Replacing / Switching Access Control Systems Guide

By: Brian Rhodes, Published on Jun 28, 2018

Ripping out and replacing access control systems is hard for important reasons.

Because users typically hold on to access control systems for as long as possible, often decades, switching them can be tricky and prone to mistakes.

However, in this post, we address the important factors driving changes and key issues to handle. These include:

The Four Drivers Leading To Change
The Complexity of Migrations and Updates
Why Changes Are Costly
Drop-In Hardware Replacement Is Not Typical
Cutover Planning Is Crucial

Sticking **** ***** *******

*** ** *** **** common ******* *** ****** control ******-***** *** ******** is ****** ***** ** no ******** ****** ** change.

**** *** ******** ***** magazine ****** ***** ** an *******:

*** *** **** ****, the **** ******** ** an ****** ******* ****** are ******* ********* **** the **** ** *******. As **** ** ******* unlock *** **** ** required, *** **** ** the ****** *** **** satisfied.

******, ********** **** *** video ************ ******** **** releases ****** **********, *******, and ****** ********** ******* on * ******* *****, the ****** ******* ******** seemingly ****** ************ ***** at * *****'* ****.

*** **** ******** ***********, funding ** ***** *** money ** ****** ***** without *****. **** *** relative ****** ****** *** stable *********** ** **** access ******* *******, ******* is ******** ** **** pressing ***** ** **** to ***** ******* ******.

Limited ****** **** ************

**** **** *** ******** improvements ** '***** **' access *******, **** ** the ******** ***** **** using ************* ************** ** ***-***** manageability. ** **** *****, those ******* *** ** compelling ****** *** ********** ** **** **, but ******** *** ***** is *** ***** ****** to ****** **********'***********' ********* ** ****** based ****** **** *** already **** ***** **** proprietary ******* *** ***** controller ******.

*** *** ****** ** that **** **-***** ******* often ** *** ***** enough ********** *** ********** to ******* ******** *******. The ***** *** *** industry ** *********** '******* the *********' ** ****** control ** ******** [**** no ****** *********], *** existing ****** **********, *****.

** **** *** *** do ****** ****** ******* occur? *** *** **********, these ******* **** **** sources *** ********** ** analog ***** ************ ******* of ***** ****:

Driver #*: **** ** *******/ ****** ******

**** ******* ****** ** a *********** ** *********. Some ************* *** **** with *** ************ ** '*** ** Life' *********, ***** **** ******* will ******* * ****** for ******* *** ****** components *** ******** **** 'backward *************' ** ****, the **** ** * legacy ****** ******* ********* as **** ******. ******* it ** ******* ***** parts ****** ********* ** procure, ** **** ********* support ***** ****** ** more ******* *********, *** users **** ****** ******* or ** ******* ** an ********* ****** ** upgrade.

Driver #*: *** *********

***** ****** ******* ******* predate ***/** ********, *** the *********** **** ** integrate **** ***** ******* systems ** ****** **** remotely ****** **** *******. The *********** ** *********** access *** ********** ******** by ** ******** ********* server *** **** **** an ********** *********** ******** to *** ********* ** IP ***** *******, *** this ******** *** **** much ****** ** *** serialized *** ****-***** ***** of ******** ****** *******.

Driver #*: *** ***** **********

** *** **** ****, the ************* ** ***** surveillance's *********** **** ****** control ****** * ****** combination. ***** ********* ** achieve **** ****** **** systems, ***** *** ** Video ******* '***-**-***' ************ with **** ******* ****** platforms. *** *********** ******* of ******** ******* **** doors ******** *** ******* of **** *******, ******** verification ** ****** *** cardholder *********** * *************** task.

Driver #*: ******* ***********

** * ****** ******, overarching *********** ** *********** force ******. ** ***** of ****** ********* ********-***-* ** *************** **** **** **** ****** ******* With **** $** *** 125kHz **** ******, **** *** ***** find **** *** ******* cannot ******* ****** ********** encoding. ************, ******** ******** factors **** ******* ** acquisition *** ***** ******, as ******* *** **************** between ********* ********* ** almost ********** ** ** non-existent.

Why ******* *** ******

*******, *** ******** ********** to ****** ** *** function, *** ****. *** users ********* ***** **** thousands ** ******* ** control **** ****, ** considering ** ****** ******* escalates ** *****. ** addition ** *** **** cost ** ******** *** labor, ****** ***** ***** creep **:

************ ****** *****: *********** ******* *** ********** of ******* ** **** work ******** ** ******** with ******. ******* ******* ** video, **************** ******** *** standards **** ***** ******* * *** C ** ********, *** ***** major ********* **** ** replaced ********** ** **** are ******* ** ***.
'*** ** *******': *** ****** ** ** interoperability ******* ** ******** even * ***** **** of ****** *********** ******** all ** *** ******. If * **** ********** is ****** ***, **** potentially ******* *** ********* of * ******* *****. If * ********** ****** ******** ********* readers, ***** ******* **** be ********* ** *** controllers, *** ** **. A *** ****** ********* can ***** ******** ******* to *** ****** ******.
**** **********: ** **** *****, any ******* ** ** opening ***** ********** **** existing ******** *********. ********* on *** *** ** an *******, *** ***** of *** **** ** configuration ** ******** **** be ******* ** **** current *****. **** **** employ **** **** ** 'grandfathering' ***** ***-********* ******** can ** ************* **** as-is, ***** ***** ***** force * ******. ** soon ** *********** ******* are *******, ****** ********** changes **** **** ****.

Migration ********** *******

** **** *****, *** process ****** ** ****** access *** ** ******* so **** *** ****** of ******** ****** ************** and ********* *** ** pulled **** *** *** system.

*******, *** ***** ****** to **** **** *** can ** *******, *** often ******* ******* **** systems ************ *** * period ** **** ***** the **** ** ********.

**** ********* ******** *** be ************* *******. *** example,******** *****'* ******* *** upgrading *-**** ***/**** ** C-Cure ************ **** **** **** different *****, ******* ******** utilities, *** ***** **** not ****** ** *** data ***** ********* *** use ** *** *** version.

******, ** *** *-**** example, *** ********* **** every system ******* ** *********, some **** **** ** manually ********* ** ******* manually **** * *** system, ********* * ****** significant **** *** ***** effort *** ********.

**** ****** ******* ***** migration ********* *** **** upgrade ********** ********, *** these ******* *** ********* customized *** ****** ********, with ***** ****** **********.

Drop-In ******** ************ ********

******* ************ **** ** often ********* *** * rewiring **** ******* ****** to * *** ******. In **** *****, * system *** ******* ******** hardware ************ **** ******* versions ** ***** *********** hardware.

***** ******** ******** ** not ********* *********, ******* products ******* ******* ********'* takeover ******* *******-**************** ************.

Cutover ******** ** *******

****** ******** ** ** upgrade ** ********* ** avoid **********. ****** ***** surveillance, ***** ******** ******* result ** ** ******, updating ****** ******* *** mean *** ******** ** entire ***** *** ** jeopardy.

***** * ****** **** may ''*******" ** ** entirely *** ****** ** once, *** ******** ** uncommon *** *****, *****-**** systems. **** ********, *** critical ***** ****** ** consider ***:

************ ** *****:******* *** ****** ** have '***********' **********, ***** activities ***** ** **** due ** ************* ********. Informing ***** ** *** change, *** *** ********** planning **** ******* **** the *********** ** ********** keys, ** ********** ** guards, **** ******* ****** recovery **** * ****** system *******.

********** *********: *** ******** ** users *** *** ******** system **** ** ***** to *** *** ******. While '******** *******' *** be *********, **** ********* do *** ******* **** data *********, ********** *** custom ****** ** *** database. ** **** *****, generic ********* *** ** a **** *** ** handling ***** ******* ** data.

***** ******** ********** ********* falls ******* *** ***** of **** ******** ********* and **********, ******* ****** be ***** **** ******** the **** ********.

****** **********: ****** ********** *** migration, ****** * ****** for ******** ** ********** occurs.
**** **** * ****: ****** ********, *** importation ****** **** ***** from * **** ** the **** ********, *** the ******.
****** ** *** '***** proprietary ******': ********* **** **** the **** ***** ****** helps ***** **********. *********, a **** ******** ****** be ******** **** * .CSV ** ***** ***** ASCII ********* ****.
** *** **** *** Process: **** * ****-******** import ****** *** **** hours ** ********. *** sites **** ********* ** users, *** ******* *** require * *** ** more. ********** ********* ** a *** ** ********** the ******* *** ****** lead ** **********.
********: ***** *** ****, the ******** **** ****** be **** ******* ** confirm ************ *** ********.

