One of the newest developments in physical and logical access security is mobile access control which utilizes smartphones and other devices to grant secure access to buildings, resources and IT networks. With so many people now carrying mobile devices, this looks like a sound move, however, it is not without its issues.
The purpose of access control is to improve security and the big question is whether mobile access control makes that security any better. At the same time, we need to look at whether, from a practical and financial perspective, mobile access control is better than the widely used smart card systems.
At present, 79 percent of organizations use smart card access control. With such a high take up rate, any alternative technology will need to be good to break into that market. So, what are the advantages of mobile access?
Advantages of mobile access control
The first and most obvious advantage is that mobiles are ubiquitous. According to Ericsson, by 2020, 70 percent of people will be using them. For businesses that want to move to mobile access, this means it’s highly likely that most employees and visitors will already have the technology needed to enable the system to work.
Another possible reason for using mobile access is the freedom of choice it brings. It gives businesses and employees the choice to use smartphones or smart cards, or for that matter, any other form of wearable, like wristbands or watches. This can make access control more convenient, both in terms of what the user carries and in how it is operated.
Security is another benefit, smartphones have their own security features such as PINs or fingerprint scans which prevent any unauthorized user from using it to gain access. However, smart cards, too, can come with password, PIN or two-step authentication.
Some argue that smartphones, because of their high value, are more likely to be better taken care of than a smartcard and so are less likely to be lost. Whilst this may be true in one sense, in another, a smartphone is much more likely to be a target of theft.
Perhaps one significant benefit is that a smartphone can be permanently connected to the company’s system, enabling any security credentials to be easily managed and new users to be issued access remotely. A visitor, for example, could be granted access remotely and have it in place on arrival, rather than having to have a card issued on site. However, smart cards can be prepared in advance, too.
Potential issues with mobile access control
While there are potential benefits to mobile access control, the technology does have a few issues that still need to be ironed out.
One possible issue is with the technology being used. BLE and NFC technologies continue to be improved upon and updated. These developments mean that current cards and smartphones may not be compatible with next-gen systems. If this happens, replacing smart cards, such as those available from Universal Smart Cards, is a simple and inexpensive solution; however, this is not so easy for companies which rely solely on mobile access. They would require smartphone manufacturers, like Apple and Samsung, to update their phones and would also require employees to have the latest and most expensive models.
Indeed, not all models of phone are compatible. It is only with the release of iOS 11 in 2017, that Apple phones became fully NFC enabled. Pre-iPhone 6 models, of which there are still millions in use, cannot be used for access. Even the iPhone 6 only acts as an NFC tag and not as an NFC reader. And with so many other makes and models being used, a company which switches to mobile access is bound to find some compatibility problems.
Another issue surrounds the ownership of the phone. With company issued phones, a business can ensure that the right security protections and user protocols are in place. However, this can be a highly expensive solution. Having a BYOD (bring your own device) system is more economical but comes with the risk that security and usage is controlled by the owner. This increases the possibility that the phones can be hacked or tampered with, giving the potential for someone to gain access to the premises or the IT system.
The mobile – smart card hybrid solution
Combining mobile access control with traditional smart card technology is perhaps the best solution. While some users may prefer to use a smartphone, others may be happier with a smart card – just as we see with contactless payments. In fact, some may not even have a compatible phone and so have no choice. The great thing is that access control systems can work with both forms of technology so that companies do not have to choose one over the other.
Indeed, it is probably best for companies that want to offer mobile access to begin doing so in a controlled way while still offering smart-cards as an option. We’ve all seen too many catastrophes happen when new systems are launched and don’t go to plan.
Whichever choice a company makes, it is important to look at the benefits and disadvantages of each before committing to a decision.