Replacing / Switching Access Control Systems Guide

By: Brian Rhodes, Published on Jun 28, 2018

Ripping out and replacing access control systems is hard for important reasons.

Because users typically hold on to access control systems for as long as possible, often decades, switching them can be tricky and prone to mistakes.

However, in this post, we address the important factors driving changes and key issues to handle. These include:

  • The Four Drivers Leading To Change
  • The Complexity of Migrations and Updates
  • Why Changes Are Costly
  • Drop-In Hardware Replacement Is Not Typical
  • Cutover Planning Is Crucial

******* *** *** ********* access ******* ******* ** **** for ********* *******.

******* ***** ********* **** on ** ****** ******* systems *** ** **** as ********, ***** *******, ********* them *** ** ****** and ***** ** ********.

*******, ** **** ****, we ******* *** ********* factors ******* ******* *** key ****** ** ******. These *******:

  • *** **** ******* ******* To ******
  • *** ********** ** ********** and *******
  • *** ******* *** ******
  • ****-** ******** *********** ** Not *******
  • ******* ******** ** *******

[***************]

Sticking **** ***** *******

*** ** *** **** common ******* *** ****** control ******-***** *** ******** is ****** ***** ** no ******** ****** ** change.

**** *** ******** ***** magazine ****** ***** ** an *******:

*** *** **** ****, the **** ******** ** an ****** ******* ****** are ******* ********* **** the **** ** *******. As **** ** ******* unlock *** **** ** required, *** **** ** the ****** *** **** satisfied.

******, ********** **** *** video ************ ******** **** releases ****** **********, *******, and ****** ********** ******* on * ******* *****, the ****** ******* ******** seemingly ****** ************ ***** at * *****'* ****.

*** **** ******** ***********, funding ** ***** *** money ** ****** ***** without *****. **** *** relative ****** ****** *** stable *********** ** **** access ******* *******, ******* is ******** ** **** pressing ***** ** **** to ***** ******* ******.

Limited ****** **** ************

**** **** *** ******** improvements ** '***** **' access *******, **** ** the ******** ***** **** using ************* ************** ** ***-***** manageability. ** **** *****, those ******* *** ** compelling ****** *** ********** ** **** **, but ******** *** ***** is *** ***** ****** to ****** **********'***********' ********* ** ****** based ****** **** *** already **** ***** **** proprietary ******* *** ***** controller ******.

*** *** ****** ** that **** **-***** ******* often ** *** ***** enough ********** *** ********** to ******* ******** *******. The ***** *** *** industry ** *********** '******* the *********' ** ****** control ** ******** [**** no ****** *********], *** existing ****** **********, *****.

** **** *** *** do ****** ****** ******* occur? *** *** **********, these ******* **** **** sources *** ********** ** analog ***** ************ ******* of ***** ****:

Driver #*: **** ** *******/ ****** ******

**** ******* ****** ** a *********** ** *********. Some ************* *** **** with *** ************ ** '*** ** Life' *********, ***** **** ******* will ******* * ****** for ******* *** ****** components *** ******** **** 'backward *************' ** ****, the **** ** * legacy ****** ******* ********* as **** ******. ******* it ** ******* ***** parts ****** ********* ** procure, ** **** ********* support ***** ****** ** more ******* *********, *** users **** ****** ******* or ** ******* ** an ********* ****** ** upgrade.

Driver #*: *** *********

***** ****** ******* ******* predate ***/** ********, *** the *********** **** ** integrate **** ***** ******* systems ** ****** **** remotely ****** **** *******. The *********** ** *********** access *** ********** ******** by ** ******** ********* server *** **** **** an ********** *********** ******** to *** ********* ** IP ***** *******, *** this ******** *** **** much ****** ** *** serialized *** ****-***** ***** of ******** ****** *******.

Driver #*: *** ***** **********

** *** **** ****, the ************* ** ***** surveillance's *********** **** ****** control ****** * ****** combination. ***** ********* ** achieve **** ****** **** systems, ***** *** ** Video ******* '***-**-***' ************ with **** ******* ****** platforms. *** *********** ******* of ******** ******* **** doors ******** *** ******* of **** *******, ******** verification ** ****** *** cardholder *********** * *************** task.

Driver #*: ******* ***********

** * ****** ******, overarching *********** ** *********** force ******. ** ***** of ****** ********* ********-***-* ** *************** **** **** **** ****** ******* With **** $** *** 125kHz **** ******, **** *** ***** find **** *** ******* cannot ******* ****** ********** encoding. ************, ******** ******** factors **** ******* ** acquisition *** ***** ******, as ******* *** **************** between ********* ********* ** almost ********** ** ** non-existent.

