We’re Tracking the Future of Security

Tag: Access Control

  • Access Credential Revocation and Offboarding for Physical Security Systems

    Access Credential Revocation and Offboarding for Physical Security Systems

    Offboarding is complete only when a departing person’s physical and digital access paths have been identified, revoked and verified. A returned badge does not prove that mobile credentials, biometric enrollments, vehicle permissions, visitor-system accounts or remote administration rights have been removed. The process must follow the identity across every connected security system.

    Build an authoritative trigger

    Revocation should begin from a trusted personnel or contract event with an effective time and accountable owner. Human resources, procurement, facilities and security may hold different parts of the record, so the workflow needs one authoritative trigger and a method for urgent terminations. Role changes and extended leave also require review even when the person remains employed.

    The request should identify the person, organization, sponsor, credential types, sites and systems in scope. Avoid using names alone; duplicate names and formatting differences can lead to missed records. Preserve identifiers that allow operators to find the same identity in the access-control system, visitor platform and mobile-credential service.

    Revoke the credential and the entitlement

    Disable active badges and mobile credentials, but also remove the access levels, groups and schedules that granted permission. Otherwise a replacement credential may inherit rights that should have ended. Biometric templates and identity documents should be handled according to retention and legal requirements rather than left indefinitely in an active population.

    Collect physical badges where practical and record those that were not returned. Vehicle tags, keys, tokens and temporary passes need their own disposition. Contractors may have access through a shared employer relationship, so terminating one assignment should not accidentally remove or preserve access for unrelated personnel.

    Verify across integrations and offline devices

    Integrated systems may not update simultaneously. Confirm that revocation reached downstream controllers, wireless locks, elevators, parking systems and third-party services. Offline locks and cached mobile credentials deserve particular attention because a central status change may not take effect until synchronization.

    Test high-risk cases by reviewing the credential status and recent transactions. Do not create a real unauthorized entry attempt unless the procedure is controlled. The verification record should show who performed each action, when it completed and which exceptions remain open.

    Measure timeliness and completeness

    Track the interval from the effective termination time to confirmed revocation. Separate routine delays from urgent failures, and investigate credentials that remain active beyond policy. Periodic reconciliation between personnel records and active access identities can identify orphaned accounts, expired contractors and duplicated credentials.

    Access offboarding is a lifecycle control within Access Control & Identity, not a one-time badge task. Clear ownership, complete inventories and evidence-based closure reduce the window in which former access can be misused.

    Include service identities and scheduled accounts assigned to the departing person. Shared administrative credentials should be rotated through a controlled process when exposure cannot be ruled out, while audit evidence is preserved.

    Reference sources

  • Rutherford Police Unifies Video and Access Control Across Public-Safety Network

    Rutherford Police Unifies Video and Access Control Across Public-Safety Network

    The Rutherford Police Department in New Jersey has consolidated video surveillance, access control and intercom functions within a single Axis Communications environment. The deployment began at the department’s new headquarters and has expanded to public spaces and the Route 3 corridor near New York City and MetLife Stadium.

    From headquarters security to borough coverage

    Axis says partner GTBM designed the headquarters system around AXIS Camera Station Pro, approximately 70 network cameras, door controllers, key-fob readers and network video intercoms. Dispatch personnel can visually verify visitors and release doors remotely, while investigators can review video and access events in the same management environment.

    The department later extended the camera network into parks and other public areas. A pan-tilt-zoom camera on Route 3 uses an ARTPEC-9 processor and AV1 compression. Axis attributes an approximately 20 percent reduction in bandwidth and storage consumption to that deployment; the figure is a manufacturer-reported result for this project, not a universal performance value.

    Operational value depends on workflow

    A unified platform can reduce time spent moving between disconnected systems, but integration alone does not guarantee effective response. Agencies still need role-based permissions, retention rules, audit logging, operator training and procedures for evidentiary export. Public-space deployments also require clear governance and oversight. SectechMedia tracks similar architectures in its video surveillance and imaging coverage.

    Sources

  • Anti-Passback and Occupancy Accounting in Access Control Systems

    Anti-Passback and Occupancy Accounting in Access Control Systems

    Anti-passback is an access-control rule that compares a credential’s expected location with the direction of the next transaction. If the system records that a badge entered a controlled area, a second entry may be rejected until a corresponding exit is recorded. The same state data can support occupancy estimates, but only when the physical and operational design is consistent.

