Replacing / Switching Access Control Systems Guide

By: Brian Rhodes, Published on Jun 28, 2018

Ripping out and replacing access control systems is hard for important reasons.

Because users typically hold on to access control systems for as long as possible, often decades, switching them can be tricky and prone to mistakes.

However, in this post, we address the important factors driving changes and key issues to handle. These include:

  • The Four Drivers Leading To Change
  • The Complexity of Migrations and Updates
  • Why Changes Are Costly
  • Drop-In Hardware Replacement Is Not Typical
  • Cutover Planning Is Crucial

Sticking **** ***** *******

*** ** *** **** common ******* *** ****** control ******-***** *** ******** is ****** ***** ** no ******** ****** ** change.

**** *** ******** ***** magazine ****** ***** ** an *******:

*** *** **** ****, the **** ******** ** an ****** ******* ****** are ******* ********* **** the **** ** *******. As **** ** ******* unlock *** **** ** required, *** **** ** the ****** *** **** satisfied.

******, ********** **** *** video ************ ******** **** releases ****** **********, *******, and ****** ********** ******* on * ******* *****, the ****** ******* ******** seemingly ****** ************ ***** at * *****'* ****.

*** **** ******** ***********, funding ** ***** *** money ** ****** ***** without *****. **** *** relative ****** ****** *** stable *********** ** **** access ******* *******, ******* is ******** ** **** pressing ***** ** **** to ***** ******* ******.

Limited ****** **** ************

**** **** *** ******** improvements ** '***** **' access *******, **** ** the ******** ***** **** using ************* ************** ** ***-***** manageability. ** **** *****, those ******* *** ** compelling ****** *** ********** ** **** **, but ******** *** ***** is *** ***** ****** to ****** **********'***********' ********* ** ****** based ****** **** *** already **** ***** **** proprietary ******* *** ***** controller ******.

*** *** ****** ** that **** **-***** ******* often ** *** ***** enough ********** *** ********** to ******* ******** *******. The ***** *** *** industry ** *********** '******* the *********' ** ****** control ** ******** [**** no ****** *********], *** existing ****** **********, *****.

** **** *** *** do ****** ****** ******* occur? *** *** **********, these ******* **** **** sources *** ********** ** analog ***** ************ ******* of ***** ****:

Driver #*: **** ** *******/ ****** ******

**** ******* ****** ** a *********** ** *********. Some ************* *** **** with *** ************ ** '*** ** Life' *********, ***** **** ******* will ******* * ****** for ******* *** ****** components *** ******** **** 'backward *************' ** ****, the **** ** * legacy ****** ******* ********* as **** ******. ******* it ** ******* ***** parts ****** ********* ** procure, ** **** ********* support ***** ****** ** more ******* *********, *** users **** ****** ******* or ** ******* ** an ********* ****** ** upgrade.

Driver #*: *** *********

***** ****** ******* ******* predate ***/** ********, *** the *********** **** ** integrate **** ***** ******* systems ** ****** **** remotely ****** **** *******. The *********** ** *********** access *** ********** ******** by ** ******** ********* server *** **** **** an ********** *********** ******** to *** ********* ** IP ***** *******, *** this ******** *** **** much ****** ** *** serialized *** ****-***** ***** of ******** ****** *******.

Driver #*: *** ***** **********

** *** **** ****, the ************* ** ***** surveillance's *********** **** ****** control ****** * ****** combination. ***** ********* ** achieve **** ****** **** systems, ***** *** ** Video ******* '***-**-***' ************ with **** ******* ****** platforms. *** *********** ******* of ******** ******* **** doors ******** *** ******* of **** *******, ******** verification ** ****** *** cardholder *********** * *************** task.

Driver #*: ******* ***********

** * ****** ******, overarching *********** ** *********** force ******. ** ***** of ****** ********* ********-***-* ** *************** **** **** **** ****** ******* With **** $** *** 125kHz **** ******, **** *** ***** find **** *** ******* cannot ******* ****** ********** encoding. ************, ******** ******** factors **** ******* ** acquisition *** ***** ******, as ******* *** **************** between ********* ********* ** almost ********** ** ** non-existent.

