Hi-Tech Security Solutions Hi-Tech Security Solutions
Follow us on:
Follow us on Facebook  Share via Twitter  Share via LinkedIn
   
 




















 

Managing identities
March 2006, Access Control

With smartcards, physical access identity management complements IT identity management

As organisations open up their networks to let partners, customers and suppliers connect to their networks, they become vulnerable to illegitimate access and identity theft. Not only can outsiders access the network and physical access control system more easily, so can employees. Thus, there is a need for an identity authorisation solution that alleviates opportunities for fraud and unauthorised access, a solution not enough companies follow.

Seeing a potential market, the Microsoft website proclaims, "The smartcard will become an integral part of the Windows platform because smartcards provide new and desirable features as revolutionary to the computer industry as the introduction of the mouse or compact disc."

Increased security demands continue to speed the adoption of smartcard technology. The major advantage of smartcards over other credentials is that they can have multiple applications on a single card. Major uses include:

* Employee identification and authentication.

* Physical security.

* Building security.

* Storage of biometric information.

* Secure access to the Internet.

* Secure transactions over the Internet.

Multicredential readers: by reading all leading proximity and smartcard credentials, let users leverage the lower cost of smartcards without having to tear out old readers for new ones
Multicredential readers: by reading all leading proximity and smartcard credentials, let users leverage the lower cost of smartcards without having to tear out old readers for new ones

Administrative applications, such as property management, storage of medical records, electronic purses, tracking cafeteria purchases and a multitude of uses, are possible, while still performing all the major uses of the earlier bulleted items. More importantly, this data can be safely stored with smartcards.

Institutions are taking advantage of smartcards

In the US, close to 1 million smartcards are being used in the college market alone, representing approximately one in 17 students.

For instance, Clemson University's Tiger 1 Card is their official ID card. In addition to being the student's personal identification card, many departments use the Tiger 1 Card as a means to grant access to their information and services. Tiger 1 Cards serve as debit cards to access funds deposited into 'TigerStripe' accounts, enabling students to obtain university dining services, check out library books and access residential halls, campus recreation centres, and athletic ticket privileges. From a teacher requiring to see a student's Tiger 1 Card to take a test to needing it to purchase discounted software, the Tiger 1 Card is a necessity of everyday campus life.

In 2004, Clemson expanded the Tiger 1 program to include off-campus merchants. Each Clemson student uses the Tiger 1 Card an average of 18 times per day.

Smartcard migration in the private sector is accelerating

"We are currently switching from magnetic stripe to Mifare cards," reports Jeremy Brewer, card access administrator for Fifth Third Bank, headquartered in Cincinnati. "We want to stay on top of technology."

At Noridian, which provides a variety of insurance products and administrative services across the western United States, the access control system is linked to the personnel (human relations - HR) system to control which employees are currently employed by the company. The linkage of these systems ensures that as employees are terminated or re-assigned, the access control is completely synchronised with the personnel moves, without manual intervention.

Noridian has put together a world-class integration system using GE's Secure Perfect 4.O Enterprise as its security platform, which integrates into the organisation's PeopleSoft system used for human resources. In this integrated system, Secure Perfect pulls down certain fields, such as first name/last name/employee ID number/employee status, from PeopleSoft, not the access control system, so that there are no variances.

When Noridian Mutual upgraded its security system, smartcards were ordered for the approximately 2000 employees.

Smartcards provide enhanced security

Using single-factor authentication, such as user ID, for information or physical access control systems access creates a significant security risk. Such password-based methods, although chosen by most enterprises, are very susceptible to the problems they were designed to eliminate. They are written down on desk pads, sticky notes put on the monitor screen, scraps of paper kept in the wallet or written on the back of the ID card. They are even sent over the Internet. When sets of passwords are needed, users choose those easy to remember, such as last names and one of the most common of all - 'password'. When passwords are forgotten, help desks are contacted, at a cost.

A card only user ID can be easily compromised and storing such data on corporate networks introduces additional vulnerability to attackers who gain network access or insider fraud. Other developments are also demanding a solution for strong authentication because:

1) The deployment of Web services to facilitate interactions among diverse systems and applications creates holes in the system.

2) Systems, which depend on credentials created for one location being accepted for authorised access in another, produce opportunities for fraudulent use.

3) Single sign-on (SSO), which consolidates application-specific authentication, exacerbates security as it simplifies access for both legitimate and illegitimate users.

4) Standardising on the Web and offering SSO and authorised access control to both Web-based internal and externally exposed applications and legacy client/server and mainframe applications can be a recipe for disaster.

5) And, as previously noted, regulatory requirements created by Sarbanes-Oxley, HIPPA and others mandates the need for both strong policies regarding access and proof of their application via audit trails.

