Access Control Records Maintenance Guide

By: Brian Rhodes, Published on Jan 16, 2019

Weeding out old entries, turning off unused credentials, and updating who carries which credentials is as important as to maintaining security as keeping equipment operational.

Failing to do so can be as dangerous as leaving a door wide open. Unfortunately, this often gets overlooked as busy work and sometimes to disastrous consequences. In this note, we examine:

  • Best practices for Cardholder Management
  • How to Maintain Records and System Databases
  • Benefits of Proactive Maintenance
  • Do Not Reuse Credentials

Best practices for Cardholder Management

Steps needed to keep the database trim and current are not difficult but their importance can not be understated:

  • Involve Human Resources: With Electronic Access Control, a formal line of communication between HR and Security must exist. As soon as employment status changes (ie: terminations, relocation, promotions) feedback needs to be channeled to those responsible for access control. Just as IT Departments terminate/change network access or emails, Security must respond accordingly with Access Control changes.
  • Formal Reporting Out: Similar communication initiated by Security groups should notify HR, Department Heads, and perhaps even employees / their direct supervisors when any configuration change to credentials occur. This helps close the loop of communication, but also reaffirms the importance to all why communicating these changes to Security is important.
  • Collect & Invalidate Credentials: Aside from just software configuration changes, write policy to include physically taking possession of credentials during an employee termination or transfer situation. Even if the credential cannot be reissued, ensuring it is properly disposed of will mitigate the potential for misuse.
  • Make Responsive Changes: Finally, do not delay in making configuration changes to the card holder database. Even if seemingly inconsequential (ie: inter-department transfer, shift change, name change) the opportunity to keep records up to date may be lost or create operational issues if delayed. Many times, managers do not consider the impact of employee changes on subsystems like Access Control, acting immediately on changes can reveal operational questions that can be asked before becoming an issue.

Do Not Relegate Upkeep As 'Busy Work'

The most critical management step for access records upkeep is to make it an operational priority, not an afterthought.

As central as this database is to access control, keeping it current is often considered 'paperwork' to be performed by clerks or by staff when less critical work slows down. While the nature of this upkeep is not complex, it is a mistake to consider it 'busy work', as not keeping it up to date can have negative security consequences.

Access Cardholder Maintenance

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

While specific screens vary, all access control systems include a management tool to administer user information, similar to the image below:

During normal operation, this management screen is not often used, and once a credential is provisioned it may not be looked at again. However, knowing the value of the data it contains should not be underestimated.

Automated Database Maintenance Tools

Most databases include a light maintenance application that should be periodically run to 'tidy up' data tables and repair broken elements before causing access failures. For example, the Microsoft SQL Server Agent performs the following tasks:

  1. Reorganize/rebuild scatter index or data tables
  2. Shrink data and log files by removing empty entries
  3. Backup database and transaction log
  4. Perform internal consistency checks

Maintenance applications often also perform Date/Time Syncs between applications and edge controller devices, so that congruity in logging is kept.

Access Database Maintenance Matters

The benefit of keeping records current range from Life/Safety benefits, to keeping IT systems responsive:

  • Quicker Operational Response: Understanding the actual effect of a 'lock down' situation relies on assuming the user database has impacted all potential card holders. For example, when using Access Control for mustering, each identity listed in the database must be accurate. Non-maintained databases will not be useful for that application, simply due to neglect.
  • Better Performance: From a functional standpoint, bloated databases increase the potential of error and time needed to process through them. The inefficiency built into operation from unkempt databases can range between increase 'wait' times to read a card, to undetected corruption/unauthorized duplication of card holder records.
  • Needs Change Over Time: Even if a feature or piece of data is not currently 'used' to identify users or grant access, remember that system use parameters change over time, and once a database is 'ruined' with bad or lost information, it is costly to recover. In many cases, keeping fields accurate and updated can provide a critical, defining key to handling card holder data that may result in a costly manual effort otherwise.

Do Not Reuse Credentials

Not all end users choose to personalize credentials as ID Badges, and as a cost-saving step repeatedly reissue credentials. Once cards are turned in, they are thrown into a drawer until they are again issued. In this situation, turning in a card is not enough, the credential must also be removed from the system.

It is also common to destroy or dispose of the credential at this stage too, to mitigate the risk of illicit use or uncontrolled examples to circulate for 'reverse engineering' in potential duplication.

If user accounts are not kept current, a credential may be handed out with the previous identity. Uncovering these discrepancies can be time-consuming and frustratingly costly.

