|
An Independent Perspective on implementation of Access Control
Systems
|
By Gordon Herrald
[Hits: 27007]
|
|
An Independent Perspective on implementation of AccessControl Systems
Access Control Systems can have a major impact on thesecurity and daily functioning of an organization. This articleoutlines fundamental issues to be taken into consideration bysystem purchasers.
There is a well-known process that most people go through onthe loss of a loved one: anger, denial, bargaining, depressionand finally acceptance. Similar reactions arise when a largeorganization embarks on installing a comprehensive accesscontrol system. However, once acceptance is reached, which oftentakes one to three months, a reversal of attitudes is frequentlyseen. Instead of the standard curse when a cardholder approachesan access control card reader operated door as seen prior toacceptance, a sense of protection is acquired.
Access control systems are complex and they need to be carefullyplanned to ensure effective integration into the businessoperation.
As always in large technical projects, the technical problemscan be difficult to overcome, but not always the humanones.
When thinking of introducing an access control system, one needsto bear in mind several key points. These card access systemscan cost a lot of money and take up a large amount of companytime, and 95% of access control systems are not security systemsper Se, they only restrict access to persons exhibiting normalacceptable social behaviour. If you are looking for security youneed to think of full-time monitoring and effective responses tosystem alerts. This means labour, in-house or contract, which ifit is not already present in some form or another can cost morethan the system.
The hardware is only part of any solution, with largeinstallations the purchaser needs to input a lot of man-hoursduring the installation to set up the system in a way that bestsuits his or her organization. There is also the production andissue of keys/identity cards/tokens/pin numbers and the on-goingoperational maintenance to provide for. Access control systemscan provide many benefits apart from the obvious, goodinstallations have been shown to produce significant changes tothe working culture in the work place, as they tend to make (orforce) employees to be more accountable and protective of theiremployer's property.
The Right Approach There is typically a choice ofthree routes to installing an access control system. You couldapproach several suppliers for proposals or use an in-houseengineer or consultant. However, consideration should also begiven to using an experienced external access control consultantto produce the necessary advice and documentation and to guideyou through the steps. As in most industries, the response todetailed professional documentation that is clear in itsobjectives and reduces risk for both purchaser and its suppliersis met with very competitive prices, and a strong desire to winthe contract. The penalty to the purchaser for not getting theright person on-board at the start of a large installation canbe high. The impact the system may have on the operation of anorganization should always be fully analysed and understood. Theright approach involves consideration and acquisition of thefollowing:
- appointment of an in-house project manager/co-ordinator,
- appointment of an external independent access controlconsultant,
- a risk assessment, (There is no point controlling thefront door if a back door route is open.)
- asking for strategy proposals with detailed
- recommendations and budget estimates,
- board approval,
- designs, specifications, contract conditions, tender
- lists and documentation, and job descriptions,
- tender appraisal (short term & long term)
- negotiations and award of contract,
- regular project meetings and site supervision,
- ensuring the factory and on - site acceptance testsand tests at the end of the defects liability period arethorough,
- negotiating a fair and reasonable maintenancecontract.
During the tender appraisal stage of a contract for a newintegrated system, it is worthwhile visiting other organisationswho have had similar access systems installed whenever possible.In one case, an installation presumably considered as a showsite by one of the favoured tenderers, was visited by thepotential client organization. After the visit it was reportedthat, technically, the installation looked really professional,but that for all the money spent on it, the access controlsystem was only being used at night when there was nobody about.
Was the above system planned thoroughly in advance of theinstallation and was it introduced correctly to meet theorganisation's objectives?
Without the proper operational support, such access systems areoften switched off for good after a few weeks!
Security Management Systems
Access control systems are often part of an integrated system.Integrated systems can reduce the diversity and complexity of apossible multitude of different building functions down into asingle manageable system. Where there are building criticalfunctions, auditing becomes very important. If this isstructured correctly in an integrated system, managementfunctions can be greatly streamlined. Secure auditing of keybuilding services' alarms can be great added value to facilitymanagers.
Built into the software of many of the systems available includefeatures that allow the printout of lists of people within anarea or building at a particular time. This can be importantduring emergency evacuations. Some software packages have fullydeveloped roster or mustering features. Guard tours packages arealso common allowing guards to be tracked while patrolling apre-arranged route.
Reports should always be readily available. From the mass ofsystem activity, data managers should be able to request reportson just about anything they want, in many cases that may bereports on just exception incidents. Large integrated systemsare therefore management systems first and foremost and aretherefore often referred to as security management systems. Awell-planned system will not only monitor and control inputsfrom various systems; it will also monitor the performance andactivities of the operators or guards. This introduces the keyissue of "accountability" which is of course essential to highsecurity installations.
Purchasers should be advised not to show-off their contractualpurchasing power by demanding unrealistic timescales fromsuppliers, as it will cost more in the end - possibly a lotmore. To get your Total Cost of Ownership (TCO) over a number ofyears your budget should include not only the tender price forthe equipment installation, but civil works (especially forinter-building ducting, turnstiles and car parking units),electrics, alterations to rooms (e.g. control rooms), doors,gates etc., security consultancy costs, in-house project team,training and operational costs, increased number of contractoperators and on-going maintenance costs.
