Access Control Records Maintenance Guide

By: Brian Rhodes, Published on Jan 16, 2019

Weeding out old entries, turning off unused credentials, and updating who carries which credentials is as important as to maintaining security as keeping equipment operational.

Failing to do so can be as dangerous as leaving a door wide open. Unfortunately, this often gets overlooked as busy work and sometimes to disastrous consequences. In this note, we examine:

  • Best practices for Cardholder Management
  • How to Maintain Records and System Databases
  • Benefits of Proactive Maintenance
  • Do Not Reuse Credentials

Best practices for Cardholder Management

Steps needed to keep the database trim and current are not difficult but their importance can not be understated:

  • Involve Human Resources: With Electronic Access Control, a formal line of communication between HR and Security must exist. As soon as employment status changes (ie: terminations, relocation, promotions) feedback needs to be channeled to those responsible for access control. Just as IT Departments terminate/change network access or emails, Security must respond accordingly with Access Control changes.
  • Formal Reporting Out: Similar communication initiated by Security groups should notify HR, Department Heads, and perhaps even employees / their direct supervisors when any configuration change to credentials occur. This helps close the loop of communication, but also reaffirms the importance to all why communicating these changes to Security is important.
  • Collect & Invalidate Credentials: Aside from just software configuration changes, write policy to include physically taking possession of credentials during an employee termination or transfer situation. Even if the credential cannot be reissued, ensuring it is properly disposed of will mitigate the potential for misuse.
  • Make Responsive Changes: Finally, do not delay in making configuration changes to the card holder database. Even if seemingly inconsequential (ie: inter-department transfer, shift change, name change) the opportunity to keep records up to date may be lost or create operational issues if delayed. Many times, managers do not consider the impact of employee changes on subsystems like Access Control, acting immediately on changes can reveal operational questions that can be asked before becoming an issue.

Do Not Relegate Upkeep As 'Busy Work'

The most critical management step for access records upkeep is to make it an operational priority, not an afterthought.

As central as this database is to access control, keeping it current is often considered 'paperwork' to be performed by clerks or by staff when less critical work slows down. While the nature of this upkeep is not complex, it is a mistake to consider it 'busy work', as not keeping it up to date can have negative security consequences.

Access Cardholder Maintenance

Get Notified of Video Surveillance Breaking News
Get Notified of Video Surveillance Breaking News

While specific screens vary, all access control systems include a management tool to administer user information, similar to the image below:

During normal operation, this management screen is not often used, and once a credential is provisioned it may not be looked at again. However, knowing the value of the data it contains should not be underestimated.

Automated Database Maintenance Tools

Most databases include a light maintenance application that should be periodically run to 'tidy up' data tables and repair broken elements before causing access failures. For example, the Microsoft SQL Server Agent performs the following tasks:

  1. Reorganize/rebuild scatter index or data tables
  2. Shrink data and log files by removing empty entries
  3. Backup database and transaction log
  4. Perform internal consistency checks

Maintenance applications often also perform Date/Time Syncs between applications and edge controller devices, so that congruity in logging is kept.

Access Database Maintenance Matters

The benefit of keeping records current range from Life/Safety benefits, to keeping IT systems responsive:

  • Quicker Operational Response: Understanding the actual effect of a 'lock down' situation relies on assuming the user database has impacted all potential card holders. For example, when using Access Control for mustering, each identity listed in the database must be accurate. Non-maintained databases will not be useful for that application, simply due to neglect.
  • Better Performance: From a functional standpoint, bloated databases increase the potential of error and time needed to process through them. The inefficiency built into operation from unkempt databases can range between increase 'wait' times to read a card, to undetected corruption/unauthorized duplication of card holder records.
  • Needs Change Over Time: Even if a feature or piece of data is not currently 'used' to identify users or grant access, remember that system use parameters change over time, and once a database is 'ruined' with bad or lost information, it is costly to recover. In many cases, keeping fields accurate and updated can provide a critical, defining key to handling card holder data that may result in a costly manual effort otherwise.

Do Not Reuse Credentials

Not all end users choose to personalize credentials as ID Badges, and as a cost-saving step repeatedly reissue credentials. Once cards are turned in, they are thrown into a drawer until they are again issued. In this situation, turning in a card is not enough, the credential must also be removed from the system.

It is also common to destroy or dispose of the credential at this stage too, to mitigate the risk of illicit use or uncontrolled examples to circulate for 'reverse engineering' in potential duplication.

