Re: 'The system includes a mobile phone app for users to manually unlocking doors from their phones by way of the controller, not via a reader.
Brivo MobilePass unlocks doors via the controller, not the reader, similar to the method used by Verkada's Pass app, but unlike the 'touchless' reader methods used by HID, Openpath, and Proxy among others.'
Brivo Mobile Pass supports both modes of operation:
Controller-based unlocks over the internet (any reader)
Reader-based unlocks using the phone’s Bluetooth connection (Brivo Readers and ACS100)
When using the Bluetooth connection to the Brivo Reader, the BMP is read, transmitted, and treated in the same way as a physical credential by reader and the panel.
They also clarified pricing for mobile pass, which we will revise in the report.
We are testing the 'Fluid Access' point feature now, although physically touching a reader to trigger an unlock is still a potential COVID/ transmission issue.
Brivo also responded with this objection about the limitations of their app, which we have verified through testing and updated the report:
Brivo Mobile Pass offers multiple ways to unlock doors that do not require the user to go through all of the steps of unlocking the phone, opening the app, finding door, etc.:
Fluid Access -- One of the major, new features of the ACS100 is the ability to tap on the reader and trigger a BMP unlock of the door without removing the phone from your pocket.
Siri Shortcuts -- Existing feature of BMP that allows iOS users to create custom voice commands to unlock their doors
Smart Widget -- Existing feature of BMP that allows users to unlock doors without opening the Brivo Mobile Pass app from either their home screen (Android) or Today View (iOS).
While not 'touchless', we confirmed that a two-finger contact on the reader with a phone in a pocket indeed unlocks the door:
However, two fingers of ~2-second contact touching the reader is needed. Given pandemic concerns, the contactless waving of a badge is safer than touching potentially infected surfaces.
In terms of using Siri commands or Widgets, if a phone is pocketed the microphone may not clearly hear a command, and handling a phone to speak clearly into it is likely as well. Likewise, swiping to activate a Widget will still likely be needed.
The whole touchless/zero interaction idea may seem appealing in this pandemic, but would you really want doors being unlocked just by having someone with a valid credential walking by a door? Imagine how easy that would be to compromise. And besides, unless you are using automatic door openers you are still having to touch the door/handle.
Can you speak to this type of system being able to handle multiple sites, user limitations, response time?
Can IPVM create a document or report that compares the "cloud based" vendors? One that summarizes all the goodies and the costs that your reports contain?
I do not believe the option is there for either, but the company has used BLE beacons in the past, and I'll ask them for feedback.
Can IPVM create a document or report that compares the "cloud based" vendors?
This is a good idea, and while we have just begun an updated look at cloud access systems with Proxy, Openpath, Verkada, we plan on adding more in 2021 and it will culminate in a 'shootout' comparing systems as is typical for us.
Agreed Jason .. the cloud-based access systems are changing every day and some of the features/advantages/shortcomings of each may not be evident until you actually buy one, install and program it, and see what is really different from your usualy systems you offer.
I have found some of the biggest drawbacks to the cloud-based systems are that they don't usually record all the events that an on-premise system (or one that has a web interface but is still on-premise) does:
Example: With a on-premise system, if you are using a complete door setup that includes a door status sensor and a REX device like a motion sensor, you should see the following events in the history log after someone presents a valid credential:
1. Valid Admit, 2. Door open, 3. REX input, 4. Door Closed
From a forensic standpoint of a "real" security/access system, you may not need to review these events very often, but during commissioning and testing, it is very useful and most of us are used to having these events to review not just in real time, but after the fact. Most cloud systems, either in their zeal to reduce network traffic to the cloud or because they are mainly "convenience" access control systems, do not record events 2, 3, and 4. You do see the real time state of the doors and when they change of course, but when you have a door in a scheduled unlocked state, it is useful (and required in my mind) to record every time the door is opened or closed for later review if needed.
2. Reports
Some cloud based systems do not offer as convenient or as granular history searches as on-premise systems. Most on-prem systems allow the choice of door, person, event type, and time/date in any combination. There may not be as many event types offered in a cloud-based system and the 4-way granularity may not be there. It seems cloud-based systems are optimized for database efficiency, which makes sense from a cloud application standpoint, but not from a traditional security database standpoint.
3. PIN Keypads on readers
Many cloud-based systems require the use of their own reader in order to enjoy all the benefits of their Mobile apps and this makes sense. Their readers are designed to use all of the features of their system as far as the BLE/geo fencing features as well as the things like tap or wave in front of the reader with your mobile device still in your pocket .. very cool and well-received features. However, these cool readers often do not come with an embedded PIN keypad option. There are numerous use cases for using a PIN password in the traditional access control situations that these newer systems cannot accomodate without mounting a weigand keypad next to or near the "smart" reader.
4. All this being said, on the plus side are the easy to deploy mobile apps that were designed from the ground up for the mobile credential world as well as the easy integrations with active directory type situations where the IT side of the end user is provisioning most of the security. For most small-to-medium systems though, where these cloud base systems should really shine, the active integrations offered by the cloud-based systems (they're not usually free) are seldon needed or used.
Two cents for now ... going through some of this as we speak.
Something tells me a A bigger problem is simply swapping out one acs1000 with another box registered to another different account. Nothing they have locks that box to that installation.
Thanks for the additional... and absolutely great article btw...
I'm looking at it from a "networking enabled device with Ethernet" and cybersecurity perspective. I will admit I don't what is in place that :locks: the panel to a door at a site, I just see an Ethernet jack that can be swapped out and another device connected to it.
