Chapter 2: Current Challenges in Physical & Digital Security

Despite decades of development, access control systems face significant challenges that hinder their effectiveness, scalability, and security. Organizations struggle with fragmented systems, interoperability issues, evolving threats, and increasing compliance requirements. This chapter examines the major challenges facing modern access control deployments and their impact on organizational security posture.

The Fragmentation Problem

One of the most pervasive challenges in access control is system fragmentation. Organizations typically deploy multiple access control systems from different vendors, each with proprietary protocols, data formats, and management interfaces. This fragmentation creates numerous operational and security challenges.

Disparate Physical Access Control Systems

A typical enterprise might have different PACS installations across various facilities, acquired through mergers, built by different contractors, or selected by different departments. Each system operates in isolation with its own:

• User database and credential management
• Access rules and schedules
• Audit logs and reporting formats
• Hardware compatibility requirements
• Management software and training requirements

This fragmentation means a single employee might need multiple credentials for different buildings, security teams must monitor separate systems, and consolidating access reports becomes a manual, error-prone process.

Digital Identity Silos

The digital realm faces similar fragmentation. Organizations maintain separate identity stores for:

When an employee joins, changes roles, or leaves, administrators must update each system individually. This manual process is time-consuming, error-prone, and creates security gaps where former employees retain access or new employees lack necessary permissions.

Interoperability and Integration Challenges

Even when organizations recognize the need to integrate access control systems, achieving true interoperability proves difficult due to technical, organizational, and vendor-specific barriers.

Lack of Standard Protocols

Unlike network communications where protocols like HTTP, TLS, and TCP/IP enable universal interoperability, access control lacks widely adopted open standards. Vendors often implement proprietary protocols for:

• Reader-to-controller communication: Wiegand, OSDP, proprietary RS-485
• Controller-to-server communication: Proprietary TCP/IP or serial protocols
• Management APIs: REST, SOAP, or no API at all
• Credential formats: Vendor-specific card formats and encoding
• Event reporting: Varying log formats and data schemas

Integration Complexity

Integrating physical access control with digital identity systems requires bridging fundamentally different architectures:

Typical Integration Challenges:

Physical Access System          Digital Identity System
├─ Proprietary database         ├─ Active Directory / LDAP
├─ Custom user schema           ├─ Standard LDAP schema
├─ No REST API                  ├─ Microsoft Graph API
├─ Numeric user IDs             ├─ Complex object GUIDs
├─ Limited attributes           ├─ Rich user attributes
├─ Manual credential encoding   ├─ Automated provisioning
└─ On-site controllers          └─ Cloud-based services

Integration Requirements:
• Bidirectional synchronization
• Schema mapping and transformation
• Real-time updates vs batch processing
• Credential lifecycle management
• Audit trail consolidation
• Failure handling and retry logic
            

Organizations often resort to custom integration code or expensive middleware platforms, creating technical debt and ongoing maintenance burden.

Security Vulnerabilities in Legacy Systems

Many access control deployments rely on legacy hardware and software that predates modern security practices, creating exploitable vulnerabilities.

Weak Authentication Mechanisms

Older access control systems often use easily compromised authentication methods:

Unencrypted Communications

Many PACS installations use unencrypted communications between components:

• Reader to controller: Wiegand carries card numbers in clear text over unshielded wires
• Controller to server: Proprietary protocols without TLS or encryption
• Management interface: Web interfaces using HTTP instead of HTTPS
• Mobile credentials: Bluetooth Low Energy without proper encryption

An attacker with physical access to cabling or network segments can intercept credentials, replay access attempts, or inject malicious commands.

Insufficient Network Segmentation

Access control systems are often deployed on the corporate network without proper segmentation, exposing them to attacks from compromised endpoints or malware:

Insecure Network Architecture:

                    ┌─────────────────┐
                    │ Corporate LAN   │
                    │   10.0.0.0/8    │
                    └────────┬────────┘
                             │
         ┌───────────────────┼───────────────────┐
         │                   │                   │
    ┌────▼────┐         ┌────▼────┐        ┌────▼────┐
    │  Desks  │         │  WiFi   │        │  PACS   │
    │10.0.1.x │         │10.0.2.x │        │10.0.3.x │
    └─────────┘         └─────────┘        └─────────┘
         ↑                                       ↑
    Malware can spread from workstation to access controllers!

Secure Network Architecture:

    ┌─────────────────┐         ┌──────────────────┐
    │ Corporate LAN   │         │ Security Systems │
    │   10.0.0.0/8    │         │  10.100.0.0/16   │
    └────────┬────────┘         └────────┬─────────┘
             │                           │
         Firewall                    Firewall
             │                           │
    ┌────────▼────────┐         ┌────────▼─────────┐
    │  Access Control │         │  PACS Controllers│
    │  Management     │◄────────┤  & Readers       │
    │  (DMZ)          │         │  (Isolated VLAN) │
    └─────────────────┘         └──────────────────┘
            

Compliance and Regulatory Complexity

Organizations face an increasingly complex web of regulations and standards governing access control, with requirements varying by industry, geography, and data type.

