The 5 Biggest Access Control Mistakes

Author: Brian Rhodes, Published on Mar 11, 2013

Access control systems keep people and places safe, but sometimes have huge weaknesses that leave doors wide open to disaster. What are these nasty, common culprits, and can you avoid them? In this note, we take a look.

Top 5

Few systems are as complex as physical access control. With a myriad of moving pieces and legions of potential users, the opportunity for failure are endless. However, the most common pitfalls are simple to identify, avoid, and correct. The Top 5 offenders include:

  • Single Access Level / Schedule
  • Locking Hardware in Poor Condition
  • No User Database Maintenance
  • Ignored Alarms
  • Door Propping

Below, we examine each failure and describe why it is a huge problem. In most cases, corrective action for each failure is inexpensive and absolutely less costly than undermining a facility's critical access control system.

#1 - Single Access Level / Schedule

Proper access control requires more than just electrified locks and card readers. Good security is reliant on the system configuration, so that it excludes unauthorized users from entering locations they should not and does not allow them entry during non-duty hours.

By default, access control systems are installed with one 'flat' default configuration that allows any card holder access through any opening, at any time. Many end-users incorrectly assess the 'extra' configuration add marginal value and drives inconvenience when restricting cardholder access at the wrong time or wrong door. However, this is a huge misstep, and all it takes is a lost or stolen access credential to undermine the entire system.

Setting the administrative access rights of users not only audits the access every card holder, it establishes the proper value of credentials to the bearer. If one credential has the same functional value as any other in a facility, troubling operational problems like Tailgating and Piggybacking are more common. However, when users truly understand that the credential is tied to their identity, and access is granted as a scope of their job responsibilities, system observance increases.

For a deeper look at the fundamental aspect of Access Control, see our "Access Control Levels and Schedules Tutorial".

Get Video Surveillance News In Your Inbox
Get Video Surveillance News In Your Inbox

#2 - Locking Hardware in Poor Condition

The 'tip of the spear' for any door access control system is the locking hardware and the door. Like every mechanical item, these items need periodic adjustment and maintenance for proper operation. Countless controlled doors fall victim to leafs that do not completely close, latch properly, or have maladjusted gaps that weaken locks or cause binding.

No door security hardware is 'maintenance free', and allowing the considerable investment of electronic access control to be wasted due to lack of care is frustrating. Best practices for operating access control means periodically inspecting, adjusting, and light lubrication and cleaning of items like electric strikes, hinges, closers, exit devices, and mechanical locks.

#3 - No User Database Maintenance

Another item frequently neglected is prompt administration of the user database. Keeping accurate inventory of who carries which card not only promotes good data collection, it also help prevent lost credentials from being improperly used to gain access. Not only does this compound Mistake #1, failing to perform updates on the database makes recovery from it impossible.

If the user database is only updated 'when it slows down a little' or handed out as busy-work, that habit runs the real risk of leaving the cardholder list an unchecked mess. 'Best practices' for access control systems call for responsive management of the user database, ensuring timely responses are possible to control credentials.

Check our "Maintaining Access Control Records" update for a deeper look at this common mistake.

#4 - Ignored Alarms

The total number of alarms even an average-sized access control system can issue is staggering. Door 'hold open' alarms, door 'forced open' alarms, anti-passback alarms, and a host of user-exception alarms are common. The problem is that these alarms are seen as nuisance alarms by many users, even those who employ operators.

Granted, these alarms do not typically represent major security incidents, but they do indicate very important clues about the condition of a system. For example, when a door repeatedly indicates a 'forced-open' alarm, it very seldom means that crooks have pried the door open. However, it may very well indicate a user is using a mechanical key to pass through that door, and is unlogged by the system.

Take a repeated 'hold open' alarm. This frequently indicates that the door is being improperly fixed in an open position or is being prevented from latching, potentially allowing unauthorized individuals into an area. Responding to the alarms is key to proper operation. Simply ignoring these alarms as irritating, minor details can belie bigger vulnerabilities not easily discovered otherwise.

#5 - Door Propping

The final mistake is a common, everyday item: a door stop. When people must repeatedly pass through a closed door, it is viewed as an inconvenience that can be effortlessly solved by propping the door open with a kicked rug, a random stone, or a rubber wedge.

While keeping the door open may increase the convenience of passing through, it prevents the door and lock from accomplishing its main purpose: keeping people out that do not belong.

Many access controlled facilities have adopted a 'No Doorstops Allowed' policy, but even so, enforcement requires vigilance. Since doors can be propped open in very subtle ways - sometimes just enough to keep doors from latching - manned security operations consider 'door checks' a critical part of a safety guard's patrol. In order to maintain access control at all times, an extreme prejudice towards doorstops needs to be taken.

While its not a deep technical issue, door prop is a common hinderance to high-end access control systems. In our "Combating the Door Prop Problem", we focus on the issue.

More on Access Control

IPVM is expanding into access control with dozens of access control articles already including reader favorites on Designing an Access Control System and Test Your Access Control Knowledge.

Comments (4)

Only IPVM PRO Members may comment. Login or Join.

I think "ignored alarms" is one of the biggest detriments to the entire security industry. I can't begin to count the number of times I'm asked how to silence the beeping from a DVR with a failed drive or other critical error condition... or worse, come on site for a service call where they "can't find the video" only to find the thing has BEEN beeping away in a cabinet for weeks and everyone simply ignored it.