If user accounts are not kept current, a credential may be handed out with the previous identity. Uncovering these discrepancies can be time-consuming and frustratingly costly.

Another Name for "Key Control"

Keeping this data up to date is another form of managing keys, called 'key control' by many. Auditing which keys are currently in circulation, who carries them, and which doors they can open is a critical part of determining where gaps in security exist. For more details on this, see Key Control For Access Control Tutorial.

In similar fashion, pulling a usage report quarterly or twice yearly to see which cards have been used, and which ones have not, will help identify old credentials that should be turned off or help uncover those who might be using a mechanical key to gain access instead of their authorized credential.

[Note: This guide was originally written in 2013 but substantially revised in 2019.]

Comments (16) : Members only. Login. or Join.

Related Reports

Access Control Course Spring 2020 - Save $50 Last Day on Mar 26, 2020
Register Now - Spring 2020 Access Control Course. Today, March 26th is the last day to save $50. IPVM offers the most comprehensive access...
Vulnerability Directory For Access Credentials on Feb 20, 2020
Knowing which access credentials are insecure can be difficult to see, especially because most look and feel the same. Even insecure 125 kHz...
Hotel Access Control Explained on Dec 23, 2019
Hotel access control does not work like typical commercial access control because doors in hotels are not typically directly connected to a central...
Directory of Access Reader Manufacturers on Nov 27, 2019
Credential Readers are one of the most visible and noticeable parts of access systems, but installers often stick with only the brand they always...
Access Control Mustering Guide on Sep 30, 2019
In emergencies, determining where employees are located can be critical for knowing whether they are in danger. Access systems can be used for...
Access Control Time & Attendance Guide on Sep 24, 2019
Access control systems can do more than lock doors. With little or no extra equipment, they can be used to track labor hours for employees...
Mobile Access Usage Statistics 2019 on Jul 18, 2019
The ability to use mobile phones as access credentials is one of the biggest trends in a market that historically has been slow in adopting new...
Poor OSDP Usage Statistics 2019 on Jul 09, 2019
OSDP certainly offers advantages over decades-old Wiegand (see our OSDP Access Control Guide) but new IPVM statistics show that usage of OSDP, even...
Access Control Job Walk Guide on May 22, 2019
Significant money can be saved and problems avoided with an access control job walk if you know what to look for and what to ask. By inviting...
Startup GateKeeper Aims For Unified Physical / Logical Access Token on Apr 04, 2019
This startup's product claims to 'Kill the Password' you use to keep your computers safe. They have already released their Gatekeeper Halberd...

Most Recent Industry Reports

FLIR New Coronavirus Prioritized Temperature Screening Camera Examined on Apr 03, 2020
FLIR has announced a new series of thermal cameras "prioritized for entities working to mitigate the spread of COVID-19 virus", the A400/A700...
ADI Branch Burglary on Apr 03, 2020
A security systems distributor branch is an odd target for burglary but that happened this week at ADI's Memphis location. Vehicle Smash &...
YCombinator AI Startup Visual One Tested on Apr 02, 2020
Startup Visual One, backed by Silicon Valley's powerful Y Combinator, aims to be "Your 24/7 Watchman" with advanced analytics and object...
Free IPVM Memberships For The Unemployed on Apr 02, 2020
IPVM is giving 3-month free memberships (regular price $99) for the unemployed, no questions asked. To get it, just contact us, your request...
Dahua Faked Coronavirus Camera Marketing on Apr 01, 2020
Dahua has conducted a coronavirus camera global marketing campaign centered around a faked detection. Now, Dahua has expanded this to the USA,...
Video Surveillance Trends 101 on Apr 01, 2020
This report examines major industry factors and how they could impact video surveillance in the next 5 - 10 years. This is part of our Video...
USA's Seek Scan Thermal Temperature System Examined on Apr 01, 2020
This US company, Seek, located down the road from FLIR and founded by former FLIR employees is offering a thermal temperature system for the...
Terrible Convergint Coronavirus Thermal Camera Recommendation on Apr 01, 2020
A week after Convergint disclosed falling revenue, pay and job cuts, Convergint is touting 'extensive research' that is either grossly incompetent...
The IPVM New Products Online Show April 2020 Opens With 40+ Manufacturers on Mar 31, 2020
IPVM is excited to announce the first New Products Online show, with 40+ manufacturers, to be held April 14 to the 16th, free to IPVM members,...