Are Key Card Systems Good Enough For Physical Access Control?

A few months ago, Brivo finished a survey that asked facility managers across the US a variety of questions about how they secure their facilities are, how confident they are in their security program, and what their maintenance plans might be. In my first blog, I talked about how 40% of facility managers still use lock and a key card system to protect their facilities.

This time around I want to talk about those 60% that are a little bit further ahead in the physical security evolution and at least use “an” electronic access control system.

In total, I have frequented over 12 different gyms over the last 20 years. I’m the type of guy who goes to the gym to be left alone. I put on my shirt, shorts and shoes, plug in my headphones and don’t say a word to anybody. It’s Kevin time. I am not there to socialize or to be seen. I tend to join gyms that have multiple facilities within quick walking or driving distance, so that I can avoid the crowds. I figure out which location is the best one to go to at which hour. I also pick the gym of the day based on the best equipment for whatever my routine of that day might be. I want to have an awesome workout. I want to feel “Sze pump!” like the Governator in “Pumping Iron.”

Here’s what I find fascinating. With the exception of one gym, they all handed me either a barcode fob, or a standard fob, or a standard access key card. None of which had a picture on them, and all worked for multiple locations in the Washington, DC, area. That’s a lot of trust you are putting in your members, folks! I had multiple friends ask me if they could borrow my fob to get into the gym when I wasn’t using it. I’m an honest man, so I politely declined. But who knows how often members share ID’s. Now to gym facility managers, how can you be sure that the right people, your true paying members, are using your gym? If a member is impolite to other members, and you cancel his/her membership, how do you make sure he/she doesn’t come back in? You have no record of what they look like. You can’t determine if they borrowed an access credential. You don’t know if they picked up a lost credential in the parking lot. My word… the risks in this lack of physical security are huge! Especially if you’re running a 24 hour shop.

Wow. Just wow. Mind blown.

Now let’s get back to the parallels to the survey.

Of the 60% of respondents who have an electronic access control solution, the majority are still using a standard key card system and access cards. Not only is your facility not safe, you are also leaving money on the table. Gyms are expensive to run; can you really afford to be this lax with your access control? This concern isn’t just limited to gyms, I am merely using them as an example. What about if you have a multi-tenant property you are managing? Or a small business? Or a large enterprise? Same challenges apply to you.

Now, beyond not being easy to enforce, standard key card and fobs can also be easily duplicated. I used to work in cybersecurity and what I can tell you from that experience, is that a high schooler can learn how to hack your car, your phone, and also your electronic access control that utilize standard cards and fobs by reading Reddit or just Googling how to do it.

Or I can just mail out my key to an online service to make multiple copies of it. Super convenient!

About two-thirds of respondents were worried about cards being lost, and one-third were worried about members, employees, or tenants abusing them (aka sharing them with others). I’m worried that only one third are worried… I think it might be time to make a change, don’t you? Wouldn’t you want to upgrade to a solution that uses more secure technology? How about upgrading to a solution that utilizes a mobile app for access control? People very rarely lose their mobile phones… people also very rarely put them down at all anymore. Why not take advantage of a technology that is difficult to put down, so that you can better protect your facility where people “lift things up and put them down?”

One final statistic from our survey that bothers me is how infrequently facility managers are updating their physical access control privileges. About one third of respondents update their access control privileges weekly… and about another third aren’t sure if they do it or never do it.

I have yet to be a member of a gym, live in an apartment complex, or work at a company where there hasn’t been monthly or even weekly turnover. I also recall how flakey high-school Kevin Jones was with his keys. If you aren’t updating your access control privileges weekly, you are giving former members, employees, tenants, etc. free range to enter your facility if they “misplaced” a key card or fob. If you are running a gym, again, you’re leaving money on the table.

Brivo has some ideas and recommendations on how to better secure your facilities. Read the Facility Manager Executive Report and learn about all of the security gaps and best practices on how to solve them.