Access Control Records Maintenance Guide

By: Brian Rhodes, Published on Jan 16, 2019

Weeding out old entries, turning off unused credentials, and updating who carries which credentials is as important as to maintaining security as keeping equipment operational.

Failing to do so can be as dangerous as leaving a door wide open. Unfortunately, this often gets overlooked as busy work and sometimes to disastrous consequences. In this note, we examine:

  • Best practices for Cardholder Management
  • How to Maintain Records and System Databases
  • Benefits of Proactive Maintenance
  • Do Not Reuse Credentials

Best practices for Cardholder Management

Steps needed to keep the database trim and current are not difficult but their importance can not be understated:

  • Involve Human Resources: With Electronic Access Control, a formal line of communication between HR and Security must exist. As soon as employment status changes (ie: terminations, relocation, promotions) feedback needs to be channeled to those responsible for access control. Just as IT Departments terminate/change network access or emails, Security must respond accordingly with Access Control changes.
  • Formal Reporting Out: Similar communication initiated by Security groups should notify HR, Department Heads, and perhaps even employees / their direct supervisors when any configuration change to credentials occur. This helps close the loop of communication, but also reaffirms the importance to all why communicating these changes to Security is important.
  • Collect & Invalidate Credentials: Aside from just software configuration changes, write policy to include physically taking possession of credentials during an employee termination or transfer situation. Even if the credential cannot be reissued, ensuring it is properly disposed of will mitigate the potential for misuse.
  • Make Responsive Changes: Finally, do not delay in making configuration changes to the card holder database. Even if seemingly inconsequential (ie: inter-department transfer, shift change, name change) the opportunity to keep records up to date may be lost or create operational issues if delayed. Many times, managers do not consider the impact of employee changes on subsystems like Access Control, acting immediately on changes can reveal operational questions that can be asked before becoming an issue.

Do Not Relegate Upkeep As 'Busy Work'

The most critical management step for access records upkeep is to make it an operational priority, not an afterthought.

As central as this database is to access control, keeping it current is often considered 'paperwork' to be performed by clerks or by staff when less critical work slows down. While the nature of this upkeep is not complex, it is a mistake to consider it 'busy work', as not keeping it up to date can have negative security consequences.

Access Cardholder Maintenance

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

While specific screens vary, all access control systems include a management tool to administer user information, similar to the image below:

During normal operation, this management screen is not often used, and once a credential is provisioned it may not be looked at again. However, knowing the value of the data it contains should not be underestimated.

Automated Database Maintenance Tools

Most databases include a light maintenance application that should be periodically run to 'tidy up' data tables and repair broken elements before causing access failures. For example, the Microsoft SQL Server Agent performs the following tasks:

  1. Reorganize/rebuild scatter index or data tables
  2. Shrink data and log files by removing empty entries
  3. Backup database and transaction log
  4. Perform internal consistency checks

Maintenance applications often also perform Date/Time Syncs between applications and edge controller devices, so that congruity in logging is kept.

Access Database Maintenance Matters

The benefit of keeping records current range from Life/Safety benefits, to keeping IT systems responsive:

  • Quicker Operational Response: Understanding the actual effect of a 'lock down' situation relies on assuming the user database has impacted all potential card holders. For example, when using Access Control for mustering, each identity listed in the database must be accurate. Non-maintained databases will not be useful for that application, simply due to neglect.
  • Better Performance: From a functional standpoint, bloated databases increase the potential of error and time needed to process through them. The inefficiency built into operation from unkempt databases can range between increase 'wait' times to read a card, to undetected corruption/unauthorized duplication of card holder records.
  • Needs Change Over Time: Even if a feature or piece of data is not currently 'used' to identify users or grant access, remember that system use parameters change over time, and once a database is 'ruined' with bad or lost information, it is costly to recover. In many cases, keeping fields accurate and updated can provide a critical, defining key to handling card holder data that may result in a costly manual effort otherwise.

Do Not Reuse Credentials

Not all end users choose to personalize credentials as ID Badges, and as a cost-saving step repeatedly reissue credentials. Once cards are turned in, they are thrown into a drawer until they are again issued. In this situation, turning in a card is not enough, the credential must also be removed from the system.

It is also common to destroy or dispose of the credential at this stage too, to mitigate the risk of illicit use or uncontrolled examples to circulate for 'reverse engineering' in potential duplication.

