Expert Speak
How Access Control Plays a Vital Role in a Safe and Secure Return-to-Work Strategy
Written by Sanjit Bardhan, Vice President – Head of Emerging Markets, Physical Access Control Solutions at HID Global
Employers today face a new challenge: to provide a safe and clean work environment as employees bring with them a new social consciousness centered on public health awareness, social distancing, and hygienic spaces. As employees consider a return to the physical workplace, they must adapt to new requirements, implement new procedures, and leverage technology to alleviate their employees’ concerns.
Access control plays a critical role in creating a safe back-to-work strategy. Organizations can leverage contactless physical access technologies — including mobile credentials along with Bluetooth solutions — as well as implement location services and visitor management tools to provide employees with an experience that supports a healthy and safe work environment.
CHANGED EXPECTATIONS
As organizations move toward reopening their offices, workers bring with them a new awareness of issues around human proximity, environmental and surface cleanliness, and the sharing of publicly accessed resources such as touch screens and keypads. Hygiene isn’t a new concern, but the level of awareness is new, as well as the need to give employees the confidence that their workplace is not only secure but healthy and safe.
Physical access is a prime area of interest.
Crowded entryways, elevators and shared working spaces are a threat to safe social distancing. Credentialing processes that come with high human-to-human contact are also a cause for concern. Those who manage physical access can play a key role in helping to meet these changed expectations.
With health and safety concerns at the forefront, security and facilities personnel have the opportunity to be the heroes of the day. At a time when employee safety is not just an ordinary need, but an extraordinary moral obligation, teams can rise to the fore with proactive solutions that meaningfully impact the quality of life.
Access control management can help route employees, in tandem with efforts to stagger work times. Physical access control systems (PACS) can also leverage location services to support contact tracing and reduce crowding, and these same systems can be used in support of thoughtful visitor management.
While contactless credentials inherently support a touchless “badging in” experience, employers and building managers should implement these technologies as part of a holistic approach to building management. Clear policies, explicit signage, cleanliness protocols — all are part of this big picture.
Those looking to support a safe return to the workplace can look to technology to help minimize the high-touch human interactions that have characterized PACS in the past. By upgrading from legacy systems to more modernized solutions, it is possible to significantly reduce human contact around access control in a way that directly addresses employee concerns.
TOUCHLESS ACCESS CONTROL
Various forms of touchless access control can help to reduce viral spread at human-to-object touchpoints. By reducing contact between humans and the objects related to access control, security could help to minimize potential cross-contamination. Automatic door operators, revolving doors, and sliding doors — all can help to reduce contact at high-volume entry and exit points. These can be coupled with contactless credentials and readers to ensure security while minimizing surface contamination.
Another strategy involves the use of long-range capable readers that leverage Bluetooth Low Energy (BLE) connections to deliver read performance at a distance. With a read range of up to several meters, BLE can further distance employees who might otherwise crowd up around readers and doors. Mobile access likewise reduces the need for employees to physically touch cards and communal readers.
Organizations that rely on keypads or two-factor authentication may find mobile credentials and mobile capable readers to be a more hygienic alternative. The user is required to unlock their phone using a passcode, fingerprint, or facial read in order for the phone to unlock, thus delivering two-factor security without the need to touch a shared keypad.
In the same way, mobile also allows for a biometric layer to be added to the access experience. Businesses can configure the mobile credential to only work when the device is unlocked, thereby requiring the owner to authenticate using their enrolled biometric, whether fingerprint or facial recognition. That mitigates the risk of a lost, stolen, or shared mobile device from being used.
And by leveraging the technology on the mobile device instead of at the door, users are only touching their own device and not a touchpoint that is shared with every other occupant. Touchless credentials, including mobile-based, shouldn’t be limited to opening doors. Organizations also may find that these credentials support more hygienic protocols for logging in to networks, paying for vending, or activating printing. In order to reduce contact at shared surfaces, these technologies need to be implemented in tandem with clear policies and supporting signage.
