Geeks working with guards

May 2009 Access Control & Identity Management

An integrated approach to managing physical access to premises and logical access to IT systems is desirable, but made difficult by the processes being owned by different parts of the organisation.

There is every reason for organisations to seek an integrated approach to managing physical access to premises and logical access to IT systems. However, this laudable aim is made difficult by the processes being owned by different parts of the organisation (guards and gates versus geeks and technology). It is also impeded by the proprietary nature of many physical access control systems as well as a lack of standards.

The key business drivers that make identity and access management important are financial discipline, operational risk and compliance with legal and regulatory requirements.

Financial discipline: The competitive business environment makes financial discipline a priority for organisations. Financial discipline is not just about saving costs but also about doing things smarter. Organisations that succeed in achieving financial discipline will be those that survive and grow by providing their products and services more efficiently and more effectively than their competitors. Technologies that recognise individuals and their preferences are important by making it easier for customers to do business with your organisation rather than with your competitors. Financial discipline also means managing operations more effectively, making employees more efficient and reducing administrative overheads.

Operational risk: Organisations survive in the face of many risks, including market risk and operational risk. Market risk includes for example, investing in products that do not meet the needs of the customers or where competitors provide better or cheaper products. Operational risk covers aspects such as processes being vulnerable to theft, fraud, disruption or mismanagement. Better management of the way in which employees, partners and customers are identified and their access is controlled and audited can mitigate some of these operational risks.

Although hacker and virus attacks are well publicised, the insider remains the greatest threat to an organisation in terms of potential to cause financial loss. One of the main reasons for this is that the insider understands the organisation’s systems and is hence able to spot and exploit any weaknesses. Another is that they have physical access to systems and this is often poorly managed.

Regulatory compliance: A further aspect concerns compliance with regulation and the law. In some sectors there is now regulation relating to the security of information and information systems.

Managing who is able to access what information (both physically as well as logically) is critical to complying with these regulations as well as reducing risk. Improving the identity management process, including the provisioning, authentication and access control processes, can reduce costs and improve efficiency. Opening up the organisation to allow partners and customers to access information and to securely purchase products can provide competitive advantages and worthwhile improvements in efficiency.

Access management

The processes for physical and logical access management are the same – to control who can have access to what resources. The processes are also the same:

Authentication – proving who you are to gain access. In logical access control this was a username and password. In physical access this was recognition by guards and possession of a pass. Here we immediately see a convergence since most physical access control systems now use a form of card to permit access and many organisations are moving towards a strong form of logical authentication such as a smartcard.

However there are challenges: there are many physical access systems vendors and not all systems are compatible, the cards used for physical access may not be suitable for logical access and the physical access control system may be for a building that is shared between multiple tenants.

Authorisation – the access control policy. In physical access control the policy controls which area you are allowed to access at what times and the gate or door is the policy enforcement point. In logical access control the structure of platform, application and data can be immensely complex but the idea is the same, to control what data can be accessed in what way at what time, and there can be multiple policies and policy enforcement points. Once again there is no single repository for policy and no integration between logical and physical policy management or policy enforcement.

Auditing – tracing who did what which is important to allow analysis of what happened following an incident. Physical access control systems mostly log who passed through gates, IT systems log who accessed various logical assets; however these logs cannot easily be consolidated. Physical access control also includes video monitoring of areas including access control points and integrating this material poses an additional challenge.

The value of this integration is illustrated by a real life example: an organisation suffered from fraudulent transactions being performed using its IT systems. These were investigated by the police and the employee whose user-ID was implicated denied responsibility and claimed that his user-ID and password must have been stolen. However, examination of the audit log for a vending machine near the terminal used showed that the employee had used his physical access pass to obtain a beverage shortly before the fraudulent activity.

Administration – managing the identities and policies. Here the processes for administering physical access are very similar to those for administering logical access but are performed by different people using different tools. When an employee joins an organisation they need to be given physical access to the premises and logical access to the systems and data needed to perform their job. When the employee leaves the organisation these access rights need to be withdrawn. Yes, there are orphan accounts for physical access.

