The Badge That Opened Too Much
A data centre has three zones: reception (public), operations floor (staff only), and the white space (server halls, escorted access only). Access is by proximity card plus PIN at the white-space door. Logs show that a cleaning supervisor's card, issued for reception and operations floor, was used at the white-space door at 23:40 on a Sunday. The door opened. The cleaning supervisor was not rostered that night. The access system's door-held-open alarm did not trigger, and the camera covering the white-space door shows a person in a cleaning uniform but the face is not visible. The system administrator says the cleaning contract was renewed three weeks ago and 'the card list was probably updated'. There is no record of a PIN change for that card in two years. The site has 14 server halls; the log does not show which hall was entered, only the door.
1. What are the most likely explanations, and how should they be ranked and tested?
Read the worked answer
Rank by likelihood and by how cheaply each can be tested.
- Card and PIN shared or borrowed. Cleaning supervisors often lend cards to staff who cover shifts. Test: check the roster, call the supervisor, check whether the same card was used earlier that evening at the operations door. High likelihood, cheap test.
- Stale access rights after contract renewal. The administrator's own comment points here: the card may still hold white-space rights it should never have had, or the renewal added staff without removing old ones. Test: pull the card's entitlement history and the current cleaning roster. Also cheap.
- PIN compromise. Two years without a change, and a 4-6 digit PIN, is a real exposure. Test: check for failed attempts before the successful entry; a clean single success suggests the PIN was known, not guessed.
- Tailgating or door manipulation. The door-held-open alarm did not fire, which is itself a fault. Test: review the door contact and alarm configuration.
- Insider theft or sabotage. Lowest prior probability but highest impact; do not rule out, but do not lead with it.
The ranking matters because the first two explanations are administrative and account for most real events. Treating this as a break-in before checking the roster wastes the response and alienates the cleaning contractor.
2. What immediate containment and follow-up actions should be taken, and what should the report to the client say?
Read the worked answer
Immediate (same night):
- Suspend the card in the access system and issue no replacement until the holder is interviewed.
- Physically check the white-space door and the 14 halls' inner doors for signs of entry; the log only shows the outer door.
- Review camera footage for the whole visit, not just the door frame, to establish duration and direction.
- Have a guard walk the white space and confirm no cabinets or cages are open.
- Notify the data centre manager and the client's security contact per the escalation matrix.
Follow-up (within days):
- Full entitlement audit of all cleaning-contractor cards against the current roster.
- Force PIN reset for all contractor cards and set a maximum PIN age.
- Repair the door-held-open alarm and test it.
- Review camera placement at the white-space door so faces are captured.
- Interview the supervisor and the person on the roster for that shift.
Report to the client: state facts and times, the door and card involved, what was and was not confirmed, the containment taken, and the corrective actions with owners and dates. Avoid naming a suspect. Say plainly that the log does not show which hall was entered and that the alarm failed - the client needs to know the limits of what can be confirmed.