4 ms·
That would be bad, if you need to suspend access effective immediately, either cause the badge is lost or ex-employee is hostile etc. Any sort of cache would
by manquer 5y ago
That would be bad, if you need to suspend access effective immediately, either cause the badge is lost or ex-employee is hostile etc.
Any sort of cache would give a window of opportunity to an attacker who has access to the badge.
- mc32 5y agoTrue. If the network were down, yes, it should fail secure. But if the network is up it should not go to the server(s) for every swipe/auth. Also not all perimeters have to be treated the same.
- manquer 5y agoIf it didn't go to server for every swipe then that window of opportunity would exist. i.e. the time where server revoked the badge abd the device/cache considers it valid. Even a few minutes could be risky with an ex-employee who knows what he is doing. There are InfoSec reasons why some companies will revoke access as soon or even before telling an employee he is being let go and Security escort the employee off premise. While it is very poor way to handle human relations, it is sound from InfoSec perspective. You are right, as you point out not all perimeters are same, typically more sensitive areas have lesser exceptions though a security guard will not be able to swipe/override you in to a DC as he would in normal office building. Someone else mentioned that they had to trigger Fire Alarms to get all the engineers they needed fast enough at a DC during a down time at eBay.