Shopping for Building Access Security?

JoeCommodore asks: "At work we are planning a new facility, which will combine a lot of departments into one bigger building. We think it may be time to forgo analog key access and go with access cards (or something like it) for physical security. I could see the benefits (we don't have to collect keys and re-do locks on staff turnover, selective room access, access logs, and so forth). Beyond this, we are pretty clueless on the ins and outs of such systems, so I am asking those of you who have had to shop, install, administer, or even just regularly use such systems, what are your thoughts, recommendations, or opinions? This is pre-building so we can do just about anything within reason."

Comments

Remember the POWER OUTAGES

[jackb_guppy]

Once you lock the doors with electronics remmeber power outages can and will hurt. Also your security is right out the window (door in the case!).

Plan for no power to power the locks.

1) One company, they planned for power outages, by placing the key control computer in a closet, with its own UPS. The day the building went dark (failed breaker) the key control was working find, the servers were on their own UPS. Every desktop was down; the wireless routers and inter-floor routers/switches were down; OH the doors to server were locked - NO power open them. We all could see in the computer room though the big glass window as the equipment started to hardfail.

2) At another company, once the power fails, all doors are opened and blocked with a chair to allow employees and anyone else though. All the video cameras are offline along with every switch. It would have been better just to clear the building and send everyone home.

So keep a few keys, they help.

Re:Remember the POWER OUTAGES

[wilko11]

Also, remember fire codes. If you use a qualified security contractor/consultant as the poster suggested, they should think of this for you, but you need to consider doors that are in the emergency exit path - These doors cannot be locked in the event of a power failure. They will need to be fitted with free-exit handles or break glass releases. These doors should also be fitted with a 24 hour monitored alarm that activates when the door is released manually, not just a local siren.

priximity cards are nice..

[joeldg]

we used those in our datacenter, just walk up and wave your wallet at the reader and it blinks and you are logged as going and the door opens, makes it pretty easy to see the comings and goings of all the employees and see who spends more time where.

Some places also use these for time clocks and apparently they work pretty well when placed by the front door.

Abloy locks

[CmdrPorno]

I agree with the other posters regarding biometric locks--Mythbusters recently tested them and was not impressed with their ability to distinguish real and fake fingerprints.

Abloy (also known as Assa-Abloy) and Medeco both manufacture physical locks that are difficult to pick. It is also difficult to find someone to duplicate them.

Card types

[Tacvek]

You have some choices. A card based system is generally a good idea.

There are three card types that are common and moderately safe:
1. Magstripe: Simple and cheep, but easy to duplicate.
2. Smartcard: Very difficult to fake, slightly less convient than than swipecards.
3. Contactless Smart Cards: Nearly as secure as smartcard, and far more convient. Employees would prefer this option, but it is probably the most espesnsive.

The smartcards use public key cryptography with challenge/response verification which makes them quite secure. Arguagble more secure than physical keys.

Avoid passive RFID cards.

Make sure support is at their expense

[Anonymous Coward]

I've seen a few access control systems that have been in place for over a year and still have weekly problems requiring technicians to come out and fix thems. Other systems get installed once and never have a problem. So clearly there is some quality difference between the different products. I would suggest that you make sure that any follow-up/repair work is at their expense, and there are some sort of penalties on the vendor if the system fails to perform as designed. You don't want a system that's flaky, costing employee productivity, and requiring constant repairs for which you're builled by the hour.