It would be interesting if you did a network trace/dump (e.g. wireshark) analysis on the panel to the network... initial questions are ... is it verified encrypted traffic to the cloud (like TLSv1.2 or greater)... does the cloud app MUTUALLY authenticate (using certs at the TLS level) to the panel itself, what about network scans, backdoors, Denial of Service opportunites. The physical stuff (wires, strikes, tamper switches) is 1/2 the story...the more dangerous stuff is all the logical networking where you cant see & touch.
The fact that you popped the door strike with a battery is straight out of the movies!
Agree
Disagree
Informative
Unhelpful
Funny
Create New Topic
Subscribe to IPVM Research to read the full report.
Why do I need to subscribe?
The IPVM Research Service includes products tests and shootouts plus competitive and financial analysis, helping decision-makers better evaluate purchasing, partnering, developing, and/or competing against companies in physical security.
Comments (11)
Brian Rhodes
Brivo responded to our report with feedback:
They also clarified pricing for mobile pass, which we will revise in the report.
We are testing the 'Fluid Access' point feature now, although physically touching a reader to trigger an unlock is still a potential COVID/ transmission issue.
Create New Topic
Brian Rhodes
Brivo also responded with this objection about the limitations of their app, which we have verified through testing and updated the report:
While not 'touchless', we confirmed that a two-finger contact on the reader with a phone in a pocket indeed unlocks the door:
However, two fingers of ~2-second contact touching the reader is needed. Given pandemic concerns, the contactless waving of a badge is safer than touching potentially infected surfaces.
In terms of using Siri commands or Widgets, if a phone is pocketed the microphone may not clearly hear a command, and handling a phone to speak clearly into it is likely as well. Likewise, swiping to activate a Widget will still likely be needed.
Create New Topic
Jason Neubauer
Does Brivo offer geofencing?
Can you speak to this type of system being able to handle multiple sites, user limitations, response time?
Can IPVM create a document or report that compares the "cloud based" vendors? One that summarizes all the goodies and the costs that your reports contain?
Create New Topic
Undisclosed Integrator #1
Agreed Jason .. the cloud-based access systems are changing every day and some of the features/advantages/shortcomings of each may not be evident until you actually buy one, install and program it, and see what is really different from your usualy systems you offer.
I have found some of the biggest drawbacks to the cloud-based systems are that they don't usually record all the events that an on-premise system (or one that has a web interface but is still on-premise) does:
Example: With a on-premise system, if you are using a complete door setup that includes a door status sensor and a REX device like a motion sensor, you should see the following events in the history log after someone presents a valid credential:
1. Valid Admit, 2. Door open, 3. REX input, 4. Door Closed
From a forensic standpoint of a "real" security/access system, you may not need to review these events very often, but during commissioning and testing, it is very useful and most of us are used to having these events to review not just in real time, but after the fact. Most cloud systems, either in their zeal to reduce network traffic to the cloud or because they are mainly "convenience" access control systems, do not record events 2, 3, and 4. You do see the real time state of the doors and when they change of course, but when you have a door in a scheduled unlocked state, it is useful (and required in my mind) to record every time the door is opened or closed for later review if needed.
2. Reports
Some cloud based systems do not offer as convenient or as granular history searches as on-premise systems. Most on-prem systems allow the choice of door, person, event type, and time/date in any combination. There may not be as many event types offered in a cloud-based system and the 4-way granularity may not be there. It seems cloud-based systems are optimized for database efficiency, which makes sense from a cloud application standpoint, but not from a traditional security database standpoint.
3. PIN Keypads on readers
Many cloud-based systems require the use of their own reader in order to enjoy all the benefits of their Mobile apps and this makes sense. Their readers are designed to use all of the features of their system as far as the BLE/geo fencing features as well as the things like tap or wave in front of the reader with your mobile device still in your pocket .. very cool and well-received features. However, these cool readers often do not come with an embedded PIN keypad option. There are numerous use cases for using a PIN password in the traditional access control situations that these newer systems cannot accomodate without mounting a weigand keypad next to or near the "smart" reader.
4. All this being said, on the plus side are the easy to deploy mobile apps that were designed from the ground up for the mobile credential world as well as the easy integrations with active directory type situations where the IT side of the end user is provisioning most of the security. For most small-to-medium systems though, where these cloud base systems should really shine, the active integrations offered by the cloud-based systems (they're not usually free) are seldon needed or used.
Two cents for now ... going through some of this as we speak.
Create New Topic
Scott Whittle
12/22/20 03:49pm
Something tells me a A bigger problem is simply swapping out one acs1000 with another box registered to another different account. Nothing they have locks that box to that installation.
Create New Topic
Scott Whittle
12/22/20 06:05pm
Thanks for the additional... and absolutely great article btw...
I'm looking at it from a "networking enabled device with Ethernet" and cybersecurity perspective. I will admit I don't what is in place that :locks: the panel to a door at a site, I just see an Ethernet jack that can be swapped out and another device connected to it.
It would be interesting if you did a network trace/dump (e.g. wireshark) analysis on the panel to the network... initial questions are ... is it verified encrypted traffic to the cloud (like TLSv1.2 or greater)... does the cloud app MUTUALLY authenticate (using certs at the TLS level) to the panel itself, what about network scans, backdoors, Denial of Service opportunites. The physical stuff (wires, strikes, tamper switches) is 1/2 the story...the more dangerous stuff is all the logical networking where you cant see & touch.
The fact that you popped the door strike with a battery is straight out of the movies!
Create New Topic