Another Name for "Key Control"

Keeping this data up to date is another form of managing keys, called 'key control' by many. Auditing which keys are currently in circulation, who carries them, and which doors they can open is a critical part of determining where gaps in security exist. For more details on this, see Key Control For Access Control Tutorial.

In similar fashion, pulling a usage report quarterly or twice yearly to see which cards have been used, and which ones have not, will help identify old credentials that should be turned off or help uncover those who might be using a mechanical key to gain access instead of their authorized credential.

[Note: This guide was originally written in 2013 but substantially revised in 2019.]

Comments (16) : PRO Members only. Login. or Join.

Related Reports

Access Control Course Fall 2019 - Last Chance on Oct 17, 2019
Register Now - Fall 2019 Access Control Course. Thursday, October 17th is the last day to register. IPVM offers the most comprehensive access...
2020 Access Control Book Released on Dec 19, 2019
This is the best, most comprehensive access control book in the world, based on our unprecedented research and testing has been significantly...
Designing Access Control Guide on Jan 30, 2019
Designing an access control solution requires decisions on 8 fundamental questions. This in-depth guide helps you understand the options and...
Access Control Job Walk Guide on May 22, 2019
Significant money can be saved and problems avoided with an access control job walk if you know what to look for and what to ask. By inviting...
OSDP Access Control Guide on Jun 04, 2019
Access control readers and controllers need to communicate. While Wiegand has been the de facto standard for decades, OSDP aims to solve major...
Poor OSDP Usage Statistics 2019 on Jul 09, 2019
OSDP certainly offers advantages over decades-old Wiegand (see our OSDP Access Control Guide) but new IPVM statistics show that usage of OSDP, even...
Biometrics Usage Statistics 2019 on Aug 13, 2019
Biometrics are commonly used in phones, but how frequently are they used for access? 150+ integrators told us how often they use biometrics,...
Access Control Time & Attendance Guide on Sep 24, 2019
Access control systems can do more than lock doors. With little or no extra equipment, they can be used to track labor hours for employees...
Access Control Mustering Guide on Sep 30, 2019
In emergencies, determining where employees are located can be critical for knowing whether they are in danger. Access systems can be used for...
Hotel Access Control Explained on Dec 23, 2019
Hotel access control does not work like typical commercial access control because doors in hotels are not typically directly connected to a central...

Most Recent Industry Reports

Breaking Into A Facility Using Canned Air Tested on Jan 28, 2020
Access control is supposed to make doors more secure, but a $5 can of compressed air may defeat it. With no special training, intruders can...
ROG Security - Cloud AI For Remote Monitoring on Jan 28, 2020
ROG Security is offering cloud-based AI analytics to remote guard companies, by touting having "nothing to install" to "add virtual guards." We...
Brivo Business Profile 2020 on Jan 27, 2020
Brivo has been doing cloud access for more than 20 years. Is the 2020s the decade that cloud access becomes the norm? CEO Steve Van Till recently...
Favorite VMS / NVR Manufacturers 2020 on Jan 27, 2020
In 2018, a new winner emerged and a former top choice declined. Now, there is a new #1, a new top 5 finisher and 2 major VMSes in decline. Our...
"Hikvision Football Arena" Lithuania Causes Controversy on Jan 24, 2020
Controversy has arisen in Lithuania over Hikvision becoming a soccer team's top sponsor and gaining naming rights to their arena, with one local MP...
Axis and Genetec Drop IFSEC 2020 on Jan 23, 2020
Two of the best-known video surveillance manufacturers are dropping IFSEC International 2020, joining Milestone who dropped IFSEC in 2019. The...
Multipoint Door Lock Tutorial on Jan 23, 2020
Despite widespread use, locked doors are notoriously weak at stopping entry, and thousands can be misspent on locks that leave doors quite...
Avigilon Shifts Cloud Strategy - Merges Blue and ACC on Jan 23, 2020
Avigilon is shifting its cloud strategy, phasing out its Blue web-managed surveillance platform as a stand-alone brand and merging it with its ACC...
Verkada Paying $100 For Referrals Just To Demo on Jan 22, 2020
Some companies pay for referrals when the referral becomes a customer. Verkada is taking it to the next level - paying $100 referrals fees simply...
Camera Analytics Shootout 2020 - Avigilon, Axis, Bosch, Dahua, Hanwha, Hikvision, Uniview, Vivotek on Jan 22, 2020
Analytics are hot again, thanks to a slew of AI-powered cameras, but whose analytics really work? And how do these new smart cameras compare to top...