from other networks destined for the local network. Routers can also be managed with SNMP and can provide usage data to the administrator.
Remote access has become a standard requirement for many companies. The cost benefits of telecommuting and regional sales teams have made this an attractive, low-cost solution. Many different types of network and server-based remote access solutions are available. Depending on the solution you choose, you'll most likely need to plan for modem banks. Modem bank configurations vary from placing ten external modems on a table to using an integrated shoebox-sized case that holds 32 modems. The second half of a remote access solution is the RAS server. This can be either a server running a remote access service such as Windows NT's RAS Server or a dedicated network communications server. Whichever solution you select, you need to plan for the space requirements and the cable mess.
Another common sight in the computer room is the redundant power supply. Depending on the size of the office, the power strategy could call for upward of ten power supplies, ranging in size from a shoebox to a television set. Because the equipment in the computer room is vital to the day-to-day operations of the company, you cannot risk downtime due to power failure.
Redundant power supply units have evolved from simple battery backups to intelligent, managed power systems. Many of them have OS specific services that monitor power conditions, send warnings based on user-defined parameters, and perform graceful shutdowns in the event of a complete power loss. Some power supplies contain SNMP management modules that enable centralized control of power to each system. These intelligent systems can also condition the line by partially activating the battery during power sags and clipping power spikes.
There are also options to install extra batteries on these systems. The batteries range in complexity from managed units to car batteries. Extra batteries give you the capability to keep your systems up in the event of extended power loss. Just remember that they're big and heavy--make sure that you have enough room to accommodate them.
Of all the equipment in the computer room, the phone switch is the most mysterious because its operation is not generally the responsibility of the system administrator. Usually, the office manager is responsible for adding extensions and voice mailboxes, and your service provider does any serious maintenance. The switch itself is usually just a big box hanging on the wall. Depending on the size of the system, there also might be a separate box that handles the voice mail. Because the system administrator is usually not responsible for the operation of this equipment, you only have to concern yourself with its location and space requirements.
The type of security equipment you see depends on the type of security installed in the office. In a leased office suite, you probably don't see any because the property management company probably handles security. In a company-owned building, you might see one or more of the following:
From a technical standpoint, you probably would consider hubs or routers the most useful equipment in the computer room. From a functional standpoint, the most useful equipment is a rack, a floor-mounted frame to which you can attach most of your equipment. Racks enable you to put all this equipment into a limited amount of space. Standard rack width is 19 inches. Hubs, routers, remote access equipment, power supplies, and patch panels are all available in rack-mounted configurations. Several server manufacturers are shipping rack-mounted servers, as well. By using racks, you require less furniture in the room. This leaves more room for your equipment and helps reduce the rat's nest of cables.
The computer room is usually the most expensive room in the building and rightfully so. This room contains nearly all the capital assets in the company and is directly involved in day-to-day operations. You don't want to run the risk of interrupting the business process because of some environmental problem. There are several factors to consider when planning the computer room, including the location of the room, the configuration of the room, and environmental considerations.
When planning a computer room, this is the logical starting point. Be sure to address the following location issues when you plan your computer room.
Security. There is a reason that most computer rooms
end up in sub-basement twelve. It's much easier to secure a room in an unpopulated
area. Because your security strategy is based on access restriction, an isolated
area can be more easily monitored. If the computer room is located in an isolated
basement, you can restrict access to the entire floor. This adds a second line of
defense to your equipment.
Proximity to IS staff. It's imperative that operators and administrators be
near the equipment. Running down three flights of stairs when there's a problem can
easily bruise the morale and bodies of your staff. Some companies actually seat IS
personnel in the computer room. This is the best way to catch problems before your
users start calling.
External Environmental Considerations. These considerations vary from region
to region and are based on common sense. If your office is in a flood plain, don't
put the computer room below ground level. If your site is in Tornado Alley, consider
placing the computer room toward the center of the building. It's a good idea not
to place the room (the whole building, for that matter) at the base of an active
volcano.