    Hard, soft and timed enforcement

    Hard anti-passback denies a transaction that violates the expected sequence. Soft anti-passback allows access but generates an event for review. Timed anti-passback blocks repeated use for a defined period without requiring a complete entry-and-exit model. Each approach addresses a different risk and produces a different operational burden.

    Hard enforcement can reduce credential sharing, yet it can also lock out legitimate users when the recorded state is wrong. Soft enforcement is less disruptive but depends on monitoring and investigation. Timed rules are useful against rapid badge handoff but do not establish where a person is located.

    Why occupancy counts drift

    An access system counts credential events, not people. Tailgating, propped doors, emergency exits, mechanical-key use and readers that cover only one direction all create gaps. A person may also enter through a turnstile and leave during an evacuation when normal exit reading is bypassed. Contractors and visitors may follow different workflows from employees.

    For these reasons, occupancy should be labeled as an operational estimate unless every route is controlled and exceptions are reconciled. It should not automatically be presented as an emergency roll-call list. Life-safety procedures need independent accountability methods and a clear understanding of who may be missing from the access data.

    Design the state model before enabling the rule

    Define areas, transitions and reset conditions before configuration. The system needs to know which reader represents entry, which represents exit and what happens when a controller or network link is unavailable. Multi-building campuses may require nested areas, while elevators and shared lobbies can complicate direction.

    Reader-to-controller communication should be supervised and protected. Standards such as OSDP can improve channel supervision and interoperability, but the complete design also includes locks, door position, request-to-exit devices and operator procedures.

    Testing and exception handling

    Acceptance testing should cover normal passage, denied re-entry, missed exit, emergency release, controller restart, duplicate credentials and operator reset. Every override should be logged with a reason and an accountable user. Reports should distinguish a true policy violation from a state-reconciliation action.

    Operators also need a defined daily reconciliation process. Repeated corrections at the same door may indicate a reader-direction error, unreliable door hardware or a business process that the configured area model does not represent.

    Successful anti-passback is a coordinated process rather than a checkbox. It works best when the organization combines physical lane control, credential governance and realistic procedures within its broader access-control and identity program. Occupancy data can then support operations without being mistaken for certainty.

    Reference sources

  • Honeywell Modernizes Access Management Across U.S. Marine Corps Barracks

    Honeywell Modernizes Access Management Across U.S. Marine Corps Barracks

    Honeywell Technologies has announced a modernized access-management program for U.S. Marine Corps barracks worldwide. The deployment is intended to replace fragmented mechanical-key and local access processes with connected electronic controls and centralized management.

    The program is designed to give authorized personnel a consistent way to issue, revoke and audit access across geographically distributed facilities. A centralized model can reduce the delay between a change in authorization and enforcement at the door, while producing records that support investigations and compliance reviews.

    Neither the company announcement nor secondary reporting provides a complete public architecture, device count or cybersecurity assessment. Those details matter because a global access platform must protect credentials, administrative privileges, network paths and offline operation as carefully as it protects doors. Local emergency procedures must remain workable during network or power disruption, including reliable override, accountability and recovery controls.

    Why it matters

    Barracks access is an identity-lifecycle problem as much as a lock problem. The program highlights the value of centralized governance while reinforcing the need for resilient local operation, auditable credential changes and disciplined key and credential management.

    Sources

  • Hospital Security Technology: Protecting Patients, Staff and Clinical Operations

    Hospital Security Technology: Protecting Patients, Staff and Clinical Operations

    Hospitals are open environments with a difficult security balance: they must remain accessible to patients and visitors while protecting people, medicine, data, critical equipment and restricted clinical areas.

    A uniquely open security environment

    Unlike many critical facilities, hospitals cannot operate as closed campuses. Emergency departments, outpatient clinics and public entrances create continuous flows of people, making identity, visitor management and staff workflows central to the security design.

    Access and identity

    Modern hospitals commonly combine staff credentials, mobile access, role-based permissions and visitor registration. Sensitive zones such as pharmacies, laboratories, operating rooms, neonatal areas and data rooms require stronger controls and detailed audit trails.

    Video and analytics

    Video systems support investigation, crowd awareness and protection of entrances, parking areas and high-risk corridors. Analytics can help detect unusual movement or congestion, but privacy rules and clinical context require careful policy design.

    Duress and emergency communication

    Staff duress devices, fixed panic buttons and location-aware alerts can shorten response time. Mass notification must reach clinical staff without creating alarm fatigue or interfering with critical care.