It's not even a new problem: I worked in car audio in the early 90s, and even then, we were saying that car alarms were ineffective because people were so used to them falsing, they would be largely ignored. A church across from my grandparents' house in the 80s had an alarm that would go off now and then for no apparent reason, howl away for up to half an hour at times, and there was never any response (that we saw).

Who was it that once said, "Our two greatest problems are ignorance and apathy"?

I don't know, and I don't care.

"Who was it that once said, "Our two greatest problems are ignorance and apathy"?

I don't know, and I don't care."

That's my quote of the month. +1

From end user perspective, we had to learn and install access control ourselves. Facilty is non-profit and we were/are trying to save money where we can. That meant poor installations that required constant maintenance. Poor recording keeping meant more issues as more hands touched to maintain the syste. The mfg would not provide support without yearly contract and up to date license upgrade costs.

This is one area where it is worth investing in professional installation. And this is one area that hasn't gone to DIY (with no experience) route just yet but it must be coming. Just as it did with video security.

Proping the door is an on-going issue. I was at the Temple today and I got my fob key out to get into a door and notices it was proped open.

Proper maintenance on the door hardware is critical. Maintenance programs are often overlooked or dismissed as unneeded. A proper maintenance program can help eliminate the number of nuisance alarms being addressed by security personnel and ensure the investment made in the facilities security remains viable.

Related Reports

Vulnerability Directory For Access Control Cards on Aug 14, 2017
Knowing which access credentials are insecure can be unclear, especially because most look and feel the same. Even the most insecure 125 kHz types...
Competing Against G4S on Aug 09, 2017
G4S Secure Solutions is a global company, operating in multiple countries and offering a suite of products and services from guards to their AMAG...
ONVIF Releases Profile A for Access on Aug 08, 2017
ONVIF has struggled so far in access control. In 2014, ONVIF released Profile C for access control, but in the 3 years since, only 2 companies...
Access Control Commissioning / Install Checklist on Aug 03, 2017
This 80+ point checklist helps end users, integrators and consultants verify that access control installation is complete. It covers the following...
Bosch G-Series Intrusion Tested on Jul 26, 2017
Bosch is one of the biggest names in intrusion, and the company's G-Series panels are their most advanced commercial and high-security panels. But...
Smartcard Copier Tested (13.56MHz) on Jul 05, 2017
Copying 125kHz cards is certainly easy, as our test results showed, but how about 13.56MHz smart cards? Are they more secure? IPVM focused on the...
Biometrics Pros and Cons For Electronic Access Control on Jun 26, 2017
Biometrics has been long sought as an alternative to the security risks of cards, pins and passwords. While biometrics has improved somewhat over...
Access Control Course Winter 2018 on Jun 11, 2017
The Winter 2018 IPVM Access Control Course is now open; save $50 on early registration. IPVM offers the most comprehensive access control course...
RMR Integrator Importance Statistics on Jun 08, 2017
How do integrators feel about offering RMR / recurring revenue services? For many, their business revolves around RMR, while others see no...
HID Edge EVO Tested on Jun 07, 2017
HID Edge controllers have been one of most common offerings in IP door controllers for years. The new generation is called Edge EVO. We tested...

Most Recent Industry Reports

Avigilon CEO Attacks Asian Companies Cyber Insecurity on Aug 18, 2017
Avigilon CEO is taking aim at their Asian competitors. And he is going directly after these company's cyber security issues. In this note, we...
Sony Next Gen HD Dome Camera Tested (SNC-EM642R) on Aug 18, 2017
Sony has released their latest generation, claiming improved WDR and low light, increased IR range, and more. We tested the SNC-EM642R outdoor IR...
IP Networking Course September 2017 on Aug 17, 2017
This is the only networking course designed specifically for video surveillance professionals plus it includes live training, personal help and...
Knightscope Raises $10 Million With $3,320 Average Per Investor on Aug 17, 2017
Congrats to Knightscope. And condolences to their legion of little investors. Knightscope has disclosed they have raised $10+ million from their...
Axis and Arecont Legal Conflict Over Multi-Imager Cameras on Aug 17, 2017
Arecont threatened Axis. Axis has responded by moving to invalidate an Arecont patent. It is an important contest. Multi-imagers are Arecont's...
Directory Of Consumer Security Cameras on Aug 16, 2017
The consumer camera segment continues to grow, with new startups and models from existing players released seemingly every month. In this report we...
Cat 5e vs Cat 6 vs Cat 6a Network Cable Usage Statistics on Aug 16, 2017
Cat 5e? Cat 6? Cat 6a? What do integrators use in practice, today? 140+ integrators told IPVM. Here are the results: For those who want to...
Hikvision Responds To Cracked Security Codes on Aug 15, 2017
Hikvision has responded to IPVM's report on Hikvision's security code being cracked, both with a 2 page update to dealers and communication...
Stolen Video NVR / DVR Statistics on Aug 15, 2017
"But what happens if someone steals my recorder?" Anyone who has done more than a handful of jobs has probably heard this question several times....
Hikvision Europe Cutting Out Unauthorized End User Sales on Aug 15, 2017
The days of anyone buying Hikvision from anywhere off the Internet are numbered, at least in Europe, if Hikvision's plan comes to fruition. In...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact