July 29, 2019
Most of us are familiar with swiping a badge to get access into a secure building, but there is a lot more going on behind the scenes that might surprise you. Access control systems are evolving with the pace of technology to provide both security and convenience, according to Louis Chavez, a principal engineer for Life Safety at UL.
“It could be a smart building with an access control system that automatically turns the lights on for the first employee each morning,” Chavez said, “or, a gatekeeping system typically used for higher security applications. One example is an access control system that integrates with the elevator control to allow only certain, credentialed people to go to pre-assigned floors. Even systems that allow only authorized egress in accordance with parameters set by the authority having jurisdiction fall under access control.”
Booked up but locked out
This increased level of technological interaction, however, can present a risk if cybersecurity isn’t reinforced. Picture this: you’re at a hotel in an exotic and luxurious locale when suddenly hotel guests are locked out of their rooms by hackers holding the access control system for ransom. This situation occurred in 2017 to a hotel in Austria. Hackers gained entry to the hotel’s electronic key system, leaving employees unable to create keys for new guests until the hotel paid nearly $1,900 in bitcoin to get their system operating again.
This is why UL 294, the Standard for Access Control System Units, includes tiered performance-based options to measure the level of protection offered to stand up to imminent threats. Level 4, the highest achievement, requires the products tested to include 256-bit encrypted line security. This extra layer of security, in conjunction with other supporting standards such as UL 2900-2-3, Software Cybersecurity for Network Connectable Products and Particular Requirements for Security and Life Safety Signaling Systems, can provide peace of mind to building owners and managers who want to make sure their systems will perform to the level that matches their risk.
Electronic access control systems are typically used in conjunction with physical security equipment, such as door locks. Take schools, for example. Nearly all schools in the United States have some type of access control system, Chavez said. While school access control systems generally allow free access to the building in the morning, when students are arriving, and early afternoon during dismissal, entrances and exits are usually secured while students are in session. During the secured times, the access control system requires building entrants to use an authorized credential (such as a card or PIN) to gain entry/ access.
In the case of an emergency, access control systems are typically interfaced with fire alarm systems to allow free egress upon activation of a fire alarm and in accordance with the local authority having jurisdiction.
Access control systems can also provide information such as who entered and exited premises through the system logging information.
The building knows
Some access control systems even provide logs of who is in the building at any given time, which can be useful in an emergency. However, an accurate headcount would require everyone to routinely swipe in and out of the building; more advanced systems that used advanced contactless technologies can detect who enters and leaves a building without a swipe by using automated technologies such as facial recognition or wireless devices.
UL 294 tests to different levels of destructive attacks. A Level 4 system is required to withstand an attack test for five minutes and generate an alarm that can’t be silenced for two minutes, in addition to requiring standby power that would allow for four hours of operation.
No matter the facility — whether it’s educational, corporate or retail — access control systems play a critical role in keeping protected premises secure. View our recorded webinar to learn the differences between UL and EN standards for Access Control Systems.