Security threats Toolkit

Inside Symantec's nuclear bunker

Tags:
Security,
Hackers,
Malware,
Botnets

Tom Espiner ZDNet.co.uk

Published: 25 Nov 2005 13:10 GMT

In one of the rolling hills above Winchester rests a decommissioned nuclear bunker, which is now owned by IT security company Symantec. The facility, built at enormous cost to the taxpayer at the end of the Cold War in the early 1990s, now houses the company's UK Security Operation Centre (SOC).

The popular image of a bunker is a dank, rat-infested hole in the ground, but luckily for Symantec's team the interior looks surprisingly like any other office. The facility houses Symantec's UK Managed Security Service (MSS) team whose main task is to filter and monitor data fed back from customers' intrusion prevention systems (IPSs), firewalls and intrusion detection systems (IDSs).

The Winchester team alone analyses some 1.5 billion lines of code per day, according to Jeff Ogden, Symantec's director of managed security services for EMEA. "We spend our lives gathering and analysing information and intelligence," he says. "This is an enormous amount of information, and we're trying to pull it into a coherent state."

The MSS team is located in a room glassed-off from the main bunker, with 15 workstations ranged in three rows of five. Four large, flat-screen monitors mounted on the wall face the workstations. Sky News plays constantly in the background to help the team "monitor the geopolitical situations that may affect the info-threat landscape".

Tight security
No one outside the SOC bunker has access — even other Symantec personnel cannot enter the building without prior clearance. Any visits must be announced at least 24 hours in advance. Symantec customers must sign non-disclosure agreements before visiting.

Once inside, all employees must log in at a separate work station and must log out when leaving. The three separate external cameras have a 360 degree view of the building. The digital recorder has 30-days' backup. The bunker runs 24/7, with a minimum of four analysts and a maximum of fifteen.

Even the atmosphere inside is highly managed. It is pressurised to one and half ppsi greater than outside air pressure, so air is constantly being forced out — handy if someone decides to drop an atomic bomb in the vicinity. In the event of a nuclear attack the air can be filtered through charcoal and there are still safeguards in place against a gas attack.

The bunker has features like a security alarm — two strips of black plastic with glowing red insides — that's activated if any unauthorised visitor steps inside the glassed-off internal perimeter of the SOC, where the analysts beaver away. Get too close to them and they bleep and register an unwanted intruder.

If anyone gets past that lot they have one last line of defence to deal with. "That's when I appear with a baseball bat," says Symantec's ex-forces facilities manager Gordon May.

Globally, there are 120 million desktops and servers using Symantec's products, which all feed back samples...

For more, click here...