Convergence of physical and IT security

Organisations need to manage the digital identity across entire organisations, authenticating to all corporate assets with a single credential, provisioning all IT systems, Web services, devices and entrance badges and securing access to files, directories and databases while monitoring of all these activities.

Common provisioning processes and technology: to automate the processes for the creation, administration and removal of access rights across all of the different security environments both physical and logical. The access rights given should be based on the functional role of the person being given them. There should be integration between the provisioning system and the human resources system (or other authoritative source of data on the people in the organisation).

This is important to provide separation of duties between the people who have the right to make changes, and the people who have the right to use the systems. This helps to reduce the potential for administrators (or others) to unilaterally give themselves the privileges necessary in order to improperly access the premises or the systems.

Auditing: It is essential that all activities and access rights can be audited, and the audit tools and information should fit within a recognised auditing methodology. Activities include those of administrators as well as users, and cover the platforms, applications and administration tools. It should be possible to link actions to the identity of the people performing the activity rather than anonymous system accounts. It should also be possible to see access rights belonging to each individual and to trace how those rights were acquired and under what authority.

One specific approach to ensuring that individuals’ access rights match those they need is through ‘attestation’. A report of the access rights possessed by each person is sent (via e-mail) to their supervisor who then checks these if they are correct. If they are correct the approval provides proof if they are incorrect the non approval triggers a process to remove them.

The process for collecting information should be tamper proof. For example, administrators (or others) should not be permitted to disable logging of their activities, or to alter the log of what they did. The audit information should be transmitted across the network and stored securely. Reports on the activities for different uses should be accessible. It should be possible to raise alerts in realtime when certain actions are detected (for example repeated failed access attempts).

Michael Small, CA principal consultant Security Management
Michael Small, CA principal consultant Security Management

For more information contact

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

The benefits of electronic visitor management
August 2019, Powell Tronics , Access Control & Identity Management, Residential Estate (Industry)
Access control is a critical aspect of estate security as it represents the controls put in place to restrict entry (and possibly exit) along the outer boundary of the location.

Addressing risks by means of access control layout and design
August 2019 , Access Control & Identity Management, Security Services & Risk Management
In order to develop a suitable, practical and appropriate security system for any organisation, it is essential to first develop a master security and life safety plan strategy.

Secure hands-free access
August 2019, Suprema , Access Control & Identity Management, Residential Estate (Industry)
Suprema’s facial biometric terminals bring no-touch access into secure residential estates, high-rise apartments and luxury homes providing fast, easy and intuitive user authentication with the added benefit of hygiene.

MorphoAccess Sigma Extreme
August 2019, IDEMIA , Products, Access Control & Identity Management
MorphoAccess Sigma Extreme from IDEMIA is a touchscreen device with multiple recognition device interfaces (NFC chip reader, PIN and BioPIN codes, contactless card readers).

Outdoor access terminals
August 2019, Suprema , Access Control & Identity Management, Residential Estate (Industry), Products
Rugged, dust- and weather-proof access control solutions that provide exceptional durability in extreme conditions is a strong requirement for many residential estates.

MorphoWave Compact
August 2019, IDEMIA , Products, Access Control & Identity Management
The MorphoWave Compact captures and matches four fingerprints on either the right or left hand in any direction. It is robust to environmental factors such as extreme light or dust.

MorphoAccess Sigma Lite
August 2019, IDEMIA , Products, Access Control & Identity Management
IDEMIA’s MorphoAccess Sigma Lite and Lite + are fingerprint access control terminals, offering time and attendance in and out function keys.

Eliminating forced gate opening scenarios
August 2019, ET Nice , Home Security, Access Control & Identity Management
When activated by the gate forced open alarm feature, the transmitter transmits a wireless alarm signal up to 750 metres in any direction.

IAM has business on high alert
August 2019 , Access Control & Identity Management
Identity and Access Management (IAM) is now a must in commerce and the need to protect digital assets is driving the development of solutions and widespread adoption

Came acquires Turkish company Özak
August 2019, CAME BPT South Africa , News, Access Control & Identity Management
Came broadens its market horizons and signals growth and consolidation in the Middle East.