Data centre risks, replication and secure transport (TLS, SSH, Tor, MPLS)

Risks to a data centre

• Power: outages and surges; mitigated with UPS units, generators and dual power feeds.
• Environment: overheating, humidity, flooding and fire; mitigated with cooling, sensors and gas-based fire suppression.
• Physical access: theft or sabotage; mitigated with guards, badges, mantraps, CCTV and locked racks.
• Cyber attack and human error: malware, misconfiguration and accidental deletion; mitigated with hardening, change control and backups.

Replica data centres

A replica (secondary) data centre holds a copy of critical systems and data in another location, far enough away not to share the same disaster.

• Synchronous replication: each write is confirmed at both sites before it completes. No data loss, but the sites must be close because latency slows every write.
• Asynchronous replication: writes are copied shortly afterwards. Works over long distances, but the last few seconds or minutes of data can be lost.

SSL and TLS

TLS (Transport Layer Security) is the successor to SSL; all versions of SSL and TLS 1.0 and 1.1 are now considered insecure. TLS 1.2 and 1.3 protect HTTPS, secure email and many other protocols by providing encryption, integrity and server authentication.

SSH

SSH (Secure Shell, TCP port 22) gives an encrypted command-line session to a remote device and replaces Telnet, which sends passwords in clear text. It also supports secure file transfer (SCP, SFTP) and key-based logins, which are stronger than passwords. Network devices should allow management only over SSH version 2.

Tor

Tor (The Onion Router) protects privacy by sending traffic through three volunteer relays, each adding a layer of encryption.

Tor hides who is talking to whom, but the exit relay can see unencrypted traffic, so HTTPS is still needed. Organisations often monitor or block Tor because it can hide data theft or malware command traffic.

MPLS

MPLS (Multiprotocol Label Switching) is used inside service-provider networks. The first router attaches a short label, and routers along the path forward by label instead of looking up the full IP address. This gives predictable paths, quality of service for voice and video, and separate private networks (MPLS VPNs) for many customers over one infrastructure. MPLS keeps customers apart but does not encrypt; add IPsec where confidentiality matters.

Real-world example: testing a replica data centre

An online garden supplies retailer runs its shop and order system in a primary data centre, with a replica in a second facility about 80 km away. Databases replicate continuously, and web servers at both sites are kept on the same version. Twice a year the team runs a planned failover: they switch DNS and the load balancer to the replica site, check that customers can browse and pay, then fail back.

During one test they found that a payment service at the replica site still used an expired TLS certificate, which would have broken checkout in a real disaster. They renewed it and added certificate expiry to their monitoring. Administrators reach servers at both sites only through SSH with key-based logins, and the link between the two data centres uses an MPLS service with encrypted replication traffic on top.