By Billy Hurley
• 5 min read
Why a simple badge reader is complicated for IT
And that means potentially working with HR, integrators, security, and more.
Francis Scialabba
And that means potentially working with HR, integrators, security, and more.
Francis Scialabba
The humble badge reader is only a simple device on the surface. But because it exists at the intersection of HR, cybersecurity, and IT, things can get complicated fast.
The reader’s hardware is probably the simplest part of the equation. When a credential such as a keycard is processed, credential data is transmitted to a door controller that grants or denies access. The reader can also integrate with physical infrastructure like cameras and intrusion alarms.
Beyond the hardware, management software configured by security admins monitors activity and enforces policies. And that’s when the simple question of, “Who’s in charge of the badge reader?” starts to get a little messier. Cybersecurity teams need oversight of the network and data connecting to the reader; HR also has a say in who’s granted access; and IT must manage everything software- and hardware-related.
Unlocked. Hans Study, now an independent network and security consultant, once found himself troubleshooting door technology at a Canadian Crown corporation building—quite literally taking the badge reader apart in the hopes of understanding it.
“I learned that the ecosystem behind access control was much larger than just the reader,” he said. Tech support involved the door itself, as well as its magnets and nearby motion sensors. Study found that a small mistake like a loose wire can affect locks across a whole facility.
In this early role, he said, physical security had no clear departmental owner, so badge readers went to IT because they were connected to the network.
“It kind of fell on IT because it was plugged in,” he told us.
Come together. Nicholas Fryer knows badge readers. As a penetration tester and principal security consultant on the threat and attack simulation team at consultancy GuidePoint Security, he breaks into them.
While he has plenty of security tips to offer team implementing access control—put a unique marker on the back of a badge, for example, since those are harder for a spy to observe and copy—he also recommends management strategies, including an early meeting with IT, the building’s facilities team, cybersecurity, HR, and front-desk staff to agree on responsibilities and how incidents will be handled.
Fryer said IT should be the point people in this endeavor, with facilities and security supporting the process of defining repeatable response procedures for incidents—say, intrusions or a badge reader that has disconnected.
Expect potential pushback from the facilities team, Fryer warned. Nonetheless, IT should take the lead: “They’re the only ones that might understand the technology enough to fear what could happen if the technology fails.”
HR and IT. Kevin Chen, founder of physical security engineering firm Connextivity, recommends HR, IT, and security align on who will add and remove users and credentials.
It’s also possible for IT teams to automate at least a portion of those additions and removals. Study says teams should connect the badge system to the HR hiring and termination process so access changes with employment status, instead of whenever someone remembers to email the facilities team. Activation and deactivation can be documented as part of the onboarding and off-boarding processes, in a manner that can be timestamped and tracked via an IT ticket or an email between HR and IT.
Integration questions. Contracts for security-system installations often lack specific network-hardware requirements, Study wrote in an email before a call with IT Brew, which can lead to an IT pro potentially facing unmanaged off-brand switches, mid-grade hardware with limited configuration options, “or an integrator who won’t give IT access because it would void their warranty.”
Write the network requirements into the contract, he advised, including managed switches that IT can reach, assurance of an isolated segment of a network (known as a virtual local area network, or VLAN) for readers and controllers, named admin accounts instead of shared ones, and vendor remote access that runs through IT’s controls and expires.
Most badge readers wire back to a door controller, which sits on a network and reports to or acts as a server. With cloud-based systems, the controllers connect to the manufacturer’s cloud. Controllers and readers often need specific ports and protocols to reach the access control server, which potentially impacts firewall configurations; a vendor asking to open a port is asking IT to make an exception, Chen warned. Chen highlighted in an email to IT Brew the following vendor red flags:
A security integrator may set up systems that are treated more as a facilities or physical-security installation than an information technology system. That means IT pros like Study have to be willing to take on the challenge—and maybe even literally break down the hardware.
“Most of the time, I hate to say it, IT isn’t talked to about any of this stuff,” Study said.
