Combating the cyber criminals

June 2004 Information Security

When access control systems were first introduced, they consisted of control panels, readers, electrically controlled door strikes, cards, and a personal computer. That part has not changed much. In the late '70s and early '80s semiconductor technology was in its infancy and still relatively expensive. As a result, the realm of access control was limited to governments and large businesses. It was not a practical or affordable security solution for mid-size to small companies. And it was still a relatively unknown commodity. Unlike today, controllers were slow with limited memory. The interval between a card swipe at a reader and the response to unlock the door could take as long as 30 seconds depending on how much activity was going on in the building. Compare that to response times of less than 1 second nowadays. Readers were pretty much limited to magnetic stripe and Wiegand swipe technology.

Integration, integration and more integration

Much has changed in the ensuing years. Although they still primarily consist of control panels, readers, electrically controlled door strikes, cards and personal computers, the dynamics of access control has undergone a radical transformation.

Access control systems have grown more sophisticated expanding well beyond their original intention of merely managing doors. Advancements in semiconductor technology have given rise to faster and more intelligent controllers and readers. And the evolution of personal computers with more powerful microprocessors and the advent of networks have spawned greater integration with other building systems and business systems. With a marked reduction in the costs of components, access control has become a much more affordable security application. And it is the end-user who has driven these changes and will continue to drive the changes as manufacturers are compelled to react to market demands. Access control systems, besides doors, now regulate elevators and parking garages, too, interface with building maintenance and alarm systems, connect with closed circuit television systems, integrate with photobadge ID card systems, have the ability to e-mail alarm messages to Internet connected wireless devices, and the access control software applications offer a full range of site management tools and report capabilities. Perhaps the greatest significant development in access control is the capability of interfacing with LAN/WAN technology allowing the interconnection of multiple buildings, regardless of their proximity to one another, and integrating those buildings into one system with multiple points of monitoring and control. The benefits of harnessing all these features into one integrated system has obvious benefits for the end-user, but manufacturers must constantly modify their products and it places greater and greater demands on dealers and installers. Dealers must be versatile and have an understanding of electrical and electronic concepts, understand access control systems, building maintenance systems, alarm systems, CCTV systems, as well as having computer skills and some knowledge of network technology. And if that is not enough, they must also know various manufacturers' products and those that are best suited to their clients' needs.

CCTV integration

Closed circuit television systems have been around for a long time. But CCTV systems were generally self-contained. With the development of video capture boards for PCs a decade ago and as PC processor speeds have increased exponentially over the past few years, it is now practical for access control systems to integrate with CCTV systems. The access control software can monitor live video feeds, initiate camera actions in response to an alarm condition while still controlling, monitoring and recording site activity. The integration of CCTV with access control provides end-users with a big economical advantage. Amalgamating the two platforms eliminates the cost of redundant equipment and gives security personnel efficient control of both systems from a single PC. And just to demonstrate that we are not resting on our laurels, access control systems are currently re-tooling to interface with digital video recorders and Web-based cameras as CCTV technology strides forward.

E-mailing alarms

In the past, to be apprised of an alarm condition, someone had to be at a fixed position at a PC or monitor. As the Internet has become a revolutionary communication tool, you can virtually go anywhere on the planet in seconds, access control has been given a new dynamic in security management. The access control software can be programmed to e-mail alarm conditions or critical building maintenance messages to any Internet e-mail address including wireless devices such as cellphones and PDAs. For the small business owner who does not have the luxury of security personnel, equipped with a cellphone or PDA, the access control system automatically e-mails a message so the recipient is quickly alerted and can respond accordingly to an emergency.

LAN/WAN

The advent of local area networks/wide area networks and modems have given access control systems the ability to regulate multiple buildings whether they are in proximity to one another or on the opposite sides of a continent. Property management companies, governments, major corporations or other organisations with multiple buildings can maintain total control of all buildings from one central office or give staff within each building full or partial control over their own building or the entire system, or, as may be the case with security guards, restrict usage to just monitoring the system for alarms. And with all buildings under one system, individuals can access any or all buildings with one access card. Imagine the benefits of an access control system integrated with a CCTV system that controls and monitors a building in Seoul from another building in Hong Kong or vice versa.

Access control software as a management tool

As access control systems have grown more sophisticated, the software, too, has grown not only in sophistication, but in functionality as a management tool, offering a wealth of report formats. With a self-contained database that records every system transaction, an access granted or access denied at a door, an alarm event, or a system administrator entry, management can tap into this vast pool of data collected by the database. Reports can range from cardholder information, site activity, time and attendance, site evacuation, alarms, and site structure with wide latitude in filtering the contents. Some access control software can import and export database contents in CSV file format. This saves on duplication of information common to other departments such as personnel records that can be converted to access control cardholder records. Many access control systems offer ancillary applications such as photobadge and guard monitoring software.

These software applications are designed to integrate with the access control software and share the database. Photobadging allows end-users to design templates and incorporate specific database fields in the template. When the ID card is printed it is personalised for the individual cardholder based on the parameters specified in the template. This could include the company logo, a photo, first and last name, and department of the cardholder. Cards can also be colour-coded to distinguish authorised access clearance for various areas in a building or imprinted with a bar code for other third-party applications.

