Physical Security: Access Cards
Sign in

Physical Security: Access Cards

Information Security Professiona
Years ago, the only guys who carried swipe cards were the government officials and top-secret scientists who used them to access the underground labs at Area 51. Fast forward a few years and the “mainframe guys” started using them to get into the computer room. Today most every corporate citizen carries one, causing a tremendous inconvenience for visitors who lack this badge of power which grants access to bathroom facilities which lie outside of the secure area. Though many are used for only physical access, others contain chips to enable logical access as well. And a few organizations employ truly smart cards which can be “loaded” with money and used to pay for lunch at the company cafeteria or speed your passage through the subway system. If you want to see truly “smart cards” used to an extreme, travel to Japan, as a colleague does regularly. You will see almost everyone transacting business and navigating security checkpoints by just waving their wallet full of cards in the general direction of the processing device. On a humorous note, she adds, “Although proximity cards in the US frequently stay in back pockets while the person hoists their buttocks up to the reader height, the Japanese people are far too polite to leave their wallets in their back pockets and point their butts at the devices!” You don’t need a crystal ball to predict that more and more of us will be using the latter version in the near future.

At the risk of stating the obvious, having a photograph does not make the card “smart.” Assuming it is not a simple photo ID, the badges that most corporate warriors carry aren’t geniuses by any means, but they are somewhat “smart.” Some have a magnetic stripe, and often are referred to as “swipe cards. Magnetic stripe cards are like most credit and debit cards. The magnetic stripe is encoded with information, which is read when the card is passed through a reader. Generally speaking, there is nothing particularly “smart” about magnetic stripe cards.

Truly and certifiably “smart” cards have an embedded chip which can receive, process, and store information, and they come in two flavors. One familiar example, the American Express Blue Card, has a chip which features contact pads, or a contact area. This type of card must be inserted into a reader, which then enables information on the chip to be accessed. (The AmEx Blue also has that old-fashioned magnetic stripe, which can be read by the Neanderthal devices at standard supermarkets and gas stations.)

A second type of smart card is a proximity card. A proximity card, unlike the previous two, does not need to be inserted into anything. Although some contain a small battery and active electronics, most are passive. A passive card’s correspondent reader transmits an electromagnetic field, which provides enough power to activate the circuitry on the card, allowing information to be exchanged. (A true story: I actually learned that my AmEx Blue also has proximity circuitry when I let my three-year-old “pay for” our purchase, and the card reader beeped and said “Thank you” when he simply tapped it with the card.)

Although proximity devices and radio frequency identification (RFID) tags tend to get a lot of press because of their alleged “interceptability,” many have a range of just a few inches.

start_blog_img