The next step is to figure out the best way of configuring the room. Keep in mind
that you want the room to be both functional and efficient. Try to keep all related
components together. Routers should go near the hubs and so forth. When you place
your racks, be sure to leave enough room to get behind them. Racks are bolted to
the floor, so after you install them, you'll have to live with them. There
are several other factors to consider as you plan your room configuration.
Planning the Floor. Now that you have decided the location of the room, decide
what type of floor is required. The most common is the raised-floor approach. This
type of floor allows air to circulate beneath the equipment and also hides much of
the cable. Another approach is to use an anti-static tile. This special type of tile
is installed over a thin copper sheet that virtually eliminates the static in the
room. This solution is ideal for smaller computer rooms that don't generate as much
heat. In a leased office situation, you might not have a room available that is not
carpeted. In this case, it's imperative to install anti-static mats in the room.
Temperature and Humidity. The equipment in the computer room generates much
more heat than any other room in the office. It's imperative to provide separate
environmental controls for this room. Each piece of equipment has an optimal operating
temperature. The best way to plan your temperature is to review the documentation
for each piece of equipment and keep the room set to the lowest temperature required.
Humidity is also used to control static electricity. Your equipment documentation
should also list the maximum amount of acceptable humidity. Keep this in mind as
you plan your environment.
NOTE: If your computer room relies on the central HVAC system to provide cooling, you might want to consider a supplemental air conditioning system. These systems can be installed in the ceiling of the room to provide greater control over the environment.
Static Awareness. Static electricity is the number one enemy of any electronic equipment. Following are several precautions you can take to virtually eliminate static electricity in the computer room:
System administrators have a lot to worry about. Security problems, viruses, and data integrity issues are growing more and more complex. Unfortunately, many administrators only plan for disasters on a logical level of abstraction. You might be prepared to fend off security intrusions and device conflicts, but what would you do in the face of a natural disaster? Do you have a plan that addresses fires or extended power loss? What is the plan of action if a tree crashes through your network operations center and severs your cable system? The chances of such a disaster are slim, but if you want to keep your job, you'd better be prepared. The last thing your superiors will want to hear is that you were caught unprepared.
The method you use to create your disaster plan should vary from region to region. Offices in Kansas need to pay close attention to the perils associated with tornadoes, whereas sites on the banks of the Mississippi River should keep their servers well above the flood plain. All disaster plans should address two common goals:
NOTE: It's a good idea to stage disaster drills. These can be as simple as creating a situation to discuss during a departmental meeting. It's also a good idea to have your staff perform a full restore of at least one of your servers to a spare machine. Most of us spend our time planning for disasters but don't get much experience actually recovering from them. By staging drills, you can expose areas of the recovery plan that need improvement while providing valuable experience to your staff. Successfully restoring the system in a test situation will give you the added peace of mind of knowing that your recovery will indeed work in the event of an actual disaster.
The furniture in your computer room needs to provide a functional workspace and room for future growth. Several companies provide solutions ranging from inexpensive tables to fully customized units. The furniture you choose will affect several of your computer room goals. For example, locked cabinets provide more security than open racks. Modular furniture provides cable management, whereas regular tables don't. Some customized solutions provide power management and static discharge in the furniture itself.
When choosing your furniture, break your decision-making process into two areas, functional workspace and equipment storage. Depending on your situation, you need to decide what percentage of your computer room to give to each. It might be less expensive to buy ten cabinets rather than than five cabinets and a modular desk, but nobody wants to stand in front of a cabinet for three hours just to access a server. When something goes wrong and you have to spend 12 hours Troubleshooting:, you'll be glad you included a functional workspace. On the other hand, too much workspace can take up the entire room. Each room requires its own delicate balance of the two.
Functional workspace is the area of the computer room where people perform system maintenance, Troubleshooting:, and configuration. Depending on the furniture you choose, working in the computer room can be either comfortable or miserable. Two required areas comprise the functional workspace:
Because most equipment is available in a rack-mounted configuration, your main choices here are racks or cabinets. Racks are open frames mounted to the floor, whereas cabinets are basically racks in a locked box.
TIP: You can get cabinets with shelves if your equipment is not rack-mountable.