If user accounts are not kept current, a credential may be handed out with the previous identity. Uncovering these discrepancies can be time-consuming and frustratingly costly.

Another Name for "Key Control"

Keeping this data up to date is another form of managing keys, called 'key control' by many. Auditing which keys are currently in circulation, who carries them, and which doors they can open is a critical part of determining where gaps in security exist. For more details on this, see Key Control For Access Control Tutorial.

In similar fashion, pulling a usage report quarterly or twice yearly to see which cards have been used, and which ones have not, will help identify old credentials that should be turned off or help uncover those who might be using a mechanical key to gain access instead of their authorized credential.

[Note: This guide was originally written in 2013 but substantially revised in 2019.]

Comments (16) : PRO Members only. Login. or Join.

Related Reports

Access Control Door Controllers Guide on Oct 22, 2019
Door controllers are at the center of physical access control systems connecting software, readers, and locks. Despite being buried inside...
Securing Access Control Installations Tutorial on Oct 17, 2019
The physical security of access control components is critical to ensuring that a facility is truly secure. Otherwise, the entire system can be...
Access Control Course Fall 2019 - Last Chance on Oct 17, 2019
Register Now - Fall 2019 Access Control Course. Thursday, October 17th is the last day to register. IPVM offers the most comprehensive access...
IPVM Camera Calculator User Manual / Guide on Oct 16, 2019
Learn how to use the IPVM Camera Calculator (updated for Version 3.1). The guide below includes instructions, images, gifs, and videos...
Pelco CEO Out, New CEO Found on Oct 15, 2019
Just 2 months after Pelco was sold, Pelco's CEO is out, with Pelco bringing in an outside President and searching for a new CEO from the industry,...
Camera Focusing Tutorial on Oct 14, 2019
Camera focus is fundamental to quality imaging. Mistakes can significantly reduce details, making cameras less effective. In this guide, we...
Last Chance - Register Now - October 2019 IP Networking Course on Oct 10, 2019
Last Chance - Register Now - Fall 2019 IP Networking Course. The course starts next week. This is the only networking course designed...
HID Fingerprint Reader Tested on Oct 09, 2019
HID has released their first access reader to use Lumidigm optical sensors, that touts it 'works with anyone, anytime, anywhere'. We bought and...
Camera Cable Whip Guide on Oct 02, 2019
Cable whips are one of integrator's least favorite camera features but seem to be unavoidable, now commonplace on dome, turret, and bullet cameras...
Fail Safe vs. Fail Secure Tutorial on Oct 02, 2019
Few terms carry greater importance in access control than 'fail safe' and 'fail secure'. Access control professionals must know how these...

Most Recent Industry Reports

Resideo Stock Plunges 40%, CFO Ousted on Oct 23, 2019
The horrible year for the ADI / Honeywell Home spinout, Resideo, just got worse, with their stock plunging another 40% today. Not even a year...
Access Control Door Controllers Guide on Oct 22, 2019
Door controllers are at the center of physical access control systems connecting software, readers, and locks. Despite being buried inside...
Alarm.com Acquires OpenEye on Oct 21, 2019
Alarm.com is targeting commercial expansion and now they have a commercial cloud VMS with the acquisition of OpenEye. In this note, based on...
Government-Owned Hikvision Wants To Keep Politics Out Of Security on Oct 21, 2019
'Politics' made Hikvision the goliath it is today. It was PRC China 'politics' that created Hikvision, funded it, and blocked its foreign...
Integrated IR Camera Usage Statistics 2019 on Oct 21, 2019
Virtually every IP camera now comes with integrated IR but how many actually make use of IR or choose 'super' low light cameras without IR? In...
Alarm Veteran "Demands A Criminal Investigation" Of UL on Oct 18, 2019
The Interceptor's Project pressure against UL continues to rise. Following Keith Jentoft's allegation that "UL Has Blood On Their Hands", Jentoft...
Camect "Worlds Smartest Camera Hub" Tested on Oct 18, 2019
Camect is a Silicon Valley startup that claims the "Smartest AI Object Detection On The Market", detecting not only people and vehicles, but...
Hikvision Global News Reports Directory on Oct 17, 2019
Hikvision has received the most global news reporting of any video surveillance company, ever, ranging from the WSJ, the Financial Times, Reuters,...
Camera Calculator V3.1 Release Improves User Experience on Oct 17, 2019
IPVM has released a new version of our Camera Calculator, V3.1, with significant user experience improvements, a new development plan, and an...