OVER-THE-AIR CREDENTIALING
Most credentialing processes rely on a high degree of human-to-human interaction: someone in IT or the card office prepares the card, the card may then be passed to HR or the front desk for delivery to the user. And when a card is lost or stolen, the process repeats. Whether it is an employee or a visitor, the credentialing process is typically a high-touch operation.
Over-the-air provisioning minimizes contact for those seeking credentials, and it can have a dramatic impact on the human-to-human contact for the administrator charged with assigning credentials. Fewer visits from those looking to obtain credentials significantly reduce the risk factor for those that normally see a range of personnel on a daily basis.
VISITOR MANAGEMENT
Visitors introduce a new variable to the equation. They must be credentialed upon entry, and their untracked movements can pose a health risk, or at least introduce a dangerous unknown should contact tracing become necessary. Solid policies and advanced technologies can ensure the safe movement of visitors. Visitor management solutions can be used either standalone or in conjunction with an organization’s access control system. Visitors self-register in the lobby and hosts are notified when they arrive.
Driver’s license scanners, barcode scanners, cameras, and printers all help support those front desk processes.
While the primary use case is for visitors, these systems can also be used to issue employees temporary badges for single-day use or to issue replacement badges.
Visitor management solutions are also ideal for a range of high-volume settings, including healthcare, schools, and logistics — all places where physical access control is critical and visitors are frequent. Even more, records from the visitor management system can be used for follow-up tracking of potential contacts in case an employee or visitor receives a positive virus test result.
LOCATION SERVICES
The key to keeping people physically distanced is knowing where they are at any given time. Much how GPS is used in outdoor settings, location services leverage BLE beacons to ping off gateways that in turn can identify the location of individuals in a physical space. An individual’s identity can be based on an ID card which broadcasts continually, creating a virtual map of location relative to the fixed gateways.
Location services give management a means to be proactive rather than reactive in their efforts to promote physical distancing. The same system could make space utilization more efficient. Connected beacons could broadcast room occupancy, for example, letting people know which spaces are free and which are in use. In the same way, this connectivity could serve as an early-warning system.
There’s also significant forensic value in this capability. Should an individual test positive for COVID, the arduous task of contact tracing — identifying people who have an infectious disease and those they’ve come in contact with — is automated. “Rather than relying on a person’s memory, you can trace a person — or anything tagged with a beacon – and build historical data on where that person had been and who else had been there, with graphics and analysis,” said Blokker.
In addition, location services support “mustering” — the ability to call together a select group of employees in an urgent circumstance. Location services can also support monitoring usage of hand sanitizing stations. By embedding a BLE sensor in the soap or sanitizer dispenser, the user’s beacon authenticates and registers the event. With hand hygiene being a key way to prevent the spread of infection, enforcing consistent usage is vital to a healthy workplace.
MAKING THE MOST OF PACS TECHNOLOGIES
For those charged with implementing and overseeing physical access control, these are extraordinarily challenging times. While technology can play a significant role in supporting social distancing and other pandemic-related needs, policies are at the core of any successful return-to-work effort.
It is critical, for example, to have solid audit systems in place. PACS systems generate logs, reports, and archives — invaluable information if put to good use. Building managers can leverage this key data to see who was in the facility and when in order to build a fuller picture of the operational risks.
Artificial Intelligence
How AI is Reinventing Cybersecurity for the Automotive Industry
Written by Alain Penel, VP of Middle East, CIS & Turkey at Fortinet (more…)
Cyber Security
Positive Technologies Study Reveals Successful Cyberattacks Nett 5X Profits
Positive Technologies has released a study on the dark web market, analysing prices for illegal cybersecurity services and products, as well as the costs incurred by cybercriminals to carry out attacks. The most expensive type of malware is ransomware, with a median cost of $7,500. Zero-day exploits are particularly valuable, often being sold for millions of dollars. However, the net profit from a successful cyberattack can be five times the cost of organizing it.