Control Rooms and the System Interface
If an organization introduces 24-hour manned guarding orsecurity monitoring where the guards are expected to respondefficiently to security, fire, access and prime buildingfunction alarms, the alarms need to be presented in a mannerthat allows them to do so, and in an environment that encouragesit. Where alarm panels are wall mounted around a tiny room andthe guard bombarded with alarms in an unstructured way, he/shemay miss a critical battery low alarm or worse. Discriminationagainst security personnel is still widespread, and securitystaff with low morale do not, in general, perform well under anycircumstances.
I have witnessed an (apparently) trained guard at the main dataprocessing site of a large UK bank panic and fail to respondcorrectly with a (deliberately operated) security alarm becausethe circumstances were different from normal - he was beingwatched by visitors.
Give the security personnel appropriate working conditions andeffective equipment to use and they become pro-active, gain ahigher profile within the organization and try to continuallyimprove site security. Remember that the security control roomis a good indicator of your security. The most important part ofany access control or integrated system is the user interface.Training of users is essential, but access control securitysystems still have to be designed in such a manner that theymore or less instruct the user what to do.
Equipment and Suppliers The majority of complexaccess control systems software is written in North America andare supplied and installed by large or specialist securitycompanies. Don't expect them to tell you what you need. In manycases I have found sales representatives do not really know whatthey are selling and what impact the system may have on theoperation of an organisation. Your business is unique and thepressures applied to system sales forces these days do not givethem time to fully analyse or understand your needs.Insufficient training, new products and system upgrades comingtoo fast are all too common problems for system integrators.
Unless you insist, the supplier's personnel who most understandtheir company's products will not normally have much contactwith the client until after the sale is made. Demand forengineering time for commissioning or rectification of badlysold or poorly specified access card control systems is high formany suppliers.
Door Entry Technology There are many terms for thevarious types of technology used for gaining entry, theseinclude; hands free, proximity, card swipe, card scan, biometricand keypad. The ones attracting most interest at present arebiometric and smart card proximity type. Door holding/lockingmechanisms come in all shapes and sizes; however, certain typescan be overcome quite easily if the design is not thorough.During a security audit at one large organization, theDepartmental Manager was shown just how easy it would be to comeback later that evening, pass through the doors and clear outthe entire department without the need of force or a valid cardand without raising an alarm - and the doors had good qualityelectric locks fitted!
Biometrics Biometrics access control is based on theverification of a person wanting access through an access portalby identification of a part or physical characteristic of theperson wanting access.
Biometric access control has largely been developed to overcomethe problem with card reader access control systems whereby whena card is presented to a card reader, the card reader verifiesthat the card is the right card; it does not verify that theholder of the valid card is the valid cardholder.
None of the current biometric access control systems on themarket have reached their goal of achieving 100% readingaccuracy. However, development has now reached a stage wherepractical uses for biometric reader systems are justifiable forparticular applications.
Fingerprint biometric identification systems are the currentmarket leaders of biometric access control systems. The majordrawback today with fingerprint biometric access control systemsis the time required to verify fingerprints in large databases.This is typically dealt with by giving users an access card aswell, so the biometric reader system only needs to check thefingerprint against one record.
The technology currently receiving most attention in theaviation industry is facial recognition with its functionalitybeing non-intrusive and passive.
Iris recognition technology is also growing fast with goodaccuracy of readings.
Retina recognition still suffers from people's apprehension ofputting their eye up to an electronic device.
Signature verification is still around. Mainly being used bygovernments and the military.
Hand geometry biometric access control is still remaining a goodseller, but appears to be losing its market position.
Voice verification biometric access control still has some wayto go to catch up with the other technologies, but in the futureit is likely to become very important in telecommunications.
Smart Cards Smart access control cards are typicallyplastic ISO standard cards with an embedded chip and aerial.Certain smart cards have surface contacts showing, currentlypreferred by banks but they are not popular for access controlreaders where throughput is important.
System Design Many of the system structures beingadopted today by system designers are following the fashionabletrends of modern networks, which is not always desirable forsecurity access card control systems with life-critical orbusiness-critical functions that require built-in redundancy.
Care also has to be taken if the system is to sit on an existingnetwork. The requirements to ensure the integrity of the systemcan often fly in the face of existing IT policy. Also, if youstart sending large numbers of photograph images or databaserestorations around a network, there are bandwidthconsiderations.
Testing Acceptance testing should be very thoroughagainst the requirement specification as very few (if any)integrated systems are independently tested. In-house designstaff normally carries out most testing with the usual pressuresfor fast market returns. I'm sure most suppliers would welcomeindependent testing, as it would solve a lot of theirinstallation problems. Again it's the speed at which newreleases and upgrades are brought to the market that makes itdifficult and expensive. Until there is user demand across theindustry, it is unlikely suppliers will consider it as givingtheir products a commercial advantage.
Standards and Legal Requirements For standards andlegal requirements see - www.herrald.co.uk/access
Conclusion The decision to install a large accesscontrol system can have far reaching consequences and anyimplementation should be carried through in the sameprofessional manner as any other major business-critical system.
* Need content? You may use this article at your website, or inyour newsletter. The only requirement is inclusion of thefollowing sentence with hyperlink: Article by Gordon Herrald ofwww.herrald.co.uk, independent and international security engineeringconsultancy.
|
|
|
|
|
|