For companies that employ security personnel or contract out to third-party security services, dedicated guard monitoring software is available. The advantage of a guard monitoring application is it provides management with a tool to direct and report on security personnel activity and excludes them from having direct contact with the access control software. The range of functionality with the guard monitoring application can be regulated at the discretion of management.

Guard monitoring software gives management the ability to format guard tours based on system controlled points and report the results of each tour, set alarm messages to specific readers or inputs. The monitoring application will also allow security personnel to monitor multiple site activity and with the ability to lock and unlock doors at any site under the jurisdiction of the software.

Price vs security

A common misperception is that all readers are the same, all access controllers are the same, and all cards are the same. To many end-users, and in some cases even dealers, the only perceptible difference, other than the names of manufacturers, is the price. The price is not necessarily indicative of the quality, reliability, and the level of security offered by the system. Not all access control components embrace proven technologies that provide adequate security and offer longevity of service. Does the access control system have an open architecture? If the system requires expansion, open architecture allows integration of other manufacturers' systems. Proprietary architecture does not. Can the cards be easily duplicated or compromised? Different card technologies do not all offer a high level of security.

Do the readers use proven technology and will they operate reliably in their environment. Are they susceptible to damage? Does the access control system use fully-intelligent distributed processing or is it host-dependent? With fully-distributed intelligent processing, each access control panel continues to operate without any degradation to performance or security. Is after-sales technical support available? With the complexity of today's systems, end-users are gratified to know they can make a phone call and receive help for any technical difficulties.

These are just some of the factors that buyers should be aware of when considering the selection of an access control system. Obviously different clients require different needs and do not necessarily require a premium system with all the incumbent ancillary devices, software applications, or the integration other systems. But if the access control system fails in offering a reliable and efficient security platform, then the end-user's investment is at risk.

Where is it all leading?

No one has a crystal ball to predict the future, but based on history, access control systems will continue to integrate with other business systems and with wireless communication technology. We are almost there now, and one can envision not only being informed of alarm or other critical messages but having complete control of the system with the use of a cellphone or PDA. With the digital transmission of images, someone with a cellphone that is connected to the access control system could from a remote location see who is at the door via a camera feed, converse with that individual, and use the keypad to unlock the door. Like we said, no one has a crystal ball but it is certainly foreseeable in the not too distant future.

Where do we go from here? As is the case for all businesses, access control manufacturers will continue to be confronted with assessing the market potential of new technologies and constantly adding product enhancements to their systems. But on the flip side of the coin, they must be sure that their products remain cost competitive in the market place. It is a fine balancing act to be sure.





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

A strong cybersecurity foundation
Milestone Systems Information Security
The data collected by cameras, connected sensors, and video management software can make a VMS an attractive target for malicious actors; therefore, being aware of the risks of an insecure video surveillance system and how to mitigate these are critical skills.

Read more...
Surveillance and cybersecurity
Cathexis Technologies Information Security
Whether your business runs a security system with a handful of cameras or it is an enterprise company with thousands of cameras monitoring sites across a multinational organisation, you must pay attention to cybersecurity.

Read more...
Cybersecurity and AI
AI & Data Analytics Information Security
Cybersecurity is one of the primary reasons that detecting the commonalities and threats of what is otherwise completely unknown is possible with tools such as SIEM and endpoint protection platforms.

Read more...
What are MFA fatigue attacks, and how can they be prevented?
Information Security
Multifactor authentication is a security measure that requires users to provide a second form of verification before they can log into a corporate network. It has long been considered essential for keeping fraudsters out. However, cybercriminals have been discovering clever ways to bypass it.

Read more...
SA's cybersecurity risks to watch
Information Security
The persistent myth is that cybercrime only targets the biggest companies and economies, but cybercriminals are not bound by geography, and rapidly digitising economies lure them in large numbers.

Read more...
Cyber insurance a key component in cyber defence strategies
Information Security
[Sponsored] Cyber insurance has become a key part of South African organisations’ risk reduction strategies, driven by the need for additional financial protection and contingency plans in the event of a cyber incident.

Read more...
Deception technology crucial to unmasking data theft
Information Security Security Services & Risk Management
The ‘silent theft’ of data is an increasingly prevalent cyber threat to businesses, driving the ongoing leakage of personal information in the public domain through undetected attacks that cannot even be policed by data privacy legislation.

Read more...
Data security and privacy in global mobility
Security Services & Risk Management Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Read more...
Sophos celebrates partners and cybersecurity innovation at annual conference
News & Events Information Security
[Sponsored] Sun City hosted Sophos' annual partner event this year, which took place from 12 to 14 March. Sophos’ South African cybersecurity distributors and resellers gathered for an engaging two-day conference.

Read more...
The CIPC hack has potentially serious consequences
Editor's Choice Information Security
A cyber breach at the South African Companies and Intellectual Property Commission (CIPC) has put millions of companies at risk. The organisation holds a vast database of registration details, including sensitive data like ID numbers, addresses, and contact information.

Read more...