Why ******* *** ******

*******, *** ******** ********** to ****** ** *** function, *** ****. *** users ********* ***** **** thousands ** ******* ** control **** ****, ** considering ** ****** ******* escalates ** *****. ** addition ** *** **** cost ** ******** *** labor, ****** ***** ***** creep **:

  • ************ ****** *****: *********** ******* *** ********** of ******* ** **** work ******** ** ******** with ******.  ******* ******* ** video, **************** ******** *** standards **** ***** ******* * *** C ** ********, *** ***** major ********* **** ** replaced ********** ** **** are ******* ** ***.
  • '*** ** *******': *** ****** ** ** interoperability ******* ** ******** even * ***** **** of ****** *********** ******** all ** *** ******. If * **** ********** is ****** ***, **** potentially ******* *** ********* of * ******* *****. If********** ****** ******** ********* readers, ***** ******* **** be ********* ** *** controllers, *** ** **. A *** ****** ********* can ***** ******** ******* to *** ****** ******.
  • **** **********: ** **** *****, any ******* ** ** opening ***** ********** **** existing ******** *********. ********* on *** *** ** an *******, *** ***** of *** **** ** configuration ** ******** **** be ******* ** **** current *****. **** **** employ **** **** ** 'grandfathering' ***** ***-********* ******** can ** ************* **** as-is, ***** ***** ***** force * ******. ** soon ** *********** ******* are *******, ****** ********** changes **** **** ****.

Migration ********** *******

** **** *****, *** process ****** ** ****** access *** ** ******* so **** *** ****** of ******** ****** ************** and ********* *** ** pulled **** *** *** system.

*******, *** ***** ****** to **** **** *** can ** *******, *** often ******* ******* **** systems ************ *** * period ** **** ***** the **** ** ********.

**** ********* ******** *** be ************* *******. *** example,******** *****'* ******* *** upgrading *-**** ***/**** ** C-Cure ************ **** **** **** different *****, ******* ******** utilities, *** ***** **** not ****** ** *** data ***** ********* *** use ** *** *** version.

******, ** *** *-**** example, *** ********* **** every system ******* ** *********, some **** **** ** manually ********* ** ******* manually **** * *** system, ********* * ****** significant **** *** ***** effort *** ********.

**** ****** ******* ***** migration ********* *** **** upgrade ********** ********, *** these ******* *** ********* customized *** ****** ********, with ***** ****** **********.

Drop-In ******** ************ ********

******* ************ **** ** often ********* *** * rewiring **** ******* ****** to * *** ******. In **** *****, * system *** ******* ******** hardware ************ **** ******* versions ** ***** *********** hardware.

***** ******** ******** ** not ********* *********, ******* products ******* ******* ********'* takeover ******* *******-**************** ************.

Cutover ******** ** *******

****** ******** ** ** upgrade ** ********* ** avoid **********. ****** ***** surveillance, ***** ******** ******* result ** ** ******, updating ****** ******* *** mean *** ******** ** entire ***** *** ** jeopardy.

***** * ****** **** may ''*******" ** ** entirely *** ****** ** once, *** ******** ** uncommon *** *****, *****-**** systems. **** ********, *** critical ***** ****** ** consider ***:

************ ** *****:******* *** ****** ** have '***********' **********, ***** activities ***** ** **** due ** ************* ********. Informing ***** ** *** change, *** *** ********** planning **** ******* **** the *********** ** ********** keys, ** ********** ** guards, **** ******* ****** recovery **** * ****** system *******.

********** *********: *** ******** ** users *** *** ******** system **** ** ***** to *** *** ******. While '******** *******' *** be *********, **** ********* do *** ******* **** data *********, ********** *** custom ****** ** *** database.   ** **** *****, generic ********* *** ** a **** *** ** handling ***** ******* ** data.