Why ******* *** ******

*******, *** ******** ********** to ****** ** *** function, *** ****. *** users ********* ***** **** thousands ** ******* ** control **** ****, ** considering ** ****** ******* escalates ** *****. ** addition ** *** **** cost ** ******** *** labor, ****** ***** ***** creep **:

  • ************ ****** *****: *********** ******* *** ********** of ******* ** **** work ******** ** ******** with ******.  ******* ******* ** video, **************** ******** *** standards **** ***** ******* * *** C ** ********, *** ***** major ********* **** ** replaced ********** ** **** are ******* ** ***.
  • '*** ** *******': *** ****** ** ** interoperability ******* ** ******** even * ***** **** of ****** *********** ******** all ** *** ******. If * **** ********** is ****** ***, **** potentially ******* *** ********* of * ******* *****. If * ********** ****** ******** ********* readers, ***** ******* **** be ********* ** *** controllers, *** ** **. A *** ****** ********* can ***** ******** ******* to *** ****** ******.
  • **** **********: ** **** *****, any ******* ** ** opening ***** ********** **** existing ******** *********. ********* on *** *** ** an *******, *** ***** of *** **** ** configuration ** ******** **** be ******* ** **** current *****. **** **** employ **** **** ** 'grandfathering' ***** ***-********* ******** can ** ************* **** as-is, ***** ***** ***** force * ******. ** soon ** *********** ******* are *******, ****** ********** changes **** **** ****.

Migration ********** *******

** **** *****, *** process ****** ** ****** access *** ** ******* so **** *** ****** of ******** ****** ************** and ********* *** ** pulled **** *** *** system.

*******, *** ***** ****** to **** **** *** can ** *******, *** often ******* ******* **** systems ************ *** * period ** **** ***** the **** ** ********.

**** ********* ******** *** be ************* *******. *** example,******** *****'* ******* *** upgrading *-**** ***/**** ** C-Cure ************ **** **** **** different *****, ******* ******** utilities, *** ***** **** not ****** ** *** data ***** ********* *** use ** *** *** version.

******, ** *** *-**** example, *** ********* **** every system ******* ** *********, some **** **** ** manually ********* ** ******* manually **** * *** system, ********* * ****** significant **** *** ***** effort *** ********.

**** ****** ******* ***** migration ********* *** **** upgrade ********** ********, *** these ******* *** ********* customized *** ****** ********, with ***** ****** **********.

Drop-In ******** ************ ********

******* ************ **** ** often ********* *** * rewiring **** ******* ****** to * *** ******. In **** *****, * system *** ******* ******** hardware ************ **** ******* versions ** ***** *********** hardware.

***** ******** ******** ** not ********* *********, ******* products ******* ******* ********'* takeover ******* *******-**************** ************.

Cutover ******** ** *******

****** ******** ** ** upgrade ** ********* ** avoid **********. ****** ***** surveillance, ***** ******** ******* result ** ** ******, updating ****** ******* *** mean *** ******** ** entire ***** *** ** jeopardy.

***** * ****** **** may ''*******" ** ** entirely *** ****** ** once, *** ******** ** uncommon *** *****, *****-**** systems. **** ********, *** critical ***** ****** ** consider ***:

************ ** *****:******* *** ****** ** have '***********' **********, ***** activities ***** ** **** due ** ************* ********. Informing ***** ** *** change, *** *** ********** planning **** ******* **** the *********** ** ********** keys, ** ********** ** guards, **** ******* ****** recovery **** * ****** system *******.

********** *********: *** ******** ** users *** *** ******** system **** ** ***** to *** *** ******. While '******** *******' *** be *********, **** ********* do *** ******* **** data *********, ********** *** custom ****** ** *** database.   ** **** *****, generic ********* *** ** a **** *** ** handling ***** ******* ** data.

***** ******** ********** ********* falls ******* *** ***** of **** ******** ********* and **********, ******* ****** be ***** **** ******** the **** ********.

