Archive for category: Commercial Security

By Neal Bellamy, IT Director at Kenton Brothers

Today, I want to talk about credential technology. While not an extremely exciting topic, it can be, and often is the weakest link in many organization’s access control system. Remember that an attacker doesn’t need to get through every defense in your system, most often they just need to get past the weakest one (or two).

Let’s start with how cards and readers work.

Any RFID reader, including the ones used for access control, puts out an electromagnetic field around the reader. This field is usually measured in inches, but in special readers like a Nedap long-range reader, fields can be measured in feet.

When a credential (card, fob, wristband, sticker, etc.) passes through the field, it electrifies the antenna giving the chip on the credential enough electricity to transmit the data stored on the chip. Most often the data that is stored is the “Card number”. I put it in quotes because that “Card number” could be many things.

Next, we need to talk about card numbers or more specifically card formats.

Unfortunately, most card formats are simple and relatively easy to guess. The most common card formation is 26 bits in length. HID calls this H10301. The first 8 bits designate the facility code and the next 16 bits designate the card number itself. The facility code is a way to group the cards together and in theory, verify that the card belongs to the access control system.

The low bit count means that there are only 256 possible facility codes and 65,535 card numbers. For those people paying attention to the details, the extra 2 bits are used for error checking.

Most people start with card number 1 and work their way up. There are other card formats like 33-bit, 37-bit, 40-bit, and so on. Each increases the possible facility code and card number options. The important takeaway is that once an attacker has the card format, facility code, and card number of a person who has access, they can gain access to your facility.

Encryption

Like most things in commercial security, encryption is a way to combat the wrong people seeing the real card number. Encryption and card formats are independent of each other. You can have a 26-bit card that uses encryption and a 26-bit card that does not use encryption. That is based on the card technology.

Card technology like Prox and Indala are not encrypted. This means that almost any card reader can read the actual card format, facility code, and card number, it just has to get close enough to a card that has access.

Some technologies are encrypted but have already been cracked. Examples of these are Mifare Classic, HID iclass Classic, etc. Because the technology is already cracked, there are several ways of reading the encrypted data, and then applying the workaround to get to the actual card data again. Using a cracked technology is better than unencrypted, but it is still not advised.

Some technologies are not yet cracked like Mifare EV3 and HID iclass SEOS.

Encryption Usage

When an encrypted technology is in use, both the card and reader must be using the same set of keys. Public/Private key is a long topic, but effectively a matching pair of keys are used to encrypt and decrypt data. (More information here.)

This means that readers and credentials are matched for the different manufacturers. If you are using HID readers, you almost always need to use HID credentials. Even with an encrypted, uncracked, card technology, the most commonly sold readers and credentials use the same key pair across all readers and credentials. This means that anyone can buy the latest HID reader to read almost every HID card ever sold.

There are special programs where a business can “own” its own set of keys. Another option is to use a system that generates a unique key and then can use that key to encrypt the cards specifically for a given system like Gallagher.

I know this was a lot of information, so let’s distill it a bit.

First, make sure you are using encrypted card technology.

Second, use the latest technology when you are using encryption. This will be based on the card readers you are using.

Finally, if at all possible, own your public/private keys. Sign up for a unique key system like Corporate 1000, or use a system like Gallagher to generate a unique key for your system.

If you have more questions or need help with your current/future commercial security solution, please give us a call.

By Kevin Whaley, CPP, Sr. Security Consultant at Kenton Brothers

Welcome to Part 3 of our discussion about Crime Prevention Through Environmental Design (CPTED).

In Part 1, I introduced the concept of CPTED and the importance of ensuring CPTED principles are considered when developing or enhancing your security program. In Part 2, we dove into greater detail on the concepts of Natural Surveillance & Natural Access Control. In Part 3 of the series, we will be looking at Territorial Reinforcement and Maintenance.

As a quick recap: in the first part, we touched on the four key overlapping concepts of CPTED which include:

1. Natural Surveillance
2. Natural Access Control
3. Territorial Reinforcement
4. Maintenance

In the second installment, we went into greater detail about the in’s & out’s of Natural Surveillance & Natural Access Control such as;

• Natural Surveillance – the placement of physical features, activities and people in a way that maximized visibility from the surrounding environment.
  • WHY? It increases the threat of apprehension by taking steps to increase the perception that people can be seen.
• Natural Access Control – Natural access control means controlling access to a site. People are physically guided through a space by the strategic design of streets, sidewalks, building entrances, and landscaping.
  • Clearly defines entryways and guides personnel to specific entrances that are well lit and overlooked by surrounding areas.

Just as a reminder, the overall goal in the successful implementation a CPTED plan of action, we must understand that all human space:

• Has some designated purpose.
• Has social, cultural, legal, or physical definitions (such as expectations or regulations) that prescribe the desired and acceptable behaviors.
• Is designed to support and control the desired and acceptable behaviors.

With that understanding in mind, our approach should focus on:

• Manipulating the physical environment to produce behavior effects that reduce the fear and incidence of certain types of criminal acts;
• Understanding and modifying people’s behavior in relation to their physical environment
• Redesigning space or using it differently to encourage desirable behaviors and discourage illegitimate activities; and
• Reducing the conflicts between incompatible building users and building uses, with the goal of eliminating “no person’s land” that no one takes ownership of.

There are various controls that can be implemented that can supplement or support the approaches listed above.

Territorial Reinforcement and Maintenance of your CPTED program.

Territorial Reinforcement:

Territorial reinforcement involves establishing a sense of ownership and belonging in a specific space, which can be achieved through various design elements and strategies. When a space appears to be clearly defined and “owned” by a particular group or individual, it may discourage potential criminals by making them feel like trespassers or intruders and that the potential for detection is high.

Importance in CPTED: By implementing territorial reinforcement, CPTED aims to deter criminal activity by promoting the perception of active ownership and surveillance. A well-defined and cared-for area signals to potential offenders that their presence is likely to be noticed and that there is a higher risk of detection and apprehension. This may lead to a decrease in the opportunities for criminal acts to occur, as criminals tend to avoid spaces where they feel more vulnerable and exposed.

Examples of Territorial Reinforcement:

1. Clear boundaries and property lines demarcated with fences, hedges, or other physical barriers.
2. Well-maintained landscaping and exterior areas, indicating active use and care.
3. Signage and symbols that represent community ownership or surveillance, such as neighborhood watch signs.

These examples of territorial reinforcement can (and should be) enhanced with other physical security measures including but not limited to:

1. Surveillance cameras
2. Speakers with pre-recorded messages stating that the person is being watched or that authorities have been called.
3. Sufficient illumination
4. Security officers
5. Access Controls
6. Active/Passive intrusion sensors

However, no matter how advanced or intricate your CPTED program is, it can deteriorate and become obsolete without proper care and maintenance.

CPTED Maintenance:

CPTED maintenance involves sustaining a sense of ownership and control over a space through ongoing upkeep and community involvement. Neglected or poorly maintained areas can attract criminal activity as they signal a lack of guardianship and a reduced risk of detection.

Importance in CPTED: Regular maintenance of public and private spaces is critical to the success of CPTED. Well-maintained environments foster a sense of pride, ownership, and responsibility among community members. It reinforces the idea that residents are actively invested in their surroundings and are vigilant against criminal behavior. This collective effort makes it less attractive for criminals to target such areas, as they are more likely to be noticed and reported by the community.

Examples of Territorial Maintenance:

• Prompt repair of broken windows, damaged fences, or graffiti.
• Adequate lighting to ensure visibility and reduce hiding spots.
• Community engagement and participation in the upkeep of shared spaces.

The image to the right is an example of POOR CPTED maintenance. As you can see, the vegetation is growing through the fence line, damaging it significantly and there are various areas where intruders have cut and recut through the fence line. The lack of prompt repair, landscaping maintenance, and lack of illumination, make this industrial facility a tempting target.

In conclusion, territorial reinforcement and maintenance are essential components of Crime Prevention Through Environmental Design. By creating a sense of ownership and responsibility within a community and ensuring that spaces are well-cared for, CPTED aims to discourage criminal activity and promote a safer environment for residents and visitors alike. These proactive measures empower communities to take control of their surroundings and play an active role in crime prevention.

I hope you will watch out for the final installment where we will review the concepts we’ve discussed and how they all can be tied together.

Have more questions about CPTED or would like an assessment? Give us a call at 816-842-3700 and our board certified security professionals will get you taken care of!