***** ******** ********** ********* falls ******* *** ***** of **** ******** ********* and **********, ******* ****** be ***** **** ******** the **** ********.

  • ****** **********: ****** ********** *** migration, ****** * ****** for ******** ** ********** occurs.
  • **** **** * ****: ****** ********, *** importation ****** **** ***** from * **** ** the **** ********, *** the ******.
  • ****** ** *** '***** proprietary ******': ********* **** **** the **** ***** ****** helps ***** **********. *********, a **** ******** ****** be ******** **** * .CSV ** ***** ***** ASCII ********* ****.
  • ** *** **** *** Process: **** * ****-******** import ****** *** **** hours ** ********. *** sites **** ********* ** users, *** ******* *** require * *** ** more. ********** ********* ** a *** ** ********** the ******* *** ****** lead ** **********.
  • ********: ***** *** ****, the ******** **** ****** be **** ******* ** confirm ************ *** ********.

*** ******** ****** *** represent ******** ** ***** of ***** ** ********, and *** ****** ** contains *** ******** ********** to **** ********. ******* of *** *****, **** should ** ***** ** perform *** ******* ********* to ************'* ************.

*** ******** ** * Time: ******* ** '******** the ******' *** ******* on * *** ****** at *** *****, * phased ******** ** ***********. In **** ***, ** entire **** ** *****-**** facility ** *** ******** all ** **** ** hiccups ** ************* ** hardware *******. ********** *** cutover ******* ****** *** each ******** ** ** completely '****** **' *** made ***% ********** ****** the ****.

Comments (22)

I love The “security trade magazine” example of 1970’s access control which is actually an image of actor Martin Landau from the fictional space adventure “Space 1999”....using a fictional space tool of some kind. Space 1999

That's a pretty impressive eye you're sporting there.  Even funnier, it was supposed to depict 'future tech' still unchanged 20+ years later!

...and we were supposed to be running around space by 1999...

Hey,  Star Trek said we would have a handheld communication device.

Take-overs give me chills. The most complex one I did involved a 56000 cardholder database from a very proprietary cloud-based access control provider.  The hardware migration was easy.  We had to sign an NDA in order to get the conversion data to make the existing credentials with "embedded numbers not the same as printed numbers" work in the new system.  The spreadsheet we devised had about 26 columns of data, and lots of IFs/THENs.  After everything imported, we still couldn't automate the extraction of their photos from online database so that became somewhat of a manual process.  Adding them to the new system was simpler.  The five bullet points above are spot on - test, test, test!  After all the prep, we did the cutover on a Friday night in about 4 hours with a small army of technicians and engineers.

Most cut-overs fail because the personnel planning and executing the tasks have a severe case of Aphantasia!

Experience is the best teacher, I was done learning years ago.

#comets!

I would think  credential security would/should be a driver. Whatever worked and was safe 10-15 yrs ago is not so safe now. I know nothing is 100% safe but still, Prox cards can be copied from your pocket with a 20$ thing from eBay... this should be unacceptable to some organizations at least. 

Also, for me it seemed like a trend the Drop-in hardware replacements. I saw Amag also had some lineup for Casi replacement - I think UTS asked for this to happen as they discontinued that line without any transition plan. And I think Mercury should be prone to Software Drop-in as it is used by many platforms, some of which are not so alive anymore. VertX too but that is not so old. 

Software House 800 to 9000 upgrades are  an extremely time consuming process. Has any one replaced Software House hardware with the new Mercury replacement boards? I wonder if it would be easier to start over from scatch? 

I've seen how easy it is to flash a Lenel Mercury board and replace it with a different Murcury software platform. Super easy.

On a separate note, For organizations that take security seriously I've gone in there with the 125 kHz copier and have blown them away on how easy it was. Budget money becomes available pretty quickly after that.

