Securing Data Centers Before Day One

Data CentersConstruction Security
Written by Jeffrey Marlow

Most owners think about security systems at commissioning. By then, the site has already been exposed for months. Raw land becomes a fenced yard, then a shell, then a building full of copper, generators, and network gear that sits half-installed while hundreds of workers come and go. That window is where a lot of risk lives, and it rarely has a clear owner.

Security Starts Before Commissioning

A recent Data Center Knowledge piece laid out the construction-phase threats plainly: material theft (copper, cabling, generators, networking equipment), vandalism and sabotage that can rise with community opposition, planted devices such as rogue wireless access points or small switches left for later access, swapped or counterfeit components in the supply chain, and drones mapping layouts and routines.

Its recommendations line up with what I have seen work on large programs: staffed gates for all foot and vehicle traffic, temporary professional-grade cameras on the perimeter and laydown yards, zoned and phased access by trade, caged storage for high-value material, and recording serial numbers and MAC addresses of networked devices at receipt. The step most often skipped is the last one: before commissioning, compare installed assets against purchase orders and approved bills of materials, and sweep for unexpected wireless signals and network endpoints.

What this means for owners:

  • Write construction-phase security into the GC contract and the security division of the specs. If it is not in the scope, it will be value-engineered out.

  • Assign one accountable owner for site security from mobilization to turnover. Split responsibility between the GC, the integrator, and your operations team is how gaps open.

  • Require a device-level chain-of-custody log (serial, MAC, receiving date, storage location) as a turnover deliverable, and make it a condition of substantial completion.

  • Budget a pre-commissioning technical sweep and an as-built asset reconciliation. Both cost far less than discovering an unknown device on your network after go-live.

Data Centers Are Now Physical Targets

Between Oct. 8 and Oct. 18, Ukrainian drones struck three Yandex data centers, a Sberbank facility under construction, and a VK data center, according to the Kyiv Independent. Russia's Digital Development Ministry has since proposed tiered guidance that calls for new data centers to be built underground and camouflaged, and for existing sites to reduce their visibility from the air and add reinforced structures and drone defenses.

U.S. sites are not in a war zone, but the lesson carries: a data center's physical footprint, and what is visible from above, is now part of its threat profile.

What this means for owners:

  • Add drones to your threat and vulnerability assessment, and treat detection, deterrence, and evidence capture as the realistic goals. Many forms of active drone interdiction are illegal, so coordinate with local law enforcement and legal counsel before buying anything that claims to "defeat" drones.

  • Review what your site reveals: roof-mounted equipment, generator yards, fuel storage, and signage visible from public vantage points or overhead imagery.

  • Test resilience assumptions. If one building is lost, how long until services move, and has that been exercised?

Integrator Remote Access Is an Attack Path

On Oct. 16, CISA added a critical authentication bypass in self-hosted BeyondTrust Remote Support (CVE-2026-102764, versions 26.2.3 and earlier) to its Known Exploited Vulnerabilities catalog, citing active exploitation. Remote support tools like this are common on the servers that run access control and video platforms, often installed by integrators for service calls.

What this means for owners: Ask every integrator and service provider to list each remote-access tool that touches your PACS, VMS, or PSIM servers, who holds credentials, and how sessions are logged. Remote access should be owner-approved, time-limited, and routed through a path your IT team controls. If any self-hosted instance is affected, confirm it has been patched and reviewed for signs of compromise.

Camera Advisories Keep Coming

In mid-October, CISA published advisories on Swann SWIFI-SE2KIC cameras (firmware 2.0.22 and earlier), where flaws could expose video without authentication, and on EseeCloud video surveillance software, whose vendor did not respond to CISA's coordination attempts.

What this means for owners: A vendor that does not answer CISA will not answer you either. Keep a current camera and recorder inventory with firmware versions, keep these devices off the internet and on segmented networks, and make vendor vulnerability response a scored criterion in your product selection, not an afterthought.

The Common Thread

This issue comes down to ownership. Security gaps open where no one is clearly accountable: on the construction site, in a vendor's remote session, or in an unpatched camera nobody tracks.

If you want a second set of eyes on your design standards, construction-phase security plan, or integrator oversight, book a consultation.

Sources

Jeffrey Marlow