Computers & Security, 9 (1990) 229-232

More Options for Physical Access Control Charlotte Klopp

A computer room as secure as the Batcave-that would

delight today’s security- conscious MIS managers. As industry manufacturers strive for these cave-like features, analysts are forecasting a surge in European sales of access control devices to climb as high as U.S.$6.1 billion by 1993, an increase of about 33% from 1988’s sales.

The latch-key computer user is fast becoming an antiquated vision, replaced by electronic scanners requiring the touch of a user’s finger or the glance of an eye to approve entrance requests to data systems.

The approximately 250 U.S. suppliers of access control devices, including card access, close circuit television (CCTV), photo identification, biometrics, electromechanical systems and mechanical systems (locks and keys), are seeing breakthroughs in the technolom of access con- trol, especially ianl the arena of biometrics. Worldwide shoppers of such elaborate security

systems are usually military and government organizations, hold- ing extremely sensitive informa- tion and service industries, including banks and insurance organizations. Joe Freeman, president ofJ. P. Freeman and Co., a Newtown, CN, security marketing research firm said biometrics is making its debut within these types of organiza- tions, and expects the product will grow in popularity by as early as 1990.

A study just completed by Free- man’s firm expects that U.S. sales of physical computer security will reach U.S.$4.1 billion by 1993, up 33% from U.S.$3.2 billion in 1986. Based on a comparison of the population in Europe to the U.S., the study estimates that by 1993, sales of physical computer security devices in Europe could reach U.S.$6.1 billion.

Freeman’s research indicates that biometrics will be leading the pack of the six different methods of physical security in the next three years, with sales forecasted

0167-4048/90/$3.50 0 1990, Elsevier Science Publishers Ltd.

to grow between 25% and 40% a year. Card access and photo identification devices will each experience an annual growth of 15%; electromechanical and mechanical systems including locks and hardware will see a 12% growth; and CCTV is ’ expected to grow 5%.

Biometrics, the automated technique of measuring a physi- cal characteristic or personal trait to recognize or verify an indi- vidual’s identity, includes finger- print matching, hand geometry matching, retina pattern match- ing, signature dynamics and voice pattern matching.

While security experts see a i potentially explosive market in biometrics, most would agree that there are still wrinkles to be ironed out, including a better accuracy rate. Also, because this product is so new, it comes with a hefty price tag, which causes some security managers to shy away from it until the product can prove itself worthy.

First introduced in the 1970s, biometric products ranged in

229

C. KlopplMore Options for Physical Access Control

price from U.S.$7500 to U.S.$12 000 per access point, which, coupled with questionable accuracy and user friendliness and limited ability to integrate with existing security systems, was an obvious deter- rent to security managers. Naturally, those prices came down, dropping to the U.S.$3500 to U.S.$75OO range by the mid- 198Os, and over the past two years, leading biometrics manu- facturers have introduced a new generation of products ranging in price from U.S.$900 to U.S.$2000 per access point. Many protectors of secretive data, however, have still been too skeptical to fork out the money for biometrics.

“The expense of biometrics is substantially greater (thanother methods of physical security), so most companies don’t use it unless they have something really important to guard, or money is no object,” said Prcsi- dent of Randallstown, MD, con- sulting firm Bowers Engineering Dan Bowers predicts this trend will change in the next decade.

A well-known player of the biometrics market is EyeDenri$ Inc. of Portland, OR, which has had retinal scanning products on the market for the last five years. Its newest system, the EycDentify 8.5 retinal identification system, priced at U.S.$4995, acknowl- edges an individual via the blood vessel pattern of the eye, a fcaturc said to be even more exact than one’s fingerprint.

“The advantage of this method over the traditional locking mechanism is that you can’t lose your key or give it to someone else,” said EyeDentify business support manager Bob Fuller, claiming a one in one million chance of wrongful entry.

The flagship product of Ecco Industries Inc. of Danvers, MA, VoiceKey, was recently expanded to include the VoiceKey Weatherproof access control system, which company officials boast as the first and only biometric security system designed to withstand climate conditions of outdoor security applications. Introduced last spring, the system allows access to authorized users who repcat a password into the voice reader. The unit promises to withstand high humidity and precipitation, and operate in temperatures ranging from 18 degrees below zero to 122 degrees Fahrenheit, and is resistant to vandalism. The weatherproofing device is about U.S.$150 higher than Ecco’s VoiccKcy system, which costs U.S.$l ZOO for an average configuration.

Ecco vice president of marketing Michael Backler agreed with analysts’ projections that the bio- metrics market would take off in the next year. “With today’s rapid technological advances, security is starting to look like the computer field,” he said. “Security departments can no longer afford to be fearful of new technology.”

