How Does an Access Control System Work?

Essential elements of access control systems

Research shows that over 70% of organizations that implemented access controls experienced no more than five serious physical access incidents per year (download the research report, PDF), indicating that these systems are highly effective when used correctly. While there are various types of access control systems to choose from, most systems share the same core elements:

• A credential. This is the thing that gives authorized personnel access. It can be token-based, such as a key fob, fingerprint, or ID card, or knowledge-based, such as a password or PIN.
• A reader. The reader is the part of the system that scans the credential that determines whether the presented credential permits access.
• The controller. After the reader scans the information, it is sent to the controller, which decides whether to allow access.
• Access point. The access point is the place the user is trying to access, whether it’s a lock, a smartphone, or a door.

How does access control work? Here’s a simple explanation. The user presents a credential to the reader, which sends the information to the controller. The controller determines whether the credential is correct and whether or not the person is granted access.

Types of access control credentials

When choosing an access control system, one of the most crucial decisions is which credential types it will support. Here are some of the options available for these security systems:

Key cards

Key cards are one of the most common credentials for an access control network. Modern key cards, also called proximity cards, use radio frequency identification (RFID) technology, so users only need to hold the proximity card near a reader rather than swipe it. There are also smart cards that use an embedded microchip and offer enhanced encryption, which can be more secure than those that use RFID, as they are more difficult to clone.

Pros:

• Allows for contractless entry
• RFID technology eliminates the need for a magnetic stripe on a swipe card, so these cards are less likely to be damaged or deactivated
• Smart cards can add additional security

Cons:

• Physical cards can easily be lost or stolen, allowing unauthorized access
• Anyone in possession of a key card can use it, even if it does not belong to them

Key fobs

Key fobs work in the same way as key cards for controlling access, but they are smaller and can be more convenient. Rather than having to wear a keycard on a lanyard around your neck or pull it out of your wallet every time you want to use it, a key fob is small and light enough to attach to a keychain, hence the name.

Pros:

• Easier to carry and access than a key card
• Offers contactless access and can be used at multiple entry points

Cons:

• Although smaller and more convenient, key fobs are still a physical credential that can be lost, stolen, or given to someone else to use

Wearables and smartphones

Just as you can use smartwatches and smartphones to pay at a register, you can also use them as credentials in an access control system. These items use either Bluetooth or NFC (near-field communication), which is similar to Bluetooth but mainly used for short-range applications.

Pros:

• No need for a physical key card or fob
• Access can be easily managed using cloud-based technology
• Can also be used with two-factor authentication for increased security

Cons:

• Lost or stolen devices can compromise security
• Devices can malfunction or run out of batteries
• Bluetooth and NFC technology can be insecure if not properly encrypted

Keypads and codes

This credential asks users to enter a code into a keypad to gain entry. Each user can be assigned a unique number, or there can be a single code or PIN for each keypad.

Pros:

• No physical items or credentials to be lost or stolen
• Giving each person an individual PIN can be very secure, as only they know their PIN, and access and use of each PIN can be screened and tracked
• Can be integrated into multi-factor authentication by combining it with another credential

Cons:

• Assigning a single code to be shared among users can open the system to breaches, as the code can be shared with anyone and does not allow for individual tracking
• Individual codes can be forgotten, and resetting them can be a hassle

Biometrics

Biometric access uses physical characteristics, such as iris scans, facial recognition, or fingerprints, to grant access.

Pros:

• Extremely secure, as biometric credentials cannot be shared, lost, or stolen
• Biometrics are generally fast and accurate

Cons:

• Biometric systems can be expensive
• Biometric data cannot be changed if compromised or spoofed
• Personal information of users is stored, which opens up various

Levels of access control

People can use these systems for several reasons, but there are generally three levels to consider when controlling access.

1. Discretionary access control systems

Discretionary access control systems give you control over every entry point individually and the ability to assign a different set of authorized users to each. It gives the owner a lot of control over who is allowed to do what.

This type is commonly used online for file sharing. For example, you may create a document that is viewable only by people you share the link with or by those who have a password to access it. You can take this further, choosing who is allowed to access and read the document versus who is allowed to edit it.

In the real world, a simple illustration of this type of system is giving someone your house key. You choose who to provide a key to and, theoretically, who can enter your home. Another good example, more applicable to a business, is allowing select people to enter a particular hallway or open a specific door.

2. Role-based access control systems

Role-based access control is broad, allowing access to anyone who holds a specific role or position. For example, if you own a medium- to large-sized business with many employees, you may grant warehouse access to forklift operators and truck drivers, while allowing only customer-facing employees to access the back office. You’re not choosing individuals who can access these places; instead, you’re granting access to users who fill a certain role so they can do their jobs.

3. Mandatory access control systems

Mandatory access control is the most restrictive and most secure. This type of access control system is determined by a system-wide policy and is more applicable to data and information than it is to entering physical spaces. This mandatory access control is commonly used in healthcare systems, financial institutions, and government agencies to limit who has access to people’s healthcare, banking, and other private information.

Benefits of access control

The most obvious benefit of an access control system is security. By using an access control system, you can control who goes where and who has access to what. You can also track down the cause of any breaches. For example, if an unauthorized person gains access to an area they aren’t allowed in, you can pinpoint when it happened using data collected from the system. If they used another person’s keycard or other credentials, you can tell that, too.

You can also use these systems to limit access to specific times. For example, you can deny access to everyone after hours to prevent anyone from entering the facility when it’s closed, or deny access to employees when they are not on shift.

There are operational benefits to having an access control system, namely that it can be easily integrated into a wider security strategy. For example, you can place security cameras monitoring doors to sensitive areas, or have an alarm system that triggers when someone enters an incorrect credential one time too many.

How to choose an access control system: Talk to the pros

There are many things to consider when choosing an access control system, including your required level of security, operational needs, and number of users. In some situations, a system that uses a key card or key fob may make more sense than one with biometrics; in others, biometrics or multi-factor authentication may be necessary to protect sensitive data or valuables.

There are other factors to consider, too, such as choosing a system that scales as your business grows or one that integrates with your current security alarms or cameras.

One of the most crucial factors is choosing the right professionals to install and monitor your system. For example, working with an authorized dealer ensures that you get genuine products and access to the manufacturer’s warranties.