{"id":81546,"date":"2020-05-14T13:42:34","date_gmt":"2020-05-14T11:42:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/skud-problemy-resheniya-i-upravlenie-riskami-bezopasnosti"},"modified":"2020-05-14T13:42:34","modified_gmt":"2020-05-14T11:42:34","slug":"skud-problemy-resheniya-i-upravlenie-riskami-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/skud-problemy-resheniya-i-upravlenie-riskami-bezopasnosti","title":{"rendered":"Access Control Systems: Problems, Solutions, and Security Risk Management","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Access
\nSource<\/i><\/a><\/noindex><\/p>\n

Contrary to popular belief, access control and management systems rarely solve security problems on their own. In reality, they create opportunities to address such issues.<\/p>\n

When you approach the choice of an access control system from the perspective of a ready-made security package that will completely eliminate the company's risks, difficulties are inevitable. Moreover, complex issues will only manifest after the system is deployed.<\/p>\n

At the forefront are challenges related to connectivity and interface. However, there are numerous other risks that could threaten the company. In this article, we will thoroughly examine unresolved issues related to interactions with physical security systems, as well as present the Ivideon solution for monitoring personnel and access.
\n<\/a><\/noindex><\/p>\n

Problems and Risks<\/h2>\n

\n\"Access
\nSource<\/i><\/a><\/noindex><\/p>\n

1. Availability and uptime<\/b><\/p>\n

Typically, 'continuous cycle' enterprises include metal manufacturers, power plants, and chemical production facilities. In reality, a significant portion of modern businesses has transitioned to a 'continuous cycle' and is quite sensitive to both planned and unplanned downtimes.\u00a0<\/p>\n

Access control systems cover more users than it seems. In traditional security systems, you need to constantly stay in touch with all users to avoid business downtime\u2014through newsletters, push notifications, and messages like 'colleagues, the turnstile is not working' in messengers. This helps, at the very least, to reduce misinformation during access control issues.\u00a0<\/p>\n

2. Speed of operation\u00a0<\/b><\/p>\n

Traditional card-based systems consume an astonishing amount of working time. This happens frequently: employees of our client often forgot or simply lost their access cards. Up to 30 minutes of working time was spent on reissuing passes.
\n\u00a0
\nWith an average salary of 100,000 rubles for the company, 30 minutes of working time costs 284 rubles. 100 such incidents result in a loss of 28,400 rubles excluding taxes.<\/p>\n

3. Constant updates<\/b><\/p>\n

The problem is that the system is not perceived as something that requires constant updates. Besides security itself, there is also the issue of monitoring convenience and reporting.\u00a0<\/p>\n

4. Unauthorized access<\/b><\/p>\n

Access control systems are vulnerable to unauthorized access, both external and internal. The most obvious issue in this regard is the tampering of time logs. An employee may 'arrive late' by 30 minutes every day, then carefully correct the logs, leaving management in the dark.\u00a0<\/p>\n

Moreover, this is not a hypothetical scenario, but a real case from our client interactions. Such 'lateness', when calculated per person, resulted in nearly 15,000 rubles of loss for the owner each month. In a large company, this can accumulate to a significant sum.<\/p>\n

5. Vulnerable Areas<\/b><\/p>\n

Some employees can unilaterally change their access rights and move around freely at any time. Do we need to clarify that such a vulnerability presents significant risks to the company?\u00a0<\/p>\n

In general, an access control system is not just a locked door or a turnstile with a sleepy guard. In an enterprise, office, or warehouse, there can be multiple locations with varying access levels. There are areas designated for management only, spaces opened for contractors while everything else is secured, or a conference room for visitors with temporary access, while passage to other floors is restricted. In all cases, an intricate system of access rights distribution can be utilized.<\/p>\n

What's Wrong with Classic Access Control Systems<\/h2>\n

\nTo begin, let's define what a 'classic access control system' is. We will consider: a turnstile or door with an electric lock, access card, reader, controller, PC (or Raspberry Pi or something based on Arduino), and a database.\u00a0<\/p>\n

In the simplest case, there may simply be a person labeled 'Security' who records all visitors' information by hand in a paper log.\u00a0<\/p>\n

A few years ago, Ivideon operated a badge-based access system, just like almost everywhere in Russia. We are well aware of the downsides of RFID cards\/keys:<\/p>\n