The main difference between the two is security. Cabinets can be locked, adding another level of security to your room. The disadvantage of cabinets is that the equipment is harder to access. Most cabinets have open backs, enabling access to the rear of your equipment. Aside from negating the security benefits, this means you have to place the cabinets away from the wall. Because they're usually about one foot from front to back, they take up a considerable amount of space. Also, you need to have your key handy whenever you need to get to the equipment. Again, you need to balance your security needs with your functional requirements.
Since the dawn of the electronic age, mankind has struggled with the problem of cable management. This problem is multiplied in the computer room because each server has up to ten cables sticking out of it. Hubs can contain as many as 25 cables each. At home, you can just throw wires behind the couch, but in the computer room, that's not an option. Forward planning is the key to successful cable management. If you wait for the mess to appear before you act, you can easily spend an entire night plugging and unplugging equipment in a futile attempt to organize your cables. There are two approaches to handling cables, cable management systems and cable minimization.
The key to office-wide cable management is a structured cabling system. Structured cabling systems are usually installed during construction of an office building. This type of system puts a predefined number of RJ-45 jacks under each desk that correspond to ports on a patch panel. If your hubs are on one side of the room and your servers are on the opposite side, you don't want to run cable from the back of each server, across the room, into the hub. With a structured cabling system, you plug each server into a nearby jack; then plug the corresponding port in the patch panel into the hub. Of course, this only helps if your patch panels are next to the hubs. Remember that planning is the key to a successful room.
Several types of systems manage the cables associated with your servers. These include cable ties, basket systems, and systems integrated into modular furniture.
TIP: Many cable manufacturers offer cables in a wide variety of colors. Color-coding cables by function makes it easier to identify them later.
Cable Ties. Cable ties are used to bundle cables traveling to the same location. For example, all cables traveling from a patch panel to a hub can be bundled together with cable ties. By using cable ties, you can reduce the number of individual cables traveling to the same location. Cable ties range in construction from plastic twist ties to Velcro straps. When used in conjunction with other cable management systems, they provide an excellent tool for reducing the cable mess.
Basket Systems. Basket systems can be installed on almost any type of furniture from a table to a customized workstation. A basket is installed at the rear of the table or directly to the wall. The cables are then routed through the basket to the desired location. By attaching a basket system to the wall, you can run cable all the way around the room. The problem with this type of system is that it usually becomes a basket full of tangled cables. To avoid this, always use cable ties in conjunction with baskets.
Integrated Cable Management. If you're planning to purchase modular furniture, you'll more than likely have an option for integrated cable management. Integrated cable management solutions range from basket style systems to complex cable wrapping equipment. Most modular server furniture also has built-in power sockets, enabling you to plug the furniture into your power system and then attach your server's power cable to the furniture. Many modular systems are constructed of hollow aluminum that enables you to route your cables through the furniture itself. An integrated solution usually provides the most effective cable management because it's planned in the design of the furniture.
Raised Floors. Raised floors are designed to circulate air under the room. They have the added benefit of giving you a place to hide your cables. If you rely on a raised floor to hide your cables, remember that out-of-sight does not necessarily mean out-of-mind. If you drop your cables under the floor without planning, you only succeed in creating an invisible mess. The day will come when you need to pull tile to trace a cable. A little planning now can save you from a miserable time later. Again, you can use cable ties to enhance the functionality of your current solution. Remember that the purpose of cable management is not just to hide the cables but to create a functional cable system.
The second approach to cable management is to minimize the number of cables you need in the room. This is accomplished by reducing the total number of peripherals in the room. Many solutions on the market enable you to combine the equipment you need into integrated units. An integrated unit enables you to combine two or more pieces of equipment into a single unit.
Switch Boxes. A switch box enables you to use
one keyboard, mouse, and monitor for multiple servers. By removing just one monitor,
mouse, and keyboard, you remove four cables from the workspace. If you put 5 servers
on one switch box, you remove 12 peripherals from the room while pulling 16 cables
from the workspace. Remember that each server will be connected to the switch box
3 times, so you will not actually remove the cables from the room. You will, however,
remove them from your functional workspace, which will visibly unclutter the area.
