Lessons from Athens on Protecting Your People, Operations and Data From a Bomb
Lessons from Athens on Protecting Your People, Operations and Data From a Bomb
September 4, 2009
No lives or data were lost when a terrorist group blew up a bomb outside the Athens Stock Exchange and Greece’s central securities depository last week.
But that doesn’t mean exchanges should feel safe. Instead, say security experts, this is a warning shot. Any market which keeps its people and its primary data centers in a prime and well-known downtown location – like in Athens -- should be re-examined. And probably relocated.
In this case, trading and settlement continued uninterrupted at the Hellenic Exchanges, parent to the Athens Stock Exchange and Central Securities Depository. This, despite extensive damage to the east wing of its building when a car bomb blew up at about 6 a.m. local time Wednesday. One passerby was slightly injured.
The exchange and central securities depository, which are housed in the same building in the Votanikos section of Athens, opened their doors that morning and continued trading and processing transactions until 8 p.m. that evening. Employees continued working in the building because engineers confirmed it was safe for occupancy, despite blown-in windows and debris.
However, the work-as-usual attitude at the Hellenic market appears to be the result of luck, rather than careful protection. Fortunately, the Hellenic Exchanges was notified of the bombing a half hour before it occurred. The Athens exchange and central securities depository house their primary data center in the basement of the same building at 110 Athinon Avenue in Athens – where about 270 operations, IT and business executives work.
Its main data center is one floor below the lobby – and just above the parking garage. That’s easy to harm, experts say, if one managed to drive into that lobby or parking garage with a 200-pound bomb instead of the estimated 80-pound baby bomb used last week.
And where does the Hellenic operation keep its secondary backup data center? In the same building. Yes, there is a tertiary center. But this one, 300 miles away in Thessalonica, a large city in northern Greece, does not start up immediately.
This time around, that did not matter. “We did not have to activate any of the backup data centers because no damage occurred to the primary data center,” said Simos Spyrou, director of investor relations for the Hellenic Exchanges.
The primary and secondary data centers are mirrors of each other. So, if the first went down, the second would go up immediately. The tertiary one would go live “quickly” after the outage of the first two, according to Spyrou. But he could not specify when that would occur. “Had the two data centers been affected by the blast we would likely have moved to the tertiary center in Thessalonica before the start of the business day,” he said.
Yet that, of course, is something of a tip of the hat to the terrorists, who struck at 6 a.m. Trading does not begin on the Athens Exchange until 10:30 in the morning. More relevant is what would be the case if a bomber or other attacker struck at midday. Trading at the exchange ends at 5 in the afternoon. The depository operates between 9 a.m. and 8 p.m. local time.
Spyrou could not estimate the magnitude of a blast that would need to occur to shut down the primary and secondary data centers but said that such a bomb would have to be located within the data centers rather than outside the building. He insisted that such a scenario would never occur because of the tight 24-by-7 security placed at the data center which allows access to only a handful of the exchange and depository’s 270 employees.