Overlapping Requirements

A single organization may need to comply with multiple frameworks simultaneously:

Audit and Reporting Challenges

Demonstrating compliance requires comprehensive, tamper-proof audit trails. Current challenges include:

• Fragmented logs: Events spread across multiple systems in different formats
• Incomplete data: Missing timestamps, user details, or justification for access
• Log integrity: Lack of cryptographic verification prevents tampering detection
• Retention policies: Inconsistent retention periods across systems
• Search and analysis: Difficulty correlating events across systems
• Privacy concerns: Balancing security monitoring with employee privacy rights

Scalability and Performance Issues

As organizations grow, access control systems must scale to handle increasing users, locations, and transactions while maintaining performance and reliability.

Database Performance Bottlenecks

Centralized access control databases can become performance bottlenecks:

Scaling Challenges:

Enterprise with 50,000 employees:
├─ 50,000 users × 3 credentials each = 150,000 credentials
├─ 500 doors × 50 access events/hour = 600,000 events/day
├─ 90-day retention = 54,000,000 events in database
└─ Peak morning entry: 10,000 authentications in 30 minutes
   = 333 authentications per minute
   = 5.5 authentications per second

Add real-time requirements:
• Door unlock decision: < 500ms (perceived as "instant")
• Database lookup: < 100ms
• Rule evaluation: < 50ms
• Network latency: < 50ms
• Lock actuation: < 300ms

This leaves minimal margin for database contention,
network issues, or complex authorization rules.
            

Geographic Distribution

Multi-site deployments face additional challenges:

• WAN latency: Centralized authentication slower for remote sites
• Connectivity failures: Access denied when connection to central server fails
• Synchronization delays: Changes to access rights propagate slowly
• Bandwidth constraints: Video surveillance and access logs consume network capacity

User Experience and Operational Friction

Poor user experience in access control systems leads to security workarounds and operational inefficiencies.

Credential Overload

Users frustrated by multiple credentials often:

• Prop open secure doors to avoid repeated authentication
• Share credentials with colleagues to simplify access
• Write down PINs or passwords in insecure locations
• Request excessive permissions to avoid future access issues

Administrative Burden

Security administrators face overwhelming workloads:

In this example scenario, access control administration consumes 133 hours per month—nearly one full-time employee just maintaining credentials, before considering incident response, system maintenance, or strategic improvements.

Emerging Threat Landscape

Modern access control systems face sophisticated attacks that legacy designs never anticipated.

Social Engineering Attacks

Attackers exploit human factors to bypass technical controls:

• Tailgating: Following authorized users through secured doors
• Credential theft: Stealing badges or harvesting passwords through phishing
• Impersonation: Posing as maintenance, delivery, or emergency personnel
• Help desk attacks: Convincing support staff to reset credentials or grant access

Advanced Persistent Threats (APTs)

Nation-state actors and sophisticated criminals target access control systems as part of broader campaigns:

APT Attack Chain Against Access Control:

1. Reconnaissance
   ├─ Identify PACS vendor through public documents
   ├─ Research known vulnerabilities in that product
   └─ Map network architecture via WiFi scanning

2. Initial Access
   ├─ Phishing email to facilities manager
   ├─ Malware gains foothold on administrative workstation
   └─ Lateral movement to access control server

3. Privilege Escalation
   ├─ Exploit unpatched PACS software vulnerability
   ├─ Obtain database credentials from configuration files
   └─ Gain administrative access to access control system

4. Persistence
   ├─ Create backdoor administrative accounts
   ├─ Install remote access tools on controllers
   └─ Modify audit settings to hide activities

5. Objective
   ├─ Grant access to specific secure areas
   ├─ Disable cameras during physical intrusion
   ├─ Exfiltrate employee data and access patterns
   └─ Plant malware for future operations
            

Supply Chain Vulnerabilities

Access control systems depend on complex supply chains that introduce risks:

• Compromised firmware in card readers or controllers
• Backdoors in third-party software components
• Counterfeit credentials or hardware
• Malicious updates pushed by compromised vendor systems

Cloud Migration Challenges

As organizations move to cloud-based access control, they encounter new challenges:

Connectivity Dependencies

• Internet outages: No cloud connectivity means no access control
• Latency: Cloud round-trips add delay to authentication
• Bandwidth costs: Video and high-frequency events generate significant traffic

Data Sovereignty and Privacy

• GDPR requirements for data residency in EU
• Government regulations prohibiting cloud storage of certain data
• Employee concerns about cloud providers accessing personal data

Vendor Lock-in

• Proprietary cloud APIs prevent easy migration to competitors
• Data export limitations make it difficult to switch vendors
• Subscription models create ongoing costs that exceed traditional purchases