I've seen many computer rooms in which unlabeled keyboards and mice are spread across
a table. Using a switch box can make life much more comfortable for you and your
staff.
NOTE: I recommend using only 1 monitor, keyboard, and mouse for every 3 servers. This enables you to remove 6 peripherals (2 monitors, 2 keyboards, and 2 mice) while providing easy access to each machine.
Integrated Peripherals. Integrated peripherals can cut in half the amount of required space in a room. In doing so, the cable requirements are also substantially reduced. Integrated peripherals combine the functions of multiple peripherals into one case. For example, instead of buying 16 separate modems for a remote access solution, you can buy an integrated modem bank that combines 16 modems into one box. Integrated networking chassis also are available that enable you to plug hubs, routers, and switches into one case. The case provides primary and redundant power to the individual components.
The final stage in planning the room is determining the security requirements. Room security should be designed in stages. The more stages you have, the more secure your room will be. Stages of security should include policy, physical security, and logical security.
When most people think of security, they think of electronic keys, passwords, and video cameras. These are certainly the most visible components of your security system, but these items are really just tools used to create a state of security. To truly understand what security is, you need to examine its basic concept. Security is a state achieved by placing restrictions, and to place restrictions, you need rules. You create these rules in the form of a security policy that should be enacted and enforced as an official company policy. I cannot stress enough the importance of getting your policy adopted as a company rule. The entire concept of security is based on rules. If there were no laws to enforce, there would be no police, and therefore no security.
Depending on your company, the security policy can be as simple as a list of people allowed in the room or as complicated as a book of rules governing company-wide system use. When drafting the section of your security policy dealing with the computer room, you need to answer one simple question. Who has a legitimate business need to be in the computer room? Don't create the list by name. Create it by position. Chances are that you'll come up with a short list.
Next, create a list of positions requiring occasional access to the room. A good example would be a sales manager touring the facility with prospective clients. The people on this list should only be able to access the room with prior approval.
The next step is to decide what hours the authorized users need access. Consider any unique situations; for example, if you back up certain servers on Sunday at 2:30 A.M., you should restrict access to those machines at that time. Your security policy will be a work in progress and will need to be updated regularly.
Your second line of defense is to secure the room itself. If you don't think about security in the early planning stages of your room, you might end up having to buy a more expensive security system to make up for a bad choice in room location. Securing the room is usually done with locks. Several types of locks can be used for the computer room.
Standard Locks. Standard door locks come in many
shapes and sizes, ranging from key locks to combination locks. They're the most inexpensive
locks and can easily be installed on any door. Combination locks are generally considered
less secure than key locks. After the combination gets out, the room can no longer
be considered secure until the combination is changed. Keys have the disadvantage
of being hard to keep up with and must be carried around at all times. The biggest
problem with either type of standard lock is that neither type can keep track of
who is accessing the room.
Electronic Locks. Electronic locks also come in a variety of styles. They're
more expensive than standard locks but also have the advantage of being able to track
anyone entering or exiting the room. Electronic locks are usually connected to an
access control system. These systems assign an access control list to each room.
Anyone attempting to enter a room is logged in a database. Electronic lock configurations
vary from magnetic keycards to optical keys to tiny radio transmitters. These locks
are far superior to standard locks for securing your computer room.
Dealing with the Politics of Locks. Locks have the tendency to create political
waves in any organization. Many people feel that being denied access to an area of
the office takes away their power. Nonetheless, resist giving access to people who
don't really need it. If they don't have a legitimate business need to be in the
computer room, keep them out. I've been in too many situations in which the Head
of Software Development or the Vice President of Marketing demanded access to the
computer room only to wander down and spill coffee on my equipment. This is where
your political skills come into play. You don't want to tell your CEO that he cannot
have access to the computer room because he gets in the way. Tell him that the static
electricity on the tenth floor is retained in his shoes due to the barometric pressure
differences at that altitude, and if he comes into the computer room without standing
on his hands, he could bring down the entire network.
Your third line of defense is in securing the actual servers themselves. There are several ways to keep the servers secured internally:
© Copyright, Macmillan Computer Publishing. All rights reserved.