Checklist for converged access control solutions

May 2009 Access Control & Identity Management

Jeremy Kimber, Honeywell’s EMEA marketing leader, lays out the key points to consider when choosing a converged access control solution.

In the past few years, perhaps no security industry buzzword has been defined in articles and promotional materials as many times as ‘convergence’. These definitions have most commonly referred to the integration of physical security and IT systems, with occasional elements of building control. These definitions, while helpful to end users, beg the ultimate question: 'How do I make it work?'

Convergence uses data generated by both physical security and IT systems to drive both business process efficiency and security, and its framework defines a migration path for organisational growth. Here are some basic elements required to ensure a solution is truly converged.

Common security policy management and control

The IT infrastructure is the backbone of a converged solution, sharing knowledge of key business data across systems. The physical security system does not inherently know critical business data such as employee status, staffer security clearances and training certifications. A computerised HR system, though, often has this knowledge. IP-enabled security systems therefore allow users to take advantage of fixed investments and improve return on investment (ROI).

Developing common protocols for managing access to company assets and data enables more efficient provisioning and management. An organisation develops role-based policies that can manage badge issuance, enrolment and revocation processes by leveraging XML/SOAP interfaces for integration with identity management solutions. The key benefit is that building security personnel continue to use tools best suited to their jobs and HR personnel continue using HR tools.

Organisations should identify:

* Authoritative sources (the system that has the ultimate say) for each person who has a building badge or an IT account.

* Sources (IT systems or people) of key data used to determine whether a person has permissions to use a resource or access an area.

* Compliance or audit needs where the data exists on multiple systems.

* Any business or security concerns that are unique or are especially important to an organisation.

* Key business processes (onboarding, offboarding, change of position) and determine the responsibilities of different systems.

* A policy platform that supports customisable workflow creation tools to easily model processes and approvals.

Common user provisioning

Convergence drives the business to contemplate the inter-relationship of physical security on IT security and vice versa. How many organisations can definitely claim that terminated employees or contractors are immediately removed from their building access control systems? How many are confident that a former employee who tailgates into the building does not have active IT accounts? How many are confident current employees would recognise former employees and know the person has been terminated? Provision dynamics are evolving and driving user permissions in non-IT and external IT systems.

Organisations must:

* Determine how many terminated employees or contractors still have active building badges and IT accounts.

* Determine how many contractors who have not been on site for the last three months still have active building badges.

* Perform studies to see if anyone questions tailgaters.

* Benchmark how long it takes for someone to be provisioned or de-provisioned.

* Educate employees on security risks.

Single access credential

Building security starts with a badge, often a proximity card. IT security, meanwhile, starts with a user name and password. When organisations want to add more security to a card, they can add a PIN or a biometric. As IT systems look to increase security, however, the choices are not equivalent.

Organisations can add:

* An RSA token or biometric that authenticates the correct person.

* A contract smart chip – embedded either in a card or in a USB dongle – that authenticates the correct person, and is also used for non-reputable digital signatures. Digital signatures are important in regulated environments to verify a person did approve or take action. A single-card solution that includes a contact smart chip for IT and proximity technologies (contactless smart or 125 kHz proximity) enables the organisation to manage one resource for each employee, thereby minimising both material and administrative costs. An optimised card issuance process allows building security to continue issuing badges and the badge issuance process will be connected to IT systems for provisioning as a single process.

Steps to take:

* Building security teams should discuss access credentials with their IT counterparts to identify opportunities to leverage cards across the organisation.

* IT departments should review authentication and PKI requirements/needs.

Correlation of events

By connecting systems, organisations can correlate seemingly disparate physical and IT security events. For example, it may not seem suspicious for an employee to download large amounts of data. However, system correlation might show the employee only downloads the data when he is in the room by himself.

Organisations must identify:

* Thresholds of normal employee behaviour by job classification. It may be necessary to audit current behaviours.

* Business events that may cause security breaches (receipt of a resignation notice, termination for cause, unexpected change in work hours).

* IT resources and/or locations with sensitive information (intellectual property, identity data) and develop a plan to lock down for normal security levels and for a heightened security level. Organisations must determine the return on risk for each sensitive item and develop security response plans accordingly.

* Normal usage for each sensitive resource and what would be considered abnormal (downloading all customer data or customer credit cards).

Convergence provides substantial benefits

Convergence is the first step for any organisation to connect its critical systems to provide a comprehensive and coherent security policy. By integrating systems to share information, an organisation can see vulnerabilities in realtime and link IT security events with physical security responses. These abilities all drive realtime security policy management. The next step will be proactive threat management, which enables correlation of realtime information with historical information. The system will learn how to manage the current environment and react in a realtime manner, increasing system value and improving ROI.

The system, for instance, can classify behaviour such as a certain employee trying to access random doors every few days or unusual behaviour by a subset of employees who all had security clearances processed by a specific adjudicator. Using a converged system can reap substantial benefits and will provide additional benefits in the future as convergence continues to evolve. How organisations choose to implement these new toolkits is up to them and their individual security and compliance requirements.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

The benefits of electronic visitor management
August 2019, Powell Tronics , Access Control & Identity Management, Residential Estate (Industry)
Access control is a critical aspect of estate security as it represents the controls put in place to restrict entry (and possibly exit) along the outer boundary of the location.

Read more...
Addressing risks by means of access control layout and design
August 2019 , Access Control & Identity Management, Security Services & Risk Management
In order to develop a suitable, practical and appropriate security system for any organisation, it is essential to first develop a master security and life safety plan strategy.

Read more...
Secure hands-free access
August 2019, Suprema , Access Control & Identity Management, Residential Estate (Industry)
Suprema’s facial biometric terminals bring no-touch access into secure residential estates, high-rise apartments and luxury homes providing fast, easy and intuitive user authentication with the added benefit of hygiene.

Read more...
MorphoAccess Sigma Extreme
August 2019, IDEMIA , Products, Access Control & Identity Management
MorphoAccess Sigma Extreme from IDEMIA is a touchscreen device with multiple recognition device interfaces (NFC chip reader, PIN and BioPIN codes, contactless card readers).

Read more...
Outdoor access terminals
August 2019, Suprema , Access Control & Identity Management, Residential Estate (Industry), Products
Rugged, dust- and weather-proof access control solutions that provide exceptional durability in extreme conditions is a strong requirement for many residential estates.

Read more...
MorphoWave Compact
August 2019, IDEMIA , Products, Access Control & Identity Management
The MorphoWave Compact captures and matches four fingerprints on either the right or left hand in any direction. It is robust to environmental factors such as extreme light or dust.

Read more...
MorphoAccess Sigma Lite
August 2019, IDEMIA , Products, Access Control & Identity Management
IDEMIA’s MorphoAccess Sigma Lite and Lite + are fingerprint access control terminals, offering time and attendance in and out function keys.

Read more...
Eliminating forced gate opening scenarios
August 2019, ET Nice , Home Security, Access Control & Identity Management
When activated by the gate forced open alarm feature, the transmitter transmits a wireless alarm signal up to 750 metres in any direction.

Read more...
IAM has business on high alert
August 2019 , Access Control & Identity Management
Identity and Access Management (IAM) is now a must in commerce and the need to protect digital assets is driving the development of solutions and widespread adoption

Read more...
Came acquires Turkish company Özak
August 2019, CAME BPT South Africa , News, Access Control & Identity Management
Came broadens its market horizons and signals growth and consolidation in the Middle East.

Read more...