Out-of-band management
IPMI, BMC and console access are permanently reachable and often the least monitored plane in the estate.
ManagementSystems and access
You own the racks. You rarely own every route into them.
Colocation gives you space, power and connectivity. It also brings shared fabric, provider engineers, remote hands and out-of-band management planes. Physical Control governs which of those routes exists, and when.
- Colocation and shared racks
- Out-of-band management
- Remote hands
- Cross-connects
The connection state today
Managed remotely, all of the time
Management planeAlways reachable
Provider accessContractual, not physical
Cross-connectsPersistent
EvidenceProvider tickets
Need → Control → Blueprint → Modules
01What is exposed
The estate is defended. The routes into it are assumed
Most data centre risk is not about the building. It is about the standing paths that make remote operation convenient.
Remote hands
Provider staff can physically touch equipment on request, with the record held by the provider.
PeopleShared fabric
Cross-connects, shared switching and provider services create routes you did not design.
NetworkBackup and replication links
Replication paths between sites stay open continuously, so an attack propagates with the data.
BackupsHardware lifecycle
Decommissioned disks and appliances leave the floor holding data that was never accounted for.
AssetsMulti-tenant assumptions
Controls that hold in a private facility do not always hold where other tenants share the same space.
Tenancy02Why the exposure exists
Remote operation was the requirement
Colocation exists so that people do not have to travel. Every convenience that supports that becomes a standing route.
The pattern
Contracts govern behaviour, not connectivity
A colocation contract describes what the provider will and will not do. It does not remove the physical routes that make those actions possible.
Control the path, protect the asset.Management planes are built for access
Out-of-band exists so equipment can be reached when everything else has failed, which is exactly why it is valuable to an attacker.
Provider boundaries are unclear
Responsibility is split, so neither party holds a complete list of the routes into the racks.
Replication is always-on by design
Continuous replication is treated as resilience, even though it copies the incident as faithfully as the data.
Audits look at the facility
Certifications cover the building and process, not the specific connections your estate depends on.
03Which paths need controlling
Write down every route into the racks
Data centre exposure becomes manageable the moment the routes are named rather than assumed.
The path or relationshipWho uses itHow it behaves todayWhat Control governs
Out-of-band managementInfrastructure teamAlways reachableWindow opened for named maintenance, then closed
Provider remote handsFacility staffOn request, provider-loggedApproved, time-bound and evidenced on your side too
Cross-connects and shared fabricProvider and partnersPersistentDocumented crossings with physical enforcement
Replication to second sitePlatform teamContinuousScheduled transfer with a disconnected gold copy
Vendor maintenanceHardware suppliersStanding accountsValidated request, opened window, automatic close
This is a list a provider cannot write for you. It describes your estate, not their facility.
04What physical Control changes
Routes into the floor exist only when they are needed
Physical Control sits in the path itself, so a management plane or cross-connect is not simply firewalled, it is absent between windows.
Before
Every convenience route is available at all times.
- •Out-of-band reachable continuously
- •Provider access governed by contract only
- •Replication open around the clock
- •Evidence held mainly by the provider
After
Routes are opened deliberately and close on their own.
- ✓Management access exists only inside a maintenance window
- ✓Every crossing named, approved and recorded
- ✓A gold copy held physically disconnected
- ✓Your own evidence trail, independent of the provider
If the route is not there, neither the provider nor an attacker can use it.Connected when approved. Disconnected by default.
05The Firevault principle
Control is physical, or it is only a policy
Software can be told to deny a connection. Physical Control removes the connection itself, so the denial does not depend on the system behaving as configured.
Start with the path, not the tool
Every incident that spreads does so along a connection that was already there. Control begins by naming that connection in plain language, before anyone talks about products.
Make the default state disconnected
A path that exists only when it is needed cannot be used at three in the morning by someone who should not have it. Disconnection is the resting state, not the emergency response.
Open on approval, close on schedule
When work genuinely needs a connection, Control opens it for a named person, a stated purpose and a fixed period, then closes it again without anyone having to remember.
Prove it physically, not on paper
A policy says the path should be closed. Physical control shows that it is. That difference is what auditors, insurers and boards are actually asking about.
How this fits together
Your need sets the direction. Control sets the rule. The Blueprint sets the architecture.
NeedControlBlueprintModules and Firebreak
06Where this is designed
The Blueprint for this need is CP-04 Enforce Physical Segmentation
Data centre and colocation exposure spans two patterns: enforcing the boundary between zones and keeping critical systems available while disconnected from unnecessary routes.
Enforce Physical Segmentation
Segmentation should not just be logical. It should be physically enforceable.
Applied to trust boundary enforcement between zones. The Blueprint page carries the architecture, the zone detail and the deployment sequence.
What you get from the Blueprint that this page does not cover
- ✓It shows how zones are separated in hardware rather than in configuration
- ✓It sets out maintenance and vendor windows that open and close on purpose
- ✓It defines the evidence you hold yourself, independent of the facility provider
Also relevant · CP-05
A different job
Protect Critical Infrastructure
Keep critical systems available, controlled and disconnected from unnecessary exposure.
Open CP-05This page is about the routes into your racks. Holding a recovery copy that no route can reach is a different job, and that belongs in Offline Secure Storage rather than in replication.
Hold a disconnected gold copyQuestions
What infrastructure teams ask
The questions that come up when colocation exposure is reviewed properly.
No. Access is still remote. It exists inside a window opened for a named person and purpose, rather than continuously.
Need → Control → Blueprint
List the routes into the floor. Then govern them.
CP-04 Enforce Physical Segmentation and CP-05 Protect Critical Infrastructure set out how those routes are separated, opened and evidenced.