    Integration matters

    The most effective hospital security platform connects access events, alarms, video, visitor data and emergency communications. Cybersecurity and privacy governance must be built in because physical-security systems increasingly share the hospital network.

    Conclusion

    Hospital Security Technology should be evaluated as part of a broader operational architecture. The strongest deployments combine suitable sensing technology, resilient communications, clear procedures and measurable performance rather than relying on a single device or headline specification.

  • Data Center Physical Security: A Layered Design Guide

    Data Center Physical Security: A Layered Design Guide

    Data centers are among the most security-sensitive facilities in modern infrastructure. They contain high-value equipment, critical data services and dependencies that support banking, telecom, cloud platforms, government systems and enterprise operations. Physical security must therefore be designed as a layered system.

    Layer 1: Site Boundary

    The outer boundary should discourage casual access and provide early detection. Depending on the site, this may include fencing, vehicle barriers, perimeter cameras, thermal imaging, radar or fiber-optic intrusion detection. The goal is to create enough distance and warning time before a person reaches the building.

    Layer 2: Vehicle and Visitor Control

    Vehicle gates, intercoms, license-plate recognition and visitor-management systems establish accountability before entry. Delivery vehicles and contractors should follow workflows different from permanent staff.

    Layer 3: Building Access

    Access control should use strong credentials, anti-passback logic and role-based permissions. High-security sites may add biometrics, mantraps or multi-factor physical authentication. Credentials should be linked to HR and identity-management processes so access changes when employment status changes.

    Layer 4: White Space and Critical Rooms

    Server halls, network rooms, power systems and storage areas require additional zoning. Not every employee who can enter the building should be able to enter every technical space. Door events should be correlated with video so investigations can reconstruct who entered, when and under which authorization.

    Video and Analytics

    Cameras support verification, investigation and compliance. Coverage should focus on entrances, corridors, cages, loading areas and critical equipment zones. Analytics can help identify tailgating, unusual movement or occupancy patterns, but should supplement rather than replace access-control logic.

    Environmental and Fire Protection

    Physical security also includes resilience. Aspirating smoke detection, thermal monitoring, leak detection, clean-agent suppression and power-system monitoring protect availability from non-criminal threats.

    Cyber-Physical Security

    Security devices themselves are networked computers. Cameras and controllers need firmware management, segmentation, strong credentials and logging. Compromised physical-security devices can create both cyber and physical risk.

    Conclusion

    The strongest data-center design uses multiple independent layers so failure of one control does not expose the asset. Perimeter security, identity, video, environmental monitoring and cybersecurity should all contribute to a single risk-based architecture.

  • Airport Security Architecture: From Perimeter to Terminal

    Airport Security Architecture: From Perimeter to Terminal

    Airports combine public spaces, restricted operational zones, aircraft movement areas, baggage systems, cargo facilities and critical communications infrastructure. Effective airport security therefore depends on layered architecture rather than a single technology.

    The Outer Perimeter

    The first layer protects the airfield boundary. Typical technologies include intelligent fencing, fiber-optic intrusion detection, radar, thermal cameras, fixed video surveillance and controlled vehicle gates. The objective is early detection and rapid verification, not simply creating a physical barrier.

    Airside Access

    Access points between landside and airside areas require strong identity controls. Staff credentials, biometric verification, vehicle authorization and anti-passback rules can reduce unauthorized movement. Temporary contractors and service vehicles deserve particular attention because their access requirements change frequently.

    Terminal Security

    Inside terminals, video surveillance, analytics, access control, screening systems and public-address platforms operate together. The challenge is scale: thousands of cameras and alarms can overwhelm operators unless information is prioritized through a unified command-and-control platform.

    Baggage and Cargo

    Baggage handling and cargo areas have different risk profiles from passenger spaces. Screening equipment, restricted access, chain-of-custody controls and video evidence must be integrated with operational workflows.

    Airspace Awareness

    Small unmanned aircraft have added another security layer. Airports increasingly evaluate radar, RF, optical and acoustic technologies for drone detection. Detection architecture must minimize interference with aviation systems and comply with national regulations.

    Cyber-Physical Integration

    Modern airport security is deeply networked. Cameras, access controllers, screening devices and building systems must therefore be treated as cyber-physical assets. Network segmentation, device hardening, credential management and monitoring are part of physical-security design.

    Conclusion

    A secure airport is not built by purchasing isolated systems. The strongest architecture connects perimeter detection, identity, screening, video, airspace awareness and command-and-control into a layered operational model. The design goal is to detect early, verify quickly and give operators enough context to respond appropriately.