A vendor technician walks into your colocation cage at 2 a.m., swaps a failed power supply, and leaves. Who confirmed that the person was actually on the approved vendor list? Who decided they could touch that rack and no other? Who has the video showing the drive bay was empty when they arrived?
Remote hands work is the weakest seam in many data center security programs. Access is frequent, staffed by people you never hired, and usually justified by urgency. Zero trust does not mean denying every request. It means every request proves itself, every time, with the smallest possible scope.
Know Which Risk You Are Actually Managing
Remote hands is not one scenario. It is at least four: a colocation provider's own smart hands team, a hardware vendor's field engineer, a contractor hired by your customer, and your own remote staff working from another site. Each carries a different risk profile, and each deserves its own approval path.
The realistic threats are mundane. Badge sharing between contractor shifts. A technician who was terminated by their employer last week but still appears in your system. Someone working outside the scope of the ticket because "I was already in there." None of these require a sophisticated attacker. They require a process that assumes nothing about the person standing in your aisle.
The Four Checks Every Visit Should Pass
Before anyone crosses the mantrap, four questions need documented answers. If any one is missing, the visit waits.
- Identity: Is this the specific individual we authorized, confirmed against a photo ID and a ticket?
- Authorization: Has an accountable person inside your organization approved this work, in writing, for this window?
- Scope: Which cabinets, which rows, which systems? What may they not touch?
- Evidence: What record will exist when they leave, and who reviews it?
Verify Identity Before the Ticket Is Approved
Ticket approval is where most programs leak. An email arrives from a vendor asking for "a tech" tomorrow morning, and someone replies "sure." Instead, tie approval to a named person. The work order should carry a full name, employer, and government-issued photo ID number collected in advance.
Keep a living roster of approved vendor companies and their authorized staff. Re-verify that roster quarterly and whenever a vendor tells you about turnover. Contractors who arrive unannounced — even with a legitimate-looking ticket — should be held at reception until the requesting party confirms identity by phone on a number you already had on file.
For higher-risk work, add a live verification step: a short video call with the technician before entry, comparing their face and ID against your records. It takes ninety seconds and eliminates the borrowed-badge problem entirely.
Grant Just-in-Time Permissions, Not Standing Access
The default access model in most facilities is standing: a badge that works every day until someone remembers to revoke it. Zero trust inverts that. Access should be created for the ticket and expire when the work ends.
Practical mechanics
- Issue credentials scoped to cabinet level, not row or hall, and only for the duration of the approved window.
- Set an automatic expiry — four hours, or the length of the scheduled visit, whichever is shorter.
- Require multi-factor authentication for anything software-based, including remote hands tools and console access.
- Require an escort for anything involving storage media, network cores, or power distribution above the rack level.
- Keep one documented break-glass path for genuine emergencies, with mandatory post-event review within 24 hours.
- Never share credentials between technicians. A shared login is an audit failure waiting to happen.
Two-tier authorizations also help. A routine fan replacement and a disk removal are not the same event, and they should not need the same sign-off. Define the tiers in writing so nobody has to improvise at 3 a.m.
Make Video Verification a Habit, Not an Exception
Cameras in the aisle record who walked in. They rarely record what happened inside a closed cabinet. Close that gap with task-level video: a phone or body camera showing the cabinet open, the component handled, serial numbers visible, and the cabinet closed again.
Structure it in three parts. Before starting, film the cabinet and the asset labels. During the work, keep the enclosure in frame for anything that touches storage or optics. After finishing, film the reassembled state and the ticket sticker.
If a dispute over a missing drive or a bent pin has ever cost you a week of finger-pointing, task video pays for itself the first time it is used.
Tell technicians they are being recorded, and get the vendor's written acknowledgement. Recording rules vary by country and by state, so have counsel confirm what applies in your locations before you make this standard. Keep clips with the ticket, and set a retention period you can defend.
Build Audit Logs That Answer Six Questions
A useful log entry answers who, what, when, where, why, and how identity was verified. That last one is the piece most programs skip, and it is the one an investigator asks about first.
Feed badge events, ticket approvals, credential grants, video references, and escort sign-offs into a single system, ideally your SIEM, with the ticket ID as the common thread. Store logs where the people being logged cannot edit them. Review exceptions weekly: visits that ran long, badges used outside ticketed windows, approvals granted after the work started. Most weeks the list is empty. The weeks it is not are the reason you built it.
Roll It Out in Phases
Start with the highest-risk category — storage and network core work — and apply the full four checks there. Then extend to routine hardware swaps, and finally to standard escorted visits. Write a one-page checklist technicians receive before arrival so nobody is learning the rules at the door. Rehearse the break-glass path once a quarter with a real drill, not a tabletop exercise.
The goal is not to make remote hands painful. It is to make a legitimate visit fast and an illegitimate one impossible, and to leave behind a record you can trust when something goes missing. Build the four checks into your ticket system, and the rest follows.
Photo: panumas nikhomkhai / Pexels