  • ****** **********: ****** ********** *** migration, ****** * ****** for ******** ** ********** occurs.
  • **** **** * ****: ****** ********, *** importation ****** **** ***** from * **** ** the **** ********, *** the ******.
  • ****** ** *** '***** proprietary ******': ********* **** **** the **** ***** ****** helps ***** **********. *********, a **** ******** ****** be ******** **** * .CSV ** ***** ***** ASCII ********* ****.
  • ** *** **** *** Process: **** * ****-******** import ****** *** **** hours ** ********. *** sites **** ********* ** users, *** ******* *** require * *** ** more. ********** ********* ** a *** ** ********** the ******* *** ****** lead ** **********.
  • ********: ***** *** ****, the ******** **** ****** be **** ******* ** confirm ************ *** ********.

*** ******** ****** *** represent ******** ** ***** of ***** ** ********, and *** ****** ** contains *** ******** ********** to **** ********. ******* of *** *****, **** should ** ***** ** perform *** ******* ********* to ************'* ************.

*** ******** ** * Time: ******* ** '******** the ******' *** ******* on * *** ****** at *** *****, * phased ******** ** ***********. In **** ***, ** entire **** ** *****-**** facility ** *** ******** all ** **** ** hiccups ** ************* ** hardware *******. ********** *** cutover ******* ****** *** each ******** ** ** completely '****** **' *** made ***% ********** ****** the ****.

Comments (22)

Avatar

Chris Helin

06/28/18 05:39pm

I love The “security trade magazine” example of 1970’s access control which is actually an image of actor Martin Landau from the fictional space adventure “Space 1999”....using a fictional space tool of some kind. Space 1999

Avatar

Brian Rhodes

IPVMU Certified | In reply to Chris Helin | 06/28/18 08:54pm

That's a pretty impressive eye you're sporting there.  Even funnier, it was supposed to depict 'future tech' still unchanged 20+ years later!

Avatar

Chris Helin

In reply to Brian Rhodes | 06/28/18 09:30pm

...and we were supposed to be running around space by 1999...

Anthony Jones

In reply to Chris Helin | 07/02/18 11:21pm

Hey,  Star Trek said we would have a handheld communication device.

Avatar

Lynn Harold

06/28/18 07:35pm

Take-overs give me chills. The most complex one I did involved a 56000 cardholder database from a very proprietary cloud-based access control provider.  The hardware migration was easy.  We had to sign an NDA in order to get the conversion data to make the existing credentials with "embedded numbers not the same as printed numbers" work in the new system.  The spreadsheet we devised had about 26 columns of data, and lots of IFs/THENs.  After everything imported, we still couldn't automate the extraction of their photos from online database so that became somewhat of a manual process.  Adding them to the new system was simpler.  The five bullet points above are spot on - test, test, test!  After all the prep, we did the cutover on a Friday night in about 4 hours with a small army of technicians and engineers.

Undisclosed #1

06/28/18 08:20pm

Most cut-overs fail because the personnel planning and executing the tasks have a severe case of Aphantasia!

Experience is the best teacher, I was done learning years ago.

#comets!

Avatar

Vlad Craciunescu

BNT | 06/29/18 09:12am

I would think  credential security would/should be a driver. Whatever worked and was safe 10-15 yrs ago is not so safe now. I know nothing is 100% safe but still, Prox cards can be copied from your pocket with a 20$ thing from eBay... this should be unacceptable to some organizations at least. 

Also, for me it seemed like a trend the Drop-in hardware replacements. I saw Amag also had some lineup for Casi replacement - I think UTS asked for this to happen as they discontinued that line without any transition plan. And I think Mercury should be prone to Software Drop-in as it is used by many platforms, some of which are not so alive anymore. VertX too but that is not so old. 

Avatar

Brian Anderson, CPP®

IPVMU Certified | 06/29/18 02:08pm

Software House 800 to 9000 upgrades are  an extremely time consuming process. Has any one replaced Software House hardware with the new Mercury replacement boards? I wonder if it would be easier to start over from scatch? 

I've seen how easy it is to flash a Lenel Mercury board and replace it with a different Murcury software platform. Super easy.

On a separate note, For organizations that take security seriously I've gone in there with the 125 kHz copier and have blown them away on how easy it was. Budget money becomes available pretty quickly after that.

Andrew Fulton

07/02/18 09:26am

Its not just 125 khz prox cards that you need to worry being copied with a $30 cloner , most older smart cards are also easily hacked so you need to make sure you make the right choice.

People also need to realize there is an interesting sniffing tool out there also on ebay for $30 which sniffs and stores the number on the "wiegand cable" and can replay it when a bluetooth command is received from the phone app.

This makes any secure card or biometric totally redundant unless you have secure communications like OSDP.

Yeah maybe the technical changes to some seem subtle , but if you want to be secure for sure its time to change.