*** ******** ****** *** represent ******** ** ***** of ***** ** ********, and *** ****** ** contains *** ******** ********** to **** ********. ******* of *** *****, **** should ** ***** ** perform *** ******* ********* to ************'* ************.

*** ******** ** * Time: ******* ** '******** the ******' *** ******* on * *** ****** at *** *****, * phased ******** ** ***********. In **** ***, ** entire **** ** *****-**** facility ** *** ******** all ** **** ** hiccups ** ************* ** hardware *******. ********** *** cutover ******* ****** *** each ******** ** ** completely '****** **' *** made ***% ********** ****** the ****.

Comments (22)

Chris Helin

06/28/18 05:39pm

I love The “security trade magazine” example of 1970’s access control which is actually an image of actor Martin Landau from the fictional space adventure “Space 1999”....using a fictional space tool of some kind.

Brian Rhodes

IPVMU Certified | In reply to Chris Helin | 06/28/18 08:54pm

That's a pretty impressive eye you're sporting there. Even funnier, it was supposed to depict 'future tech' still unchanged 20+ years later!

Chris Helin

In reply to Brian Rhodes | 06/28/18 09:30pm

...and we were supposed to be running around space by 1999...

Anthony Jones

In reply to Chris Helin | 07/02/18 11:21pm

Hey, Star Trek said we would have a handheld communication device.

Lynn Harold

06/28/18 07:35pm

Take-overs give me chills. The most complex one I did involved a 56000 cardholder database from a very proprietary cloud-based access control provider. The hardware migration was easy. We had to sign an NDA in order to get the conversion data to make the existing credentials with "embedded numbers not the same as printed numbers" work in the new system. The spreadsheet we devised had about 26 columns of data, and lots of IFs/THENs. After everything imported, we still couldn't automate the extraction of their photos from online database so that became somewhat of a manual process. Adding them to the new system was simpler. The five bullet points above are spot on - test, test, test! After all the prep, we did the cutover on a Friday night in about 4 hours with a small army of technicians and engineers.

Undisclosed #1

06/28/18 08:20pm

Most cut-overs fail because the personnel planning and executing the tasks have a severe case of Aphantasia!

Experience is the best teacher, I was done learning years ago.

#comets!

Vlad Craciunescu

RST | 06/29/18 09:12am

I would think credential security would/should be a driver. Whatever worked and was safe 10-15 yrs ago is not so safe now. I know nothing is 100% safe but still, Prox cards can be copied from your pocket with a 20$ thing from eBay... this should be unacceptable to some organizations at least.

Also, for me it seemed like a trend the Drop-in hardware replacements. I saw Amag also had some lineup for Casi replacement - I think UTS asked for this to happen as they discontinued that line without any transition plan. And I think Mercury should be prone to Software Drop-in as it is used by many platforms, some of which are not so alive anymore. VertX too but that is not so old.

Brian Anderson, CPP®

IPVMU Certified | 06/29/18 02:08pm

Software House 800 to 9000 upgrades are an extremely time consuming process. Has any one replaced Software House hardware with the new Mercury replacement boards? I wonder if it would be easier to start over from scatch?

I've seen how easy it is to flash a Lenel Mercury board and replace it with a different Murcury software platform. Super easy.

On a separate note, For organizations that take security seriously I've gone in there with the 125 kHz copier and have blown them away on how easy it was. Budget money becomes available pretty quickly after that.

Andrew Fulton

07/02/18 09:26am

Its not just 125 khz prox cards that you need to worry being copied with a $30 cloner , most older smart cards are also easily hacked so you need to make sure you make the right choice.

People also need to realize there is an interesting sniffing tool out there also on ebay for $30 which sniffs and stores the number on the "wiegand cable" and can replay it when a bluetooth command is received from the phone app.

This makes any secure card or biometric totally redundant unless you have secure communications like OSDP.

Yeah maybe the technical changes to some seem subtle , but if you want to be secure for sure its time to change.

Brian Rhodes

IPVMU Certified | In reply to Andrew Fulton | 07/02/18 02:09pm

Hello Andrew:

Thanks for that comment. We cover the type of 'Wiegand Skimmer' you mention in our 'Secure Channel' OSDP Access Control Examined note. From that report:

Almost every access system is vulnerable to the risk of Wiegand copying when skimmers are installed in the reader. The card information they intercept can then be used to create identical copies of valid cards or to inject valid Wiegand signals in systems bypassing readers entirely.

