Checklist for converged access control solutions

Access & Identity Management Handbook 2009 Access Control & Identity Management

Jeremy Kimber, Honeywell’s EMEA marketing leader, lays out the key points to consider when choosing a converged access control solution.

In the past few years, perhaps no security industry buzzword has been defined in articles and promotional materials as many times as ‘convergence’. These definitions have most commonly referred to the integration of physical security and IT systems, with occasional elements of building control. These definitions, while helpful to end users, beg the ultimate question: 'How do I make it work?'

Convergence uses data generated by both physical security and IT systems to drive both business process efficiency and security, and its framework defines a migration path for organisational growth. Here are some basic elements required to ensure a solution is truly converged.

Common security policy management and control

The IT infrastructure is the backbone of a converged solution, sharing knowledge of key business data across systems. The physical security system does not inherently know critical business data such as employee status, staffer security clearances and training certifications. A computerised HR system, though, often has this knowledge. IP-enabled security systems therefore allow users to take advantage of fixed investments and improve return on investment (ROI).

Developing common protocols for managing access to company assets and data enables more efficient provisioning and management. An organisation develops role-based policies that can manage badge issuance, enrolment and revocation processes by leveraging XML/SOAP interfaces for integration with identity management solutions. The key benefit is that building security personnel continue to use tools best suited to their jobs and HR personnel continue using HR tools.

Organisations should identify:

* Authoritative sources (the system that has the ultimate say) for each person who has a building badge or an IT account.

* Sources (IT systems or people) of key data used to determine whether a person has permissions to use a resource or access an area.

* Compliance or audit needs where the data exists on multiple systems.

* Any business or security concerns that are unique or are especially important to an organisation.

* Key business processes (onboarding, offboarding, change of position) and determine the responsibilities of different systems.

* A policy platform that supports customisable workflow creation tools to easily model processes and approvals.

Common user provisioning

Convergence drives the business to contemplate the inter-relationship of physical security on IT security and vice versa. How many organisations can definitely claim that terminated employees or contractors are immediately removed from their building access control systems? How many are confident that a former employee who tailgates into the building does not have active IT accounts? How many are confident current employees would recognise former employees and know the person has been terminated? Provision dynamics are evolving and driving user permissions in non-IT and external IT systems.

Organisations must:

* Determine how many terminated employees or contractors still have active building badges and IT accounts.

* Determine how many contractors who have not been on site for the last three months still have active building badges.

* Perform studies to see if anyone questions tailgaters.

* Benchmark how long it takes for someone to be provisioned or de-provisioned.

* Educate employees on security risks.

Single access credential

Building security starts with a badge, often a proximity card. IT security, meanwhile, starts with a user name and password. When organisations want to add more security to a card, they can add a PIN or a biometric. As IT systems look to increase security, however, the choices are not equivalent.

Organisations can add:

* An RSA token or biometric that authenticates the correct person.

* A contract smart chip – embedded either in a card or in a USB dongle – that authenticates the correct person, and is also used for non-reputable digital signatures. Digital signatures are important in regulated environments to verify a person did approve or take action. A single-card solution that includes a contact smart chip for IT and proximity technologies (contactless smart or 125 kHz proximity) enables the organisation to manage one resource for each employee, thereby minimising both material and administrative costs. An optimised card issuance process allows building security to continue issuing badges and the badge issuance process will be connected to IT systems for provisioning as a single process.

Steps to take:

* Building security teams should discuss access credentials with their IT counterparts to identify opportunities to leverage cards across the organisation.

* IT departments should review authentication and PKI requirements/needs.

Correlation of events

By connecting systems, organisations can correlate seemingly disparate physical and IT security events. For example, it may not seem suspicious for an employee to download large amounts of data. However, system correlation might show the employee only downloads the data when he is in the room by himself.

Organisations must identify:

* Thresholds of normal employee behaviour by job classification. It may be necessary to audit current behaviours.

* Business events that may cause security breaches (receipt of a resignation notice, termination for cause, unexpected change in work hours).

* IT resources and/or locations with sensitive information (intellectual property, identity data) and develop a plan to lock down for normal security levels and for a heightened security level. Organisations must determine the return on risk for each sensitive item and develop security response plans accordingly.

* Normal usage for each sensitive resource and what would be considered abnormal (downloading all customer data or customer credit cards).

Convergence provides substantial benefits

Convergence is the first step for any organisation to connect its critical systems to provide a comprehensive and coherent security policy. By integrating systems to share information, an organisation can see vulnerabilities in realtime and link IT security events with physical security responses. These abilities all drive realtime security policy management. The next step will be proactive threat management, which enables correlation of realtime information with historical information. The system will learn how to manage the current environment and react in a realtime manner, increasing system value and improving ROI.

The system, for instance, can classify behaviour such as a certain employee trying to access random doors every few days or unusual behaviour by a subset of employees who all had security clearances processed by a specific adjudicator. Using a converged system can reap substantial benefits and will provide additional benefits in the future as convergence continues to evolve. How organisations choose to implement these new toolkits is up to them and their individual security and compliance requirements.



Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Paxton10 for smart buildings
Issue 5 2020, Paxton Access , Access Control & Identity Management
Paxton10, offering access control and video management on one simple platform, is available in the South African market.

Read more...
Suprema enhances cybersecurity
Issue 5 2020, Suprema , Access Control & Identity Management
Suprema BioStar 2 is a web-based, open and integrated security platform that provides comprehensive functionality for access control and time and attendance.

Read more...
A wizz at visitor management
Issue 5 2020 , Access Control & Identity Management
WizzPass is a locally developed software platform for managing visitors to businesses, buildings or business parks.

Read more...
Contactless at the game
Issue 5 2020, IDEMIA , Access Control & Identity Management
IDEMIA partners with JAC to successfully test frictionless biometric access technology at Level5 Stadium in Japan.

Read more...
Focus on touchless biometrics
Residential Estate Security Handbook 2020, Hikvision South Africa, Saflec, IDEMIA , Suprema, Technews Publishing , Access Control & Identity Management
The coronavirus has made touchless biometrics an important consideration for access control installations in estates and for industries globally.

Read more...
Providing peace of mind
Residential Estate Security Handbook 2020, ZKTeco , Access Control & Identity Management
Touchless technology embedded with face and palm recognition sensors provide 100% touchless user authentication for a variety of applications.

Read more...
Frictionless access with a wave from IDEMIA
Residential Estate Security Handbook 2020, IDEMIA , Access Control & Identity Management
Platinum Sponsor IDEMIA displayed its frictionless biometric reader, the MorphoWave Compact, at the Residential Estate Security Conference.

Read more...
Cost effective without compromising security
Residential Estate Security Handbook 2020, Bidvest Protea Coin , Access Control & Identity Management
Bidvest Protea Coin offers a range of services, all integrated to offer a future-proof and cost-effective security solution for estates.

Read more...
Broad range of estate solutions
Residential Estate Security Handbook 2020, Hikvision South Africa , Access Control & Identity Management
Hikvision offers residential estates a range of systems and solutions that deliver security, from the gate to the individual’s own home.

Read more...
Excellerate looks beyond traditional guarding
Residential Estate Security Handbook 2020, Excellerate Services , Access Control & Identity Management
Excellerate Services has a suite of best-of-breed technologies that have been integrated into a sophisticated SLA, incident and people management system.

Read more...