Avatar

Brian Rhodes

IPVMU Certified | In reply to Andrew Fulton | 07/02/18 02:09pm

Hello Andrew:

Thanks for that comment.  We cover the type of 'Wiegand Skimmer' you mention in our 'Secure Channel' OSDP Access Control Examined note.  From that report:

Almost every access system is vulnerable to the risk of Wiegand copying when skimmers are installed in the reader. The card information they intercept can then be used to create identical copies of valid cards or to inject valid Wiegand signals in systems bypassing readers entirely.

For one example, the BLEKey, installation takes about 60 seconds, can be done from the public/unsecured side of the door, and is undetectable by the system and system managers. The video below shows how these skimmers are typically installed:

Wiegand sniffers are easy and inexpensive to get, with kits typically running ~$35 - $50 online.

Because many of the skimmers are small, they can be installed in readers, hidden from detection, and require nothing more than an app on a cellphone to use.

Andrew Fulton

In reply to Brian Rhodes | 07/02/18 03:20pm

Yes its a good article.

 

It does amaze me though that a lot of people still choose controllers that only use Wiegand even though most of us now have ODSP controllers.

 

Surely its time for a change?

Undisclosed #1

In reply to Andrew Fulton | 07/02/18 11:43pm

IP readers are needed along with and OSI layer integration to communicate with a PoE switch or more intelligent access control feature switch needs to be developed.

Example Tamper Rule: The reader has been tampered or has timed out with the switch. The smart switch disables the port data & power. An alert is sent to the access control system. If the alert is not cleared by an operator the port remains disabled. A lesser rule could have the same affect and disable access until an authorized card read clears the alarm. This could be any valid user or a specific user access level.

If a camera is integrated or viewing the card reader rule: Send reader tamper/network loss. Disable access, leave reader power on. Bookmark video. Return to normal once cleared by an operator/or specific card/mobile credential.

Can you think of more rules?

I think OSDP is good for transition upgrades, however I would rather see ethernet at the door. 802.11x plus 256 encryption along with the above integration to a intelligent poe switch should slow them down.

My 10 - 8 cents.

 

Avatar

Vlad Craciunescu

BNT | In reply to Undisclosed #1 | 07/03/18 08:00am

Maybe IP is a bit too much ? I mean you need a good technician/engineer to configure everything right and the PoE port on a good switch might cost more than the reader it connects ...

If OSDP becomes 'the norm' and if modern readers use their embedded security features from the HF channel to secure the communication of the wired channel also I think this could be enough. I know HID Seos platform and always thought the future of that is to send the SIO ( encrypted container ) straight to the controller via OSDP and decrypt it there. This way you make like a tunnel from the credential to the controller. 

Amag and other platforms had encrypted bidirectional comms for yrs but they were proprietary. 

Avatar

Michael Gonzalez

Integrated Security Technologies, Inc.
In reply to Andrew Fulton | 07/04/18 02:43am

Got this from HID the other day. Now you don't even have to be kind of savvy to clone a card. Just walk into CVS or Home Depot and they'll do it for you, and you don't even have to identify yourself or the card you're cloning. Yay...

Avatar

Brian Anderson, CPP®

IPVMU Certified | In reply to Michael Gonzalez | 07/04/18 11:13pm

FYI. This only works on prox though. Not iclass or better.

Andrew Fulton

In reply to Brian Anderson, CPP® | 07/05/18 08:15am

Yeah , but iclass is really easy to do also.....

Avatar

Brian Rhodes

IPVMU Certified | In reply to Andrew Fulton | 07/05/18 11:29pm

Really?  Which iClass formats?

Andrew Fulton

In reply to Brian Rhodes | 07/06/18 05:55am

Most, but of course not Seos.

Avatar

Brian Anderson, CPP®

IPVMU Certified | In reply to Andrew Fulton | 07/06/18 05:13am

I know iclass can be cloned but every source I've read it is not nearly as easy as prox. Can you share so any resources?

Andrew Fulton

In reply to Brian Anderson, CPP® | 07/06/18 05:54am

if you look in youtube under "card cloning" you will see a 2 minute video, at least HID have recognised the issue and moved on to SEOS...

Avatar

Brian Rhodes

IPVMU Certified | In reply to Andrew Fulton | 07/07/18 04:08am

Legacy iClass (DP) has been broken for several years, and has been replaced by HID with SEOS.  We covered that dynamic in: Vulnerability Directory For Access Control Cards. 

