Safety & Security (Prepare and Be Aware)
Managing Access Control
Many college and university campuses have physical key-and-lock doors and electronic card access doors. Is that a security problem?
As long as campus police or security has control of the locks, that isn’t a security problem. Key-and-lock doors do cost more to maintain than electronic card access doors, which are, of course, expensive to install. But these are cost problems, not security problems.
PHOTO COURTESY OF DAVID GALLARD
A locked door is a locked door. A security problem arises when the person opening a locked door with a key or a card is someone other than the person who was issued the key or the card. That problem is easier to fix with an electronic card access system.
With an electronic system, a public safety officer can log onto the system and turn off a lost or stolen card and make a new card. It’s a quick and easy. With a lost key, you need to go to work. You have to rekey the lock and make a new key.
Some schools that have been issuing keys for many years have lost control of the keys altogether. Inadequate records track who has received keys for what rooms. Inadequate records track who has returned the keys at the end of the school year. That means there is no way of stopping students who kept their room keys from last year and decide to enter their old rooms and take something.
It’s a security risk.
Seize Control of the Keys
That doesn’t mean you can’t control access with keyed locks. You can, but you need to control the keys and who has them. “If you have lost control of keys, you can regain control,” says Jeff Slotnick, CPP, PSP, founder and chief security officer of OR3M, a Bellevue, WA-based security-consulting firm. The first step is to inventory all of the outstanding keys. You might need to go building by building and collect the keys.
“When you identify what keys work on which doors, pull the tumbler out of door 100 and swap it with door 50. Exchange all of the tumblers that way. When you finish, those that didn’t turn in their keys can no longer use them.”
Next, set up a record-keeping system to track keys so you won’t need to go through such an ordeal again.
The Case for Electronic Access Control
An electronic access control system consists of access cards and card readers wired to electronic strikes on the doors.
Time was, cabling represented a major and often prohibitive access control system cost. Today, IP-enabled cameras connect directly to the data network, dramatically reducing cabling costs.
“Today, an access control system costs about $2,200 per door,” Slotnick says. “You will probably spend about half of that on labor to rekey locks with a key-lock system.”
Should you install an electronic access control system? It’s really not the right question. Controlling access to doors is only one part of larger security system that has a number of components: cameras, alarms, communications technology, patrolling officers, console operators, a security operations center and more.
The first question isn’t whether or not to install electronic access control, it is what do you need to do to protect the campus. What are the risks and vulnerabilities?
Every school, every campus is different. A center city university will face different risks and vulnerabilities than a college in a small suburban town.
All-hazards Risk Assessment
“Answering the question of how to protect a campus requires a professional all-hazards vulnerability and risk assessment,” says Slotnick.
An all-hazards assessment considers natural disasters as well as criminal and terrorist acts. The goal is to figure out what particular disasters might befall your particular campus, the range of consequences that might follow and to develop policies and procedures that will hold injuries and property damage to a minimum and speed recovery.
That said, experts recommend beginning with the threats most likely to occur. In the case of a college or university campus, those threats would likely appear in annual Clery Act reports. The police can help, too, by providing an assessment of the surrounding neighborhoods and what that might mean to campus crime. Talk to the various campus communities: human resources, operations, facilities, administration, faculty, students, grounds keeping and other groups that may contribute to the listing of potential threats.
“Once you have identified problems, you can develop risk treatments for them in the form of a security master plan,” Slotnick says. “The master plan will lay out measures you can take over the next three to five years.
Security master plans follow one upon the other, just like facility master plans. The next plan will note progress made through the preceding plan and set new goals for the next three to five years. “The master plan will probably consider technologies, including electronic access control, video, alarms, as well as security personnel and training for security, as well as the various campus communities — in the form of drills to practice responding.”
The Business of Access Control
Campuses where electronic access control is recommended by an assessment typically develop multiyear plans to cover the buildings noted in the security master plan, adding doors to the system each year.
Electronic access control systems lock and unlock doors just like keys. But the electronic tool goes further than a key-lock system. For instance, an access control system provides an audit trail, a date- and time-stamped list of names of individuals who have opened which doors.
You can set the system to report cards that have attempted unauthorized entries. One attempt often indicates a mistake. Repeated attempts probably bear investigating.
“During an emergency response, I can locate people with cards,” adds Slotnick. “Suppose there is a fire in a residence hall, and students are evacuating the building. You can use a reader to scan cards as the students file out. Then you can compare that list with the list of students that carded into the building but haven’t come out. “At the end of the school year, you can turn off access permissions for students that are leaving.
“You can use the date and time stamp feature time and attendance reporting for hourly employees, a task that may benefit human resources, grounds keeping, custodial, maintenance and other departments on campus.
“You can even set the system to turn off the cards of terminated employees, as well as those that resign, without worrying about getting keys back. Departmental managers will appreciate that. “The cards can also access debit accounts for vending, laundry, food and other campus services.”
By providing business value to other departments, you can make a stronger case for funding an electronic access control system and perhaps earn funding contributions from departments that will benefit.
As noted during the assessment discussion, access control is only one part of an overall system. When the access control system reports an unauthorized entry, a security officer must evaluate the event. That means turning a video camera on the door to see who entered, radioing an officer to investigate.
Without the video camera, the radio and the patrolling officer, you would need to send someone from the security center. That would take too long to do any good if a malicious individual was behind the break in.
While electronic access control can do many things, it can do them better, faster and more securely as a component of a larger security system designed around a number of technologies and a sufficient number of security officers.
NFC: Get Close, Getting Closer
Near-field communications (NFC) is a system of software and network interaction that allows smartphones and similar devices to establish two-way communication for a host of purposes that go well beyond calling or texting someone, accessing the Internet, taking photos/videos or playing games. NFCenabled smartphones can be used like a badge ID to gain access to buildings and other ID card applications.
To turn NFC-enabled smartphones into an access control credential, allowing people to use their smartphones to enter buildings in the same way they present a badge ID, users simply download an app to their smartphones. Then, the user’s access control administrator uses a cloud service to send a secure mobile credential directly to the user’s phone. Once the mobile credential is downloaded, the user opens the app and taps his or her smartphone on the reader in the same way one uses an ID card.
Pilot programs at colleges and universities have shown the value of using smartphones as access control credentials. Students enjoy the convenience of using their phones instead of searching for their key cards. Such convenience is also important to the administrators, but equally important is the security of using their existing contactless credentials, keeping transactions secure. The combination makes for a first-rate experience for both students and staff.
Assigning the credential to the students’ phone takes less work than printing and delivering a badge or card, and since students are very protective of their phones, doing so should lead to a greatly reduced replacement rate. If a phone is lost or broken, a new ID can be reissued to the new phone without having the students even come into the office.
Although the use of NFC access apps is not yet widespread on campus, the interest in it is there and deployment is growing. NFC can also be combined with other, traditional access control systems for added security.
This article originally appeared in the issue of .