Experts estimate that performing a popular phishing attack involving ransomware costs novice cybercriminals at least $20,000. First, hackers rent dedicated servers, subscribe to VPN services, and acquire other tools to build a secure and anonymous IT infrastructure to manage the attack. Attackers also need to acquire the source code of malicious software or subscribe to ready-to-use malware, as well as tools for infiltrating the victim’s system and evading detection by security measures. Moreover, cybercriminals can consult with seasoned experts, purchase access to targeted infrastructures and company data, and escalate privileges within a compromised system. Products and tools are readily available for purchase on the dark web, catering to beginners. The darknet also offers leaked malware along with detailed instructions, making it easier for novice cybercriminals to carry out attacks.
Malware is one of the primary tools in a hacker’s arsenal, with 53% of malware-related ads focused on sales. In 19% of all posts, infostealers designed to steal data are offered. Crypters and code obfuscation tools, used to help attackers hide malware from security tools, are featured in 17% of cases. Additionally, loaders are mentioned in 16% of ads. The median cost of these types of malware stands at $400, $70, and $500, respectively. The most expensive malware is ransomware: its median cost is $7,500, with some offers reaching up to $320,000. Ransomware is primarily distributed through affiliate programs, known as Ransomware-as-a-Service (RaaS), where participants in an attack typically receive 70–90% of the ransom. To become a partner, a criminal must make a contribution of 0.05 Bitcoin (approximately $5,000) and have a solid reputation on the dark web.
Another popular attack tool is exploits: 69% of exploit-related ads focus on sales, with zero-day vulnerability posts accounting for 32% of them. In 31% of cases, the cost of exploits exceeds $20,000 and can reach several million dollars. Access to corporate networks is relatively inexpensive, with 72% of such ads focused on sales, and 62% of them priced at under a thousand dollars. Among cybercriminal services, hacks are the most popular option, accounting for 49% of reports. For example, the price for compromising a personal email account starts at $100, while the cost for a corporate account begins at $200.
Dmitry Streltsov, Threat Analyst at Positive Technologies, says, “On dark web marketplaces, prices are typically determined in one of two ways: either sellers set a fixed price, or auctions are held. Auctions are often used for exclusive items, such as zero-day exploits. The platforms facilitating these deals also generate revenue, often through their own escrow services, which hold the buyer’s funds temporarily until the product or service is confirmed as delivered. On many platforms, these escrow services are managed by either administrators or trusted users with strong reputations. In return, they earn at least 4% of the transaction amount, with the forums setting the rates.”
Considering the cost of tools and services on the dark web, along with the median ransom amount, cybercriminals can achieve a net profit of $100,000–$130,000 from a successful attack—five times the cost of their preparation. For a company, such an incident can result not only in ransom costs but also in massive financial losses due to disrupted business processes. For example, in 2024, due to a ransomware attack, servers of CDK Global were down for two weeks. The company paid cybercriminals $25 million, while the financial losses of dealers due to system downtime exceeded $600 million.
Expert Speak
What the Bybit Hack Reveals About the Future of Crypto Security
Written by Oded Vanunu, Chief Technologist & Head of Product Vulnerability Research at Check Point (more…)
-
GISEC1 week agoPositive Technologies @ GISEC Global 2025: Demonstrating Cutting-Edge Cyber Threats and AI Defense Strategies
-
Cyber Security1 week agoAxis Communications Sheds Light on Video Surveillance Industry Perspectives on AI
-
GISEC1 week agoVideo: SANS Institute Weighs in on Deepfakes, Model Poisoning and Risk Frameworks at GISEC Global 2025
-
GISEC1 week agoManageEngine @ GISEC Global 2025: AI, Quantum Computing, and Ransomware Form Part of Cybersecurity Outlook for 2025
-
GISEC1 week agoVideo: SentinelOne Speaks Hyperautomation, Purple AI, and the Future of Threat Detection at GISEC Global 2025
-
Africa Focus6 days agoCyberKnight Sets Up South Africa Entity
-
GISEC1 week agoGroup-IB @ GISEC Global 2025: Tackling Evolving Cyber Threats with Localised Intelligence and AI
-
GISEC1 week agoVideo: CyberKnight on Zero Trust, AI, and Saudi Arabia’s Digital Transformation at GISEC Global 2025