If you buy new iClass, you're not buying clonable stuff... yet.  Give it a few more months maybe.  :)

Andrew Fulton

07/04/18 11:22am

Michael,

 

this one really did make me smile , thanks for this.

 

Maybe more people will start to understand how cloning many (not all) of the cards is so easy.

Read this IPVM report for free.

This article is part of IPVM's 6,380 reports, 860 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.

Already a member? Login here | Join now

Related Reports

Help Security End Users Facing Coronavirus Improve Remote Access on Mar 24, 2020
Many end-users and integrators are struggling with the impact of coronavirus lock downs but remote access can help both sides during this...
Pivot3 Mass Layoffs on Mar 27, 2020
Pivot3 has conducted mass layoffs, the culmination of grand hopes, a quarter of a billion dollars in VC funding, and multiple failures to gain...
Converged vs Dedicated Networks For Surveillance Tutorial on Feb 12, 2020
Use the existing network or deploy a new one? This is a critical choice in designing video surveillance systems. Though 'convergence' was a big...
Integrators Hard Hit By Coronavirus on Mar 18, 2020
Integrators are already being hard hit by Coronavirus as brand new IPVM survey results show. Inside this report, we share statistics and dozens...
Vehicle Gate Access Control Guide on Mar 19, 2020
Vehicle gate access control demands integrating various systems to keep unauthorized cars out. Everything from high voltage electrical, to...
The Problem With Fever Detecting Thermal Sunglasses on Apr 15, 2020
While the media has promoted using thermal sunglasses to detect fevers, this approach has fundamental problems and, at best, is health...
Disaster Relief Loans For Integrators Examined on Mar 23, 2020
Integrators are being impacted by the coronavirus. Now, the US government is offering Economic Injury Disaster Loans (EIDL). We researched this,...
Use Access Control Logs To Constrain Coronavirus on Apr 09, 2020
Access control users have included capabilities that are not commonly used that can help zero-in and discover potential Coronavirus hotspots in a...
"Severely Impacted" Mercury Security 2020 Leap Year Firmware Issue on Jan 17, 2020
One of the largest access controller manufacturers has a big problem: February 29th. Mercury Security, owned by HID, is alerting partners of the...
Coronavirus Hits Manufacturers, Standing Now, Worse To Come on Apr 06, 2020
Coronavirus is hitting security manufacturers, though overall modestly for now, with worse expected to come, new IPVM survey results...

Most Recent Industry Reports

Remove Dahua and Hikvision Equipment "Immediately" Or Else Banned From US Government Contracts on Jul 10, 2020
The US government has directed contractors to remove covered equipment, such as Dahua, Hikvision, and Huawei Hisilicon products, "immediately." If...
ZeroEyes Presents Firearm Detection Video Analytics on Jul 09, 2020
ZeroEyes presented its Firearm detection Video Analytics system at the May 2020 IPVM Startups show. A 30-minute video from ZeroEyes...
Directory of 162 "Fever" Camera Suppliers on Jul 09, 2020
This directory provides a list of "Fever" scanning thermal camera providers to help you see and research what options are available. There are...
Clinton Public View Monitor (PVM) Mask Detection Tested on Jul 09, 2020
Face mask detection, or more specifically not wearing one, is expanding amidst the pandemic. Clinton Electronics has added this capability to their...
These Florida Real Estate Agents Are Now Selling "SafeCheck USA" Temperature Detectors on Jul 09, 2020
The "Kakon Brothers", William and Nathan, are self-described "south Florida Power Agents specializing in Luxury Real Estate" who "have closed over...
Avigilon ACC Cloud Tested on Jul 08, 2020
Avigilon merged Blue and ACC, adding VSaaS features to its on-premise VMS, offering remote video and health monitoring that was previously limited...
Hikvision's India Dominance Faces Threat on Jul 08, 2020
While Hikvision has become a dominant video surveillance provider in India, recent tension between the governments of India and the PRC is...
The US Fight Over Facial Recognition Explained on Jul 08, 2020
The controversy around facial recognition has grown significantly in 2020, with Congress members and activists speaking out against it while video...
Sperry West / Alibaba Tablet Temperature Measurement Tested on Jul 07, 2020
In April, we ordered a ~$500 temperature tablet from Alibaba. We set it to the side while doing 18 other temperature screening tests but, after...
Facial Recognition: Weak Sales, Anti Regulation, No Favorite, Says Security Integrators on Jul 07, 2020
While facial recognition has gained greater prominence, a new IPVM study of security systems integrators shows weak sales, opposition to...