A new form of biometrics is signature analysis. This type of physical security analyzes the signature of a person seeking entrance, and, through propric- tat-y algorithms, boils the scribble down to 16 dynamic charac- tcristics. Ion Track Instruments of Burlington, MA, has dcvcloped such a system in the last few years. Division manager for security systems John Padcrson said ITI’s product, Sccurisign, priced at U.S.$SOOO, is the only signature analysis he knows of on the market today. He considered this unique product packed with potential. “It is a more socially accepted tcchniquc over other forms of biometrics, such as putting your eye up to something, or your finger on a device,” hc said. “At one time or another, cvcryonc has been asked to sign some- thing.” He admitted, however, that there is not a large market for this type of biometrics yet, and sales arc sluggish.

EycDcntify’s Fuller agreed the industry has not as readily accepted biometrics as hc and others had expected. “People are not aware of the opportunity to use biometrics. They still think it’s a James Bond device,” hc said.

Consultant Bowers said one reason for the slow acceptance of biometrics into the marketplace is that the error rate has not changed significantly, cvcn though the cost has come down. Hc said it still costs companies about U.S.$60 000 to arm a door

230

Computers and Security, Vol. 9, No. 3

with such devices, and “there will always be a non-zero error rate with biometrics. This is not true with card readers and key pass devices.”

The second largest growth potential of physical security, and still the most popular form of portable-key access control systems is the plastic, wallet- sized card. It is offered by 87% of the vendors, reported Bowers in a report titled Physical Access Control.

Card readers are the biggest part of Hamilton, Ohio-based Mosler’s business. The company’s Comsec and Mosler Ultra Pass systems have a price range of from U.S.$300 to U.S.$1500, said director of marketing Bob Kyle. Access code is stored via magnetic stripe, barium ferrite and proximity technology. Kyle said Mosler does not cater to the card technology’s newest trend, smart cards. Because of their high price tag, the cards, first introduced a few years ago, are not in high demand, he said.

Also a supplier of CCTV systems, Kyle said a major recent improvement in this field is the replacement of tube cameras by chip cameras, which tout a longer maintenance cycle. “We still supply the tube cameras, but I inform customers that in about two years, manufacturers will slow production, or discontinue tube cameras altogether,” he said. The CCD camera may last 10

years before needing to be

replaced, VS. the one-to-three year life cycle of tube cameras, Kyle said.

Mosler’s cards are either flashed before a reader, or may be radioactively read from particu- lar distances. A similar “hands free” system is produced by Mastiff Systems of Marietta, GA. A token, which is worn by employees, will automatically unlock or open doors of which a particular person is cleared to go through. President Charles McRoberts said this system not only gives access, but monitors who and when a person goes through a door, as well as the direction they traveled. The price of the system’s control equip- ment ranges from U.S.$1200 to U.S.$2700, and each door, including peripherals costs from U.S.$3500 to U.S.$7000.

In the security business for about 20 years, Racal-Chubb, thrives on the business of its card access systems. Called Spectrum, the computer system includes a wide range of features that include a wide price range, from U.S.$50O to U.S.$lOO 000, said president James Ringold. He emphasized that all of Spectrum’s “building block” units are upgradablc, and can be integrated. “Small systems will intcgratc with larger systems as a company grows.”

While Racal-Chubb’s security products feature only card access, president James Ringold said he is aware of biometrics’ potential to become an important security

tool in the future. “I have no doubt that someday biometrics will take over, but the technol- ogy is just not hcrc yet.”

Included in the growing trends that face and challenge security managers and information managers is not only how to secure but what to secure. The broadening of a desktop com- puter’s abilities has heightcncd a security manager’s awareness to the desk’s susceptibility, said Jim Wade, chairman for Computer Security Committee for Amcri- can Society for Industrial Secur- ity (ASIS). Managers have had to change their focus of physical computer security from main- frames and networks to cmploycc’s desktops or end user computing, he said. It is harder to get a grip on company assets when those assets are not so centrally located.

“Security managers and informa- tion systems managers must think of the availability of company resources as not in one fixed location, but removed by tremendous distances,” Wade said. Based on complaints he has heard through ASIS, Wade said the main problem managers arc having with physical security is that they don’t know whcrc all the terminals arc. “Managers don’t know where to install security systems.”

Because every employee’s desk- top can’t be barricaded with tricky security devices or surrounded by a tightly sealed

231

C. KlopplMore Options for Physical Access Control

cave, theft is a security manager’s biggest nightmare in trying to guard against the physical forces that threaten to capture a company’s secrets. “The hard- ware is enough of a loss, but the largest concern is with what’s on the hard disk.” Company officials don’t want to think about the amount of information packed into a desktop or portables that can be easily hoisted.

“Theft is happening, especially with portables,” Wade said. People can’t get enough of the new portables, which arc growing in popularity. Wade said Compaq’s newest portable, especially, is in high demand. The growing portability of PCs adds a new dimension to a security manager’s job of keeping a handle on company informa- tion.

Analysts say the integration of information security with physical security is the best prevention for a company’s machines. Stand alone methods of passwords, encryption and software programs are not always enough. “Password efficiency is proven by what hackers arc doing,” Bowers said. “It doesn’t dctcr the professional.”

232