Twelve Racks in Someone Else's Building
Vantage Health stores 4 PB of imaging data in 12 racks inside a multi-tenant colocation facility in Amsterdam. The provider owns the building, perimeter, CCTV and badge system; Vantage owns the racks and a cage door opened with a mechanical key. A joint review found: a former Vantage contractor's badge still opened the cage corridor nine days after the contract ended, because the provider deactivates badges only in a monthly batch; CCTV is retained 30 days but the provider releases footage only on a police request; the cage key is held by three engineers, one of whom is on long-term leave; two racks hold an out-of-support MRI console on the same flat network as the backup appliance; and backup credentials sit in a shared vault used by 22 people with no check-out logging. The provider's ISO/IEC 27001 certificate covers 'facility operations' but not tenant racks. Availability commitment is 99.95%, and maintenance requires four hours' notice. Vantage's board has asked whether the facility is 'covered by the provider's certification'.
1. Allocate the relevant physical controls between provider and Vantage, and classify each finding as a contract issue, a process issue or a technical issue.
Read the worked answer
Allocation. The provider naturally owns the perimeter (7.1), building and corridor entry (7.2), CCTV operation (7.4) and environmental protection and utilities (7.5, 7.11). Vantage owns everything at and inside the cage: cage entry, key custody, secure-area rules (7.6), equipment siting and cabling (7.8), media handling (7.10) and secure disposal (7.14). Shared controls must be specified, not assumed: badge deprovisioning, footage release, incident notification and maintenance access all have a provider action and a Vantage verification.
Classification:
- Badge still active after nine days - contract and process. The monthly batch is a provider design choice; Vantage never imposed a deprovisioning service level or required a reconciliation report. Fix the contract, then add independent verification.
- CCTV only released on police request - contract. Retention is fine; the access path for a tenant's own investigation is missing, which makes 7.4 and 8.15 ineffective for tenant incidents.
- Three key holders, one on leave - process and physical. Single mechanical key with no dual custody, no issue log and no rekeying on change of personnel.
- MRI console on a flat network with the backup appliance - technical.
- Shared vault with 22 users and no check-out - technical and process.
Answer to the board: the certificate covers facility operations only. It is evidence about the provider, not assurance about Vantage's racks, and it does not transfer Vantage's accountability.
2. Rank the two technical findings by exposure. Show how the out-of-support console and the shared credentials interact, and what compensating controls you would require.
Read the worked answer
Ranking: the shared credentials are the larger exposure, but only because of what the network allows.
The reasoning should combine blast radius with detectability:
- The MRI console cannot be patched, so its vulnerability is permanent. On a flat segment shared with the backup appliance it provides a pivot path to the data most needed for recovery. Blast radius is high, but exploitation requires reachability and the console is not internet-facing.
- The shared vault gives 22 people, with no check-out logging, standing access to backup credentials. Detectability is close to zero: without attribution you cannot distinguish legitimate restore activity from destructive use, and you cannot rely on logs as evidence because the same population may be able to alter them. This is the classic precursor to ransomware success - reach the backups, then destroy them.
The interaction is the real problem. Because the network is flat, one compromised host reaches both the appliance and the credential-dependent restore path. Either finding alone is serious; together they remove both the barrier and the recovery option.
Compensating controls for the console: segment it into its own zone with deny-by-default firewall rules to the backup appliance; allow-list the specific management hosts and the vendor's support path; restrict vendor remote access to time-boxed, monitored sessions; log all traffic to and from the zone and alert on deviations. Document the residual risk with a vendor-supported migration date.
For credentials: per-person privileged accounts, a managed vault with check-out approval and session recording, multi-factor authentication, and separation of the backup administrator role from the database team. Until then, no shared accounts for the restore path.
3. Recommend the control and assurance requirements you would add to the colocation contract and to Vantage's own monitoring, including the evidence you would demand each month.
Read the worked answer
Contract additions:
- Deprovisioning service level: badges and access rights removed within 24 hours of notification, with a monthly reconciliation report listing all Vantage-authorised holders and any removals, sent to a named Vantage contact.
- CCTV access: footage relating to Vantage's cage released within 72 hours of a Vantage incident request, without requiring a police request, subject to data-protection terms.
- Maintenance and escorted access: notice period aligned to operational need (four hours is workable only for planned work), plus notification of any unescorted access and a log of who entered the cage corridor.
- Incident notification: a defined timeframe for notifying Vantage of physical or environmental events affecting its racks, and of any provider-side compromise.
- Audit and evidence rights: annual right to review provider controls relevant to the tenancy, and a standing right to the reports below.
Monthly evidence to require: badge reconciliation report; cage-corridor access log; CCTV availability and retention confirmation; any environmental alarms; maintenance-access log.
Vantage's own monitoring: quarterly physical inspection with photographic record; key issue and return register with dual custody and rekeying on personnel change; review of access logs against the authorised list; annual test of the restore path including a documented restore; quarterly review of privileged vault check-outs; and a yearly re-assessment of the shared-responsibility matrix, because the boundary moves whenever either party changes a process. Assign an owner for the supplier relationship - the controls exist on paper only if someone is accountable for reading the reports.