Non IT Staff Access to Server Rooms

[jnfarmer]

Hi all

 

We've had requests from our Facility staff to have access to our server rooms so they can check the room in the event of fire. I'm against the idea, my arguments against are below:

 

1) The obvious security one, nobody except IT should have access to server rooms.

2) They are a controlled air conditioned environment, if the equipment over heats we receive alerts so we can manage that.

3) My understanding of checking rooms during a fire evacuation is to make sure nobody is in those rooms. Server rooms are locked down so nobody should be in there.

4) If something has gone pop in the server room, you're probably not going to want to go in there anyway, so best to leave it shut and get out of dodge.

 

Would be great to get other people's thoughts.

 

Cheers!

[localzuk]

Facilities/Estates must have access to all areas of the site in my experience - there's a multitude of reasons why. Fire safety is just one of them. At every school I've worked in, they've had master key access to every room and I can't see an issue with this. Like our jobs are high trust positions, there's are too.

[DalekSec]

Facilities/Estates must have access to all areas of the site in my experience - there's a multitude of reasons why. Fire safety is just one of them. At every school I've worked in, they've had master key access to every room and I can't see an issue with this. Like our jobs are high trust positions, there's are too.

 

100% This

[Steve101]

In my opinion, those reasons certainly don't come above a fire warden checking nobody is trapped in a burning building.

[Aprice]

In my experience facilities typically have access to comms / server rooms, however I would say your points are valid.

Unfortunately I think this is one of those where a compromise is necessary.

 

Facilities must have a reason to go in there each time, and you should be notified prior, unless in an emergency.

 

The fire evacuation point I would say they need access, while nobody should be in there someone could be in there. Equally if someone has an accident and is locked in there.

 

 

I have found it annoying in the past where facilities have let people in to my office and then unlocked the server room for them when they have no reason to be in there.

 

 

I would suggest a camera goes in that notifies the IT team if motion is detected, and racks are locked if they can be.

[hardtailstar]

Facilities/Estates must have access to all areas of the site in my experience - there's a multitude of reasons why. Fire safety is just one of them. At every school I've worked in, they've had master key access to every room and I can't see an issue with this. Like our jobs are high trust positions, there's are too.

 

This.

 

The Estates team can be helpful knowing they have a master key.

[DrCheese]

Ours have access & I trust them fully with it. They are under strict instructions tho not to let third parties in there without our consent or knowledge.

 

If you're worried about it, put a CCTV camera in there but trying to block the site team from any room is usually a losing battle & it's not one worth having. You'd insist on having control over anything IT on your site, they insist on having control over anything buildings wise on your site.

[jnfarmer]

Thanks for the responses and I'm in no way saying certain reasons come above fire evac procedure. However, as Aprice has said, our Estates/Facilities team have previous of letting themselves in to server rooms to store stuff. Even had one situation where they let an engineer into a cab/rack to install something without my knowledge or consent (I had just started and had no idea that certain person had a key to the rack and promptly took it off him)

 

I'm trying to see if our access control system can send an alert when someone has been granted access to the server room, unfortunately it doesn't give a name, just that access has been granted.

[Oaktech]

Estates have access to ours, but it's only the senior member of staff on duty on any given day that has the bunch of keys with the server room on it.

[chris11256]

Same here, our site manager has a building master key and full access. He mainly uses it to acccess the CCTV unit, otherwise he calls me if it's for anything IT related.

[Garacesh]

Facilities/Estates must have access to all areas of the site in my experience - there's a multitude of reasons why. Fire safety is just one of them. At every school I've worked in, they've had master key access to every room and I can't see an issue with this. Like our jobs are high trust positions, there's are too.

 

Yep, this. Our server room has a key and a code lock, and site team have both.

Even though there's no fire alarm in there, if someone say, noticed smoke coming under the door, it would be a heck of a lot quicker to grab site team (and they'd probably be better equipped to handle it!) than it would be to come up 2 flights of stairs to grab us.

 

The trick is making sure you have an agreement with facilities about who does and doesn't go in.

We're having a fibre line installed and site team are taking care of it. They still called me when the guy showed up to let me know he was here and they'd let him in.

 

Decent compromise IMO, but it does depend on the temperament of your colleagues.

[Guest Guest]

Out site and business managers have access to ours, came in useful when I lost my keys

[slugshead]

Facilities guys access all areas. No questions asked.

