Page 20 - Security Today, May 2017

• Use the “card present” line commonly available on many of today’s access control readers. This signal line lets the access control panel know when