For one example, the BLEKey, installation takes about 60 seconds, can be done from the public/unsecured side of the door, and is undetectable by the system and system managers. The video below shows how these skimmers are typically installed:

Wiegand sniffers are easy and inexpensive to get, with kits typically running ~$35 - $50 online.

Because many of the skimmers are small, they can be installed in readers, hidden from detection, and require nothing more than an app on a cellphone to use.

Andrew Fulton

In reply to Brian Rhodes | 07/02/18 03:20pm

Yes its a good article.

It does amaze me though that a lot of people still choose controllers that only use Wiegand even though most of us now have ODSP controllers.

Surely its time for a change?

Undisclosed #1

In reply to Andrew Fulton | 07/02/18 11:43pm

IP readers are needed along with and OSI layer integration to communicate with a PoE switch or more intelligent access control feature switch needs to be developed.

Example Tamper Rule: The reader has been tampered or has timed out with the switch. The smart switch disables the port data & power. An alert is sent to the access control system. If the alert is not cleared by an operator the port remains disabled. A lesser rule could have the same affect and disable access until an authorized card read clears the alarm. This could be any valid user or a specific user access level.

If a camera is integrated or viewing the card reader rule: Send reader tamper/network loss. Disable access, leave reader power on. Bookmark video. Return to normal once cleared by an operator/or specific card/mobile credential.

Can you think of more rules?

I think OSDP is good for transition upgrades, however I would rather see ethernet at the door. 802.11x plus 256 encryption along with the above integration to a intelligent poe switch should slow them down.

My 10 - 8 cents.

Vlad Craciunescu

RST | In reply to Undisclosed #1 | 07/03/18 08:00am

Maybe IP is a bit too much ? I mean you need a good technician/engineer to configure everything right and the PoE port on a good switch might cost more than the reader it connects ...

If OSDP becomes 'the norm' and if modern readers use their embedded security features from the HF channel to secure the communication of the wired channel also I think this could be enough. I know HID Seos platform and always thought the future of that is to send the SIO ( encrypted container ) straight to the controller via OSDP and decrypt it there. This way you make like a tunnel from the credential to the controller.

Amag and other platforms had encrypted bidirectional comms for yrs but they were proprietary.

Michael Gonzalez

Integrated Security Technologies, Inc.
In reply to Andrew Fulton | 07/04/18 02:43am

Got this from HID the other day. Now you don't even have to be kind of savvy to clone a card. Just walk into CVS or Home Depot and they'll do it for you, and you don't even have to identify yourself or the card you're cloning. Yay...

Brian Anderson, CPP®

IPVMU Certified | In reply to Michael Gonzalez | 07/04/18 11:13pm

FYI. This only works on prox though. Not iclass or better.

Andrew Fulton

In reply to Brian Anderson, CPP® | 07/05/18 08:15am

Yeah , but iclass is really easy to do also.....

Brian Rhodes

IPVMU Certified | In reply to Andrew Fulton | 07/05/18 11:29pm

Really? Which iClass formats?

Andrew Fulton

In reply to Brian Rhodes | 07/06/18 05:55am

Most, but of course not Seos.

Brian Anderson, CPP®

IPVMU Certified | In reply to Andrew Fulton | 07/06/18 05:13am

I know iclass can be cloned but every source I've read it is not nearly as easy as prox. Can you share so any resources?

Andrew Fulton

In reply to Brian Anderson, CPP® | 07/06/18 05:54am

if you look in youtube under "card cloning" you will see a 2 minute video, at least HID have recognised the issue and moved on to SEOS...

Brian Rhodes

IPVMU Certified | In reply to Andrew Fulton | 07/07/18 04:08am

Legacy iClass (DP) has been broken for several years, and has been replaced by HID with SEOS. We covered that dynamic in: Vulnerability Directory For Access Control Cards.

If you buy new iClass, you're not buying clonable stuff... yet. Give it a few more months maybe. :)

Andrew Fulton

07/04/18 11:22am

Michael,

this one really did make me smile , thanks for this.

Maybe more people will start to understand how cloning many (not all) of the cards is so easy.

Read this IPVM report for free.

This article is part of IPVM's 6,533 reports, 880 tests and is only available to members. To get a one-time preview of our work, enter your work email to access the full article.