Physical Key Vulnerabilities in Security Planning

Security planning affects every area of business management, and building access is no exception.

Transitioning from physical keys to digital keys has many advantages to security that extend beyond the key itself. Likewise, physical keys open up many unique vulnerabilities. Whether you ultimately do or do not incorporate physical keys in your security planning, you should consider each of these vulnerabilities. You can then determine whether to eliminate physical keys or combine them with additional layers of auditable security controls.

While there is a place for physical keys, this should be evaluated against the entire security plan. Some of the best places for physical keys are where ownership costs are lower, in low-vulnerability areas, or when there is little risk if security is breached. Every plan should be risk-based in context.

Physical Key Vulnerabilities

Physical keys have been used for centuries, so why are they often replaced with new technology? This is because physical keys also can create new vulnerabilities in security planning. Here are just a few of the considerations you should include in your planning process.

Insider Threat and Accountability

At any business, the most valuable asset is its employees. This is because of the key role that each individual has in maintaining, growing, and protecting the organization. Physical keys can provide some unique challenges for malicious and accidental actions.

Manual keys, particularly master keys or keys to susceptible spaces, increase the risk of insider threat incidents to a business. Lost, stolen, shared, or misplaced keys are not easily tracked and can be utilized by unauthorized persons to access physical assets and sensitive information. Impacts may include loss of assets and sanctions by regulatory bodies.

If an incident involves a physical key, it is more challenging to investigate and hold an individual accountable, particularly in the case of a duplicated key.

Safety and Chain of Custody

Atriade has conducted several surveys and studies and run focus groups. An overwhelming response from employees has been using a modern access control system, which allows them to use their credentials, which they own, to access the facility. Having a digital, reviewable system, even in smaller retail locations, adds a significant layer to the security of the place. It also decreases the overhead during incident management.

Physical keys can only be easily tracked by creating extensive policies, procedures, and documentation that must be enforced and updated. Keys that leave the business location are not considered ‘controlled.’ The overhead administration of key management can be extensive and lead to inefficient controls and gaps in the long term.

Making Changes – Duplication, Role-based Access, and Re-Keying

When keys are lost, personnel changes happen, or other changes, physical keys provide the greatest challenges to making quick updates.

If a key is taken offsite, it can be duplicated without knowledge of the business. A standard physical key can be easily reproduced with a key mold or impression kit, even if kept onsite. These materials are widely available and easy to use.

Access to a facility should be provided based on the employee’s role and business needs. This is more difficult to manage with physical keys vs. electronic access control systems. With physical keys, changes in roles may require changes in keys issued.

A lost key, particularly a master key, would require changing all locks accessible by that key. This is expensive and an operational challenge for most organizations.

Security Planning Implications for Physical Keys

Increased Overhead Cost

Operational and overhead costs invested in managing physical keys properly can be expensive due to all the additional mitigation elements that must be implemented. Implementation of electronic security controls is much more cost-effective.

This includes not only physical costs but also costs in employee time and planning.

Compliance and Financial Risk

The inability to run adequate security and access audits can open the organization to non-compliance concerns.

The increased overhead cost and compliance vulnerabilities can lead to a higher overall financial risk for the organization. This can have a ripple effect through all areas of the business. This risk impacts the day-to-day administrative functions and the long-term compliance and financial controls.

Safety, Loss, and Theft

One of the most important advantages of digital technology is the ability to create access and control measures that can be audited easily. Using reviewable and documented access control measures significantly increases the level of overall safety and security for employees. This provides them with a safer work experience and creates a healthier workplace culture of safety and security.

A person using a physical key may allow them to access confidential or sensitive information or gain access to network resources and physical assets. This is not only a safety risk but a reputational risk.

Relevant Standards for Security Planning

When making the decision to include or eliminate physical keys from your system, it is important to keep in mind the relevant security standards that apply to your organizational needs. Some of the important compliance standards to keep in mind include:

  • HIPAA – applies to all electronic health information, both digital and physical
  • PCI DSS – which includes any business that manages cardholder or payment data
  • NIST – should be considered for any organization that works with federal government contracts
  • ISO/IEX 27001 – needs to be considered for international contracts or if you have locations in multiple countries

If your company falls under any of these areas, you should strongly consider expert support in compliance, including a review of your digital and physical key use.

Recommendations

Develop a physical security standard that defines security controls based on location type. This standard should define the use cases for physical security technologies. In creating this standard, you can create manageable and auditable controls.

Technology to Replace Physical Keys

Digital keys allow you to leverage more advanced technologies. In many cases, they may be the best response to the liabilities and limitations of using physical keys.

For example, using physical security technologies such as card readers provides frictionless, auditable, and easily manageable forms of access. Using card readers or other similar technology can streamline your security process and allow for easy changes as needed in the normal course of business operations. You can integrate locations with centrally managed access through a control platform.

Planning around access and succession should all be included in your master planning.

Physical Key Use When Needed

If keys must be issued, create a controlled use environment. You can do this in a variety of ways. For example, limit physical keys to management or employees in trusted positions.

You can also maximize the security of the physical keys by utilizing more complex keys and locking mechanisms.

It is also vital to add supportive technology, such as tools that can track when a physical key is used. Add a sensor to a lock that triggers an alarm and/or video analytics.

Accountability mechanisms, including a sign-in/out process and on-site key storage, are recommended. There are numerous key lockers that can be used standalone or integrated with access control systems to help manage keys.

Physical keys can still be used safely in some cases as long as additional protections are implemented.

Conclusion

In most cases, using digital technology for key access will provide a safer and more secure environment. When physical keys are needed, it is important to include additional safety and security mitigation practices.

About Atriade

Atriade has worked on over 500+ projects in 60+ industries in 30+ countries. If you are looking for support in crafting your full spectrum security plans that will set you apart in a competitive marketplace, we are here to help. Our management team carries a lifetime of experience in all areas of Physical Security and Electronic Security that we are ready to put to work for your unique business and team.

Visit us online at Atriade.com 

Connect with us on LinkedIn

Subscribe to our LinkedIn Newsletter: Take A Risk