Wireless Security.pdf - PDF Archive

RFID Security 645
building and to enter different rooms within the building. Like most of these
types of systems, the card number is associated with the database containing the
cardholder’s name and the areas they are allowed to access. When the cardholder
passes the card over the reader antenna associated with each door, the system
looks in the database and makes a decision based on the privileges associated with
that card.
Proximity cards are issued when an employee begins a new job, and are collected
when the employee leaves the company. At this particular agency, the personnel
department is responsible for issuing and collecting cards. Therefore, they
implemented a policy that imposes a fine on employees that lose their card.
In one case, an employee lost a card, but did not report it to his superiors because
he did not want to pay a fine. As a relatively low-level employee, reporting the loss
and paying the fine would create a financial hardship.
The proximity card is the least costly part of the RFID-controlled entry system.
However, because of a policy designed to discourage losing the cards, the entire
building security could easily be compromised if someone found that particular
card. The goal of securing physical access to the building was forgotten when the
cost of the card replacement began to drive the policy. The people who wrote the
policy assumed that if an employee lost a card, they would pay the fine.
At another agency, the people using the system issue the cards and control physical
access to the building, taking great effort to password-protect the workstations
that access the database. However, sometimes they forget to physically protect
the control system. The RS-232 serial ports that directly control the system and
the cables to each controlled door are accessible by anyone who wanders into the
room. The room itself is accessible via an unlocked door to a room where visitors
are allowed to roam unescorted.
This particular agency lacks policies regarding installing security equipment, the
areas to secure, and the inability to fully understand the system, which all add up
to a potential failure.
Review your policies and keep focused on the goal. Remember to asked questions
like, “ Are we trying to secure a building, or are we concerned about buying new
cards? ” “ Are we leaving parts of a system vulnerable just because they are out of
sight? ” “ Will people follow or evade this policy? ”
www.newnespress.com