Most data center security conversations start at the fence line: crash-rated barriers, mantraps, biometrics at the data hall door, cameras on every aisle. All of that matters, and none of it is going away. But the biggest threat, and the one most often overlooked, walks straight through all of it, because the system says that person is allowed in.
At the reader, an access control system checks one thing: Is this credential allowed to pass this threshold? It’s a simple yes or no. What the system doesn’t know is whether the person holding the credential should still have that level of access. It has no idea whether the cardholder still works for you, finished their scope three months ago, or moved into a role that has nothing to do with Hall 2.
“In a lot of facilities, ‘valid credential’ and ‘appropriate credential’ drifted apart long ago. Nobody noticed because nothing broke.”
Earlier this year, a security director at a colocation operator in Southeast Asia shared a story that shows how easily this happens. A contractor brought in for UPS maintenance in one hall had a badge that also opened other areas. Nobody had done anything wrong. The access had been set up broadly to save time, and nobody went back to narrow it.
How a valid credential becomes the wrong credential
1. The build crew never really leaves
Walk onto a hyperscale or colocation (“colo”) campus mid-build, and most of the people on site don’t work for the operator: electricians, mechanical crews, commissioning agents, integrators, fiber teams. They arrive in waves, they rotate, and every one of them needs a badge.
On large data center construction projects, contractor populations can grow into the thousands, with multiple trades, subcontractors and vendors moving through the site as construction progresses. Issuing their credentials is the easy part. Removing access once it’s no longer needed is where things slip. As individual data halls move from construction to operations, contractors finish their assignments while their credentials stay active. That’s why offboarding needs the same discipline as onboarding.
“A valid credential should never mean indefinite access, particularly in a mission-critical environment.”
The fix is to stop relying on someone remembering. Every contractor credential should be tied to a sponsor and an end date, and it should expire on its own. That’s the approach behind AMAG’s Symmetry CONNECT 2.0. Contractors and vendors are verified through their sponsoring company, with training, qualifications and certificates of insurance checked up front. Their access is date-based and auto-expiring. And because CONNECT manages one identity across every site and system, ending someone’s access in one place ends it everywhere.
One AMAG critical infrastructure customer runs this across more than 200 locations worldwide with zero manual data entry. When the crew leaves, the access leaves with them.
2. The typical access review process leaves gaps
If you run a colo, your customers audit you. Your SOC 2 report and ISO 27001 certificate are part of the sales cycle, and sooner or later an auditor asks a simple question: Who can get into the data hall, and who approved it?
In too many facilities, answering that question looks like this: Someone exports a spreadsheet from the access control system. It goes out by email to a list of managers. Half of them reply “looks fine” without opening it. The other half get chased for two weeks. Meanwhile, the access itself never changes. At the end, you have a signed-off spreadsheet and the same access list you started with. Email and spreadsheets don’t hold up when one campus has thousands of badges and dozens of area owners.
When it comes to audits, writing the policy is usually the easy part. The hard part is proving it was followed. When an auditor asks who entered a critical area, when, and on whose approval, you need to produce the answer quickly and confidently. Audit readiness should come out of how you manage access every day, so there’s nothing to scramble for when the auditor arrives.
With CONNECT 2.0, recertification runs on a schedule and goes straight to the people who own each area: the cage owner, the data hall manager, the site lead. They confirm the access or remove it, and every decision lands in an audit trail that can’t be edited after the fact. When the auditor asks who approved what, you run a report.
One Symmetry CONNECT customer completed more than 400,000 access reviews in 20 days and hit 99% compliance.
3. Badge footprints often used reactively instead of proactively
Your access control system already records how every credential is used. Most organizations treat that history as a log to pull after something goes wrong. It’s far more useful as an early warning.
The easiest thing to look for is a badge nobody uses. If a credential hasn’t been used in four months, ask why it’s still active. Maybe it belongs to a remote technician who moved to another site, or a generator vendor whose contract lapsed. Either way, nobody would notice if it started getting used again.
The second thing to look for is activity that doesn’t fit the person: a valid credential at 2:00 a.m. in a cage that person has never entered, or a contractor badge used in a building outside their scope. Every one of those swipes is authorized, so nothing alarms. You only see the problem when you look at the pattern.
AMAG’s Symmetry analytics scores identities on where they badge, when, and how that compares with their normal patterns, so your team sees the highest-risk identities first instead of digging through raw logs.
One of the real values of access control isn’t just recording who entered. It’s recognizing when authorized access becomes unusual or no longer appropriate.
The audit trail is the real defense
None of this replaces the fence line, the mantrap or the camera. Those controls stop the people who shouldn’t be there. Access governance covers the people you let in, and whether they should still be getting in.
The operators who get this right can answer four questions at any moment: who has access, to what, why they have it, and who approved it. If answering them today takes a spreadsheet and a week of emails, that’s the place to start.
AMAG Technology works with data center operators on exactly these problems. If you’re heading into an audit or planning a new campus, the AMAG team would welcome the chance to compare notes.
This blog post was authored by Ed Evans, VP Business Development Global Data Centers
Ed drives AMAG’s global data center strategy, building partnerships with hyperscale, colocation, wholesale and enterprise operators around the world. He brings more than 13 years of experience across data centers, physical security and building technology, helping operators protect critical infrastructure at scale.
