Cloud Platform and Infrastructure Security · Topic 2 of 5
Designing a Secure Data Center
CCSP secure data center design: tenant partitioning and access control, location and buy or build, HVAC, multi-vendor connectivity, resilience and tiers.
- 5 min
- Logical design isolates tenants and separates administrative duties and networks.
- Location decides natural, man made and legal risks before any control.
- Buy versus build trades control against cost and speed.
What it is
A secure data center combines logical design (how tenants and administrators are separated), physical design (where it is and how it is built), environmental design (power, cooling and connectivity) and resilience so that a single failure does not stop service.
Providers do this at scale, and private cloud owners do it themselves. Either way, the CCSP expects you to judge a design and spot the weak point.
How it works
Logical design
| Element | Design goal |
|---|---|
| Tenant partitioning | Each tenant's compute, network and storage isolated through virtualization, separate virtual networks and encryption with per tenant keys |
| Access control | Role based admin access, separation of duties between facility, network and platform teams, MFA, logged sessions |
| Management network | Out of band management on a separate network from tenant traffic |
| Hardening | Secure baselines for hypervisors and management tools |
Partitioning can be logical (shared hardware with software isolation) or physical (dedicated hosts or racks) for tenants that need it.
Physical design: location
Location decides many risks before any control is chosen:
- Natural hazards: flood plains, earthquake zones, storm paths, wildfire areas.
- Man made hazards: airports, chemical plants, unrest.
- Jurisdiction: the laws that apply to data and to government access.
- Utilities: reliable power and diverse network carriers.
- Distance between sites: far enough apart that one disaster does not hit both, near enough for the required replication latency.
- Staff and access: availability of skilled people and emergency services.
Physical design: buy or build
| Option | Advantages | Disadvantages |
|---|---|---|
| Build | Full control of design, location and security | High capital cost, long lead time |
| Buy or lease (colocation) | Faster, shared facility costs | Less control; rely on the operator's controls and reports |
| Use public cloud | No facility to run | Rely entirely on the provider's audits |
Physical security layers include perimeter fencing and barriers, controlled single entry points, mantraps, badge plus biometric access, guards, CCTV, visitor escort and locked cages or racks.
Environmental design
HVAC keeps equipment within its operating range. ASHRAE guidance recommends server inlet temperatures of roughly 18 to 27 degrees Celsius. Designs use hot aisle and cold aisle layouts, containment, and monitoring of temperature and humidity.
Multi-vendor pathway connectivity means using more than one network carrier, entering the building through physically separate routes, so that one cable cut or carrier failure does not isolate the site.
Fire protection uses early detection, and suppression suited to electronics, such as clean agent gas or pre-action water sprinklers that only fill pipes after detection.
Design resilience
| Area | Resilience measures |
|---|---|
| Power | Dual utility feeds, UPS for short gaps, generators with fuel on site, redundant power paths to each rack |
| HVAC | Redundant cooling units so maintenance or failure does not overheat the floor |
| Connectivity | Multiple carriers, diverse paths, redundant core switches |
Redundancy is often described as N (exactly enough), N+1 (one spare) and 2N (a full duplicate system).
Data center tiers
The Uptime Institute tier standard classifies resilience:
| Tier | Description |
|---|---|
| I | Basic capacity, no redundancy |
| II | Redundant capacity components |
| III | Concurrently maintainable: any component can be taken down for maintenance without stopping IT |
| IV | Fault tolerant: an unplanned failure of any single component does not stop IT |
TIA-942 is another widely used data center standard.
A worked example
A government agency plans a private cloud. One proposed site is cheap but sits next to a river with a history of flooding and has only one carrier. The second costs more but is on high ground, has two carriers entering on opposite sides, and dual utility feeds.
The architect recommends the second site, designed to Tier III so maintenance never needs a shutdown. Management networks are separated from tenant networks, and each agency department gets its own virtual networks and key hierarchy.
How the exam asks about this
- "Which tier allows any component to be maintained without shutting down IT systems?" Tier III, concurrently maintainable.
- "What is the PRIMARY reason to use more than one network carrier with separate building entry points?" To avoid a single point of failure in connectivity.
- "Which factor should be assessed FIRST when choosing a data center site?" Location risks, such as natural hazards and jurisdiction.
What to remember for the exam
- Logical design isolates tenants and separates administrative duties and networks.
- Location decides natural, man made and legal risks before any control.
- Buy versus build trades control against cost and speed.
- Multi-vendor pathway connectivity means diverse carriers on separate physical routes.
- Tier III is concurrently maintainable; Tier IV is fault tolerant.
Redundant equipment sharing one path is not redundant. Two carriers whose cables run through the same trench fail together.
Common mistakes
Choosing a site on cost alone. Cheap land in a flood plain buys a permanent risk that controls only partly reduce.
Confusing Tier III and Tier IV. Tier III survives planned maintenance; Tier IV survives unplanned component failure.
Forgetting cooling in resilience planning. Servers with power but no cooling shut down within minutes.
Check yourself
What is tenant partitioning?
Isolating each tenant's compute, network and storage from others, logically through virtualization, networks and keys, or physically through dedicated hardware.
What does N+1 redundancy mean?
The design has the capacity needed plus one additional spare component.
Why is out of band management used in data centers?
It keeps administrative access on a separate network from tenant traffic, reducing exposure of management interfaces.
Topic 2 of 5 in Cloud Platform and Infrastructure Security
Test yourself on Cloud Platform and Infrastructure Security
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.