6) Wireless networks installed across enterprises and organisations further erode the traditional network boundary and open up networks to attackers. Unlike eavesdroppers on wired LANs, WLAN eavesdroppers do not have be on site to make a connection to the network. And, passwords have been the authentication method of choice for wireless access, exposing network assets to additional vulnerability.

Thus, strong authentication requires the use of two or three factors. Smartcards work with other authentication techniques by storing some combination of password files, public key infrastructure certificates, one-time password seed files or biometric image templates on a single card.

Organisations then combine more than one factor to improve the security and privacy of the overall authentication process. For example, authentication might require something you have, the smartcard; something you know, a personal identification number or password; and something you are, a unique physical characteristic or biometric identifier.

Lastly, but very importantly, smartcards are the most secure solution in access control. They use cryptography, encryption and the internal computing power of smart chips to provide the most secure access control card solution possible.


  Share via Twitter   Share via LinkedIn      

Further reading:

  • The safest estate in Africa?
    April 2014, Xone Integrated Security, CCTV, Surveillance, Access Control, Perimeter Security, Alarms & Intruder Detection, Case Studies, Residential (Industry)
    A luxurious estate promises residents an unprecedented lifestyle experience, first-class healthcare, 24-hour security and a range of well maintained facilities, which include a 9-hole golf course, bowling greens, a heated swimming pool, and more.
  • Integrate visitor management and access control
    April 2014, iPulse Systems, Access Control
    One of the crucial aspects of commercial security is visitor management. Hi-Tech Security Solutions approached Gary Chalmers, CEO of iPulse, to find out who’s doing what and how visitor management has evolved from the tattered old visitor’s book that Superman filled in many times each day.
  • Visitor management solution from Gallagher
    April 2014, Gallagher Security , Access Control
    The Visitor Management System provides improved client-server connectivity on modern corporate IT networks; automatic application updates; automatic removal of access on visit-completion among other attributes.
  • Wireless technology empowers visitor management
    April 2014, Powell Tronics, Access Control
    Technology has enabled bespoke visitor management solutions to deal with the shortcomings of the manual book system employed by many facilities worldwide over the past few years.
  • GSM intercom solution
    April 2014, Centurion Systems, Access Control
    G-SPEAK is a new range of GSM-based intercom systems from Centurion Systems.
  • Groote Schuur Hospital ­upgrades to ­biometrics
    April 2014, Castle Access Control Systems, Access Control, Identity Management
    In 2013, Groote Schuur Hospital took another step into the future, when it upgraded its RFID access cards and tags to include fingerprint biometric access to certain areas. The Granding biometric devices were supplied by Castle Access Control Systems and installed by Keep Electronics.
  • The future of authentication
    April 2014, Access Control, Identity Management
    SlickLogin focuses on a very important piece of the authentication puzzle – ease and simplicity for the user. The idea of just placing your phone near your laptop to logon sounds cool and simple.
  • FIDO Alliance opens its security standards to the public
    April 2014, Access Control, Identity Management
    The FIDO (Fast IDentity Online) Alliance, a security-minded industry consortium that includes tech giants such as Google, Netflix, and PayPal has released a public draft of new security standards that could someday make user passwords a thing of the past.
  • EntraPass v6.01 with exacqVision VMS integration
    April 2014, Tyco Security Products, Access Control, Identity Management
    EntraPass v6.01 features an integration with the cross-platform, open architecture exacqVision video management system (VMS) from Exacq.
  • Solar-friendly GateMate by Cartell
    April 2014, Access Control, Identity Management
    Cartell introduces the solar-friendly GateMate (CP-3) self-contained Free Exit System, offering the lowest stand-by current draw in the industry.
  • Secure ID at last
    April 2014, Access Control, Identity Management
    New ID cards will ensure that citizens can vote securely and help protect social grants. Each South African will, once issued with a smart ID card, have a secure, verifiable and digital identity.
  • New time-recording terminal
    April 2014, Access Control, Identity Management
    Latest in time recording terminal technology available through AWM360. The B-web 96 00 is an entry-level solution for simple time recording and access control applications.

 
 
 
Search...
Hi-Tech Security Solutions Business Directory


         
Contact:
Technews Publishing (Pty) Ltd
1st Floor, Stabilitas House
265 Kent Ave, Randburg, 2194
South Africa
Publications by Technews
Dataweek Electronics & Communications Technology
Electronic Buyers Guide (EBG)

Hi-Tech Security Solutions
Hi-Tech Security Business Directory (HSBD)

Motion Control in Southern Africa
Motion Control Buyers’ Guide (MCBG)

South African Instrumentation & Control
South African Instrumentation & Control Buyers’ Guide (IBG)
Other
Terms & conditions of use, including privacy policy
PAIA Manual
         
    Mobile | Classic

Copyright © Technews Publishing (Pty) Ltd. All rights reserved.