 

I've got three phase board supplying the room - That's the electricians.

There's multiple AC units - That's the plumbers

There's fire suppression and detection - That's our porters (They test, monitor and deal with our fire alarm company).

It's a room on campus - Security need to be able to check all rooms.

It's a room - Fire marshals need to be able to confirm a building has been evacuated.

 

Don't dig your heels in, it'll bite you later. If you don't want the equipment touched, lock your cabs (Plus it looks good with the doors shut on server racks).

[bushby]

all facilities staff have access to my server rooms across the trust, they need access in case of fire but also normally maintance access should be required eg AC maintance (source of legionaris, mold) fuse board safty checks. heck even on of my server rooms has a pump in the ground there as the school is located in a flood plain and yes that was needed in one of the lockdowns. the other thing to take into mind is what happens at night and there was a brake in and they had accessed the server room yet the facilities didnt have access to the room to ensure that it was secure. i have had server rooms direclty connected to rooms that have been broken into in the past

[mavhc]

The problem isn't who goes it, it's knowing who went in, and what they did. So can you log access, and record with a camera?

 

Also have a policy about who goes in, what records must be kept, and what they can do in there, eg not store a load of random stuff because there's a few spare cm of space.

[Danp]

Don't see the issue, let them have access on the basis they are not to touch anything. This was the case at my last school. At my current one, I don't have a server room, no need for one.

[Koldov]

Well, OK... my 2p's worth.

 

Previously our server room (glorified cupboard with A/C) had a lockable door and I pretty much had the only key. There was a spare but the Site Agent had it and there wasn't really any need for him (or anyone else) to actually go in there apart from the A/C engineer once a year.

 

Now, I've moved the servers to the Plant Room (which is also the Switch Room and where the SA stores some other equipment) and although the door is lockable and it has AC, I am aware that there may be more 'traffic' in this room - the fact that the switch cab has a big bow in it from when the electricians stood on it (yes that's right) to reach the ceiling for cabling proves that regardless of who 'says' they will do (or not do) something is irrelevant (SA said he would keep an eye on them)... but I've taken those risks and assessed them and the servers being in there is for the greater good...

 

But as others have said if the Site Team are mandated to check 'every' room on a fire evacuation, then they have to check every room... that's all there is to it.

 

I would however get assurances from the SLT that access to said room is on the proviso that it is only for that purpose (if there is no other need for them to be in there) and a cheap motion detection cam (with alerts) for good measure.

[Sonic007]

I've always found facilities to be good to me in I.T. and once they know what to do and not do then they actually help by making sure all is well.

 

Teachers on the other hand, I wouldnt let them near it. It will become a junk yard for all left over crap from their classrooms.

[Andrew_C]

As above really, except make sure they understand that "access" !equal "let the PAT monkeys in"

[strawberry]

Let them in, assume they are professional and when they aren't deal with it.

[JATSO]

Its not an issue until someone nicks the mouse from the server because theirs wasn't working.

Easily solved I nicked it back and gave them one of the old ball ones I had lying around for a the day;)

[Sylv3r]

Our site team have access to ours and I have no ideas with that - they wouldn't however go in unless they have a good reason to do so.

[smurfomatic]

No issues with site team having access to our server room, as the main "server room" is my office. As it's on the first floor, and in the middle of the block, there's an exit to the ICT room (which leads onto the stairs) and another door which is the fire exit from the room on the other side. Weirdly this means we've got a set of keys on a hook inside the office - if there's a fire and we're not in, the door to the office would be locked, and someone using the fire exit would be stuck.

 

We have a backup server, stuck in the corner of what used to be a store room but has since been expanded and turned into an office.

[Guest ZFarnworth]

Ours have access & I trust them fully with it. They are under strict instructions tho not to let third parties in there without our consent or knowledge.

 

If you're worried about it, put a CCTV camera in there but trying to block the site team from any room is usually a losing battle & it's not one worth having. You'd insist on having control over anything IT on your site, they insist on having control over anything buildings wise on your site.

 

Yeah, IT control IT and estates manager control the estate.

[Davit2005]

Our security dept has access to our datacenter server rooms, in the event of a fire they will be dealing with this anyway. No one else has access apart from the senior level IT teams, not even estates. The datacenters also are on CCTV and all access is logged.