Its not just 125 khz prox cards that you need to worry being copied with a $30 cloner , most older smart cards are also easily hacked so you need to make sure you make the right choice.

People also need to realize there is an interesting sniffing tool out there also on ebay for $30 which sniffs and stores the number on the "wiegand cable" and can replay it when a bluetooth command is received from the phone app.

This makes any secure card or biometric totally redundant unless you have secure communications like OSDP.

Yeah maybe the technical changes to some seem subtle , but if you want to be secure for sure its time to change.

Hello Andrew:

Thanks for that comment.  We cover the type of 'Wiegand Skimmer' you mention in our 'Secure Channel' OSDP Access Control Examined note.  From that report:

Almost every access system is vulnerable to the risk of Wiegand copying when skimmers are installed in the reader. The card information they intercept can then be used to create identical copies of valid cards or to inject valid Wiegand signals in systems bypassing readers entirely.

For one example, the BLEKey, installation takes about 60 seconds, can be done from the public/unsecured side of the door, and is undetectable by the system and system managers. The video below shows how these skimmers are typically installed:

Wiegand sniffers are easy and inexpensive to get, with kits typically running ~$35 - $50 online.

Because many of the skimmers are small, they can be installed in readers, hidden from detection, and require nothing more than an app on a cellphone to use.

Yes its a good article.

 

It does amaze me though that a lot of people still choose controllers that only use Wiegand even though most of us now have ODSP controllers.

 

Surely its time for a change?

IP readers are needed along with and OSI layer integration to communicate with a PoE switch or more intelligent access control feature switch needs to be developed.

Example Tamper Rule: The reader has been tampered or has timed out with the switch. The smart switch disables the port data & power. An alert is sent to the access control system. If the alert is not cleared by an operator the port remains disabled. A lesser rule could have the same affect and disable access until an authorized card read clears the alarm. This could be any valid user or a specific user access level.

If a camera is integrated or viewing the card reader rule: Send reader tamper/network loss. Disable access, leave reader power on. Bookmark video. Return to normal once cleared by an operator/or specific card/mobile credential.

Can you think of more rules?

I think OSDP is good for transition upgrades, however I would rather see ethernet at the door. 802.11x plus 256 encryption along with the above integration to a intelligent poe switch should slow them down.

My 10 - 8 cents.

 

Maybe IP is a bit too much ? I mean you need a good technician/engineer to configure everything right and the PoE port on a good switch might cost more than the reader it connects ...

If OSDP becomes 'the norm' and if modern readers use their embedded security features from the HF channel to secure the communication of the wired channel also I think this could be enough. I know HID Seos platform and always thought the future of that is to send the SIO ( encrypted container ) straight to the controller via OSDP and decrypt it there. This way you make like a tunnel from the credential to the controller. 

Amag and other platforms had encrypted bidirectional comms for yrs but they were proprietary. 

Got this from HID the other day. Now you don't even have to be kind of savvy to clone a card. Just walk into CVS or Home Depot and they'll do it for you, and you don't even have to identify yourself or the card you're cloning. Yay...

FYI. This only works on prox though. Not iclass or better.

Yeah , but iclass is really easy to do also.....

Really?  Which iClass formats?

Most, but of course not Seos.

I know iclass can be cloned but every source I've read it is not nearly as easy as prox. Can you share so any resources?

if you look in youtube under "card cloning" you will see a 2 minute video, at least HID have recognised the issue and moved on to SEOS...

Legacy iClass (DP) has been broken for several years, and has been replaced by HID with SEOS.  We covered that dynamic in: Vulnerability Directory For Access Control Cards

If you buy new iClass, you're not buying clonable stuff... yet.  Give it a few more months maybe.  :)

Michael,

 

this one really did make me smile , thanks for this.

 

Maybe more people will start to understand how cloning many (not all) of the cards is so easy.

Read this IPVM report for free.

This article is part of IPVM's 6,533 reports, 880 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now

Related Reports

AHJ / Authority Having Jurisdiction Tutorial on Aug 06, 2020
One of the most powerful yet often underappreciated characters in all...
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
Mobile Access Control Usage Statistics 2020 on Sep 21, 2020
Most smartphones can be used as access control credentials, but how...
Pivot3 Mass Layoffs on Mar 27, 2020
Pivot3 has conducted mass layoffs, the culmination of grand hopes, a quarter...
Dynamic vs Static IP Addresses Tutorial on Apr 16, 2020
While many cameras default to DHCP out of the box, that does not mean you...
Spectron IR Thermal Fever Screening System Examined on Apr 14, 2020
Most are quick to avoid "fever screening" and "medical" labels, but...
Manufacturers Doing Better Than Expected Against Coronavirus on May 05, 2020
Coronavirus impacts are not hitting manufacturers as badly as they feared,...
Free Online NFPA, IBC, and ADA Codes and Standards 2020 on Sep 03, 2020
Finding applicable codes for security work can be a costly task, with printed...
Beware Rigged China Fever Cameras on Sep 08, 2020
Many China fever camera manufacturers have rigged algorithms dynamically...
Door Fundamentals For Access Control Guide on Aug 24, 2020
Doors vary greatly in how difficult and costly it is to add electronic access...
Remote Network Access for Video Surveillance Guide on Jul 27, 2020
Remotely accessing surveillance systems is key in 2020, with more and more...
Forced Door Alarms For Access Control Tutorial on Aug 17, 2020
One of the most important access control alarms is also often ignored....
Coronavirus Hits Manufacturers, Standing Now, Worse To Come on Apr 06, 2020
Coronavirus is hitting security manufacturers, though overall modestly for...
Use Access Control Logs To Constrain Coronavirus on Apr 09, 2020
Access control users have included capabilities that are not commonly used...
The US Fight Over Facial Recognition Explained on Jul 08, 2020
The controversy around facial recognition has grown significantly in 2020,...

Recent Reports

Hikvision Sues Over Brazilian Airport Loss on Sep 24, 2020
Hikvision was excluded from a Brazilian airport project because it is owned...
China General Chamber of Commerce Calls Out US Politics on Sep 24, 2020
While US-China relations at an all-time low, optimism about relations...
Verkada Disruptive Embedded Live Help on Sep 24, 2020
Call up your integrator? Have someone come by the next day? Verkada is...
IP Networking Course Fall 2020 - Last Chance - Register Now on Sep 23, 2020
Today is the last chance to register for the only IP networking course...
Drain Wire For Access Control Reader Tutorial on Sep 23, 2020
An easy-to-miss cabling specification plays a key role in access control, yet...
IPVM Camera Calculator User Manual / Guide on Sep 23, 2020
Learn how to use the IPVM Camera Calculator (updated for Version 3.1). The...
Installation Course Fall 2020 - Save $50 - Last Chance on Sep 22, 2020
Today is your last chance to save $50 on registration for the Fall 2020 Video...
SimpliSafe Business Security Launched Examined on Sep 22, 2020
SimpliSafe has launched "SimpliSafe Business Security" that the company...
FLIR CEO: Many New Fever Entrants "Making Claims That The Science Just Won't Support" on Sep 22, 2020
FLIR's CEO joins a growing number calling out risks with fever / screening...
China Bems Temperature Measurement Terminal Tested on Sep 22, 2020
Guangzhou Bems (brand Benshi) is the manufacturer behind temperature...
Axis Exports To China Police Criticized By Amnesty International on Sep 21, 2020
Axis Communications and other EU surveillance providers are under fire from...
Milestone XProtect on AWS Tested on Sep 21, 2020
Milestone finally launched multiple cloud solutions in 2020, taking a...
Mobile Access Control Usage Statistics 2020 on Sep 21, 2020
Most smartphones can be used as access control credentials, but how...
Axis Compares Fever Camera Sellers to 9/11 on Sep 18, 2020
Axis Communications, the West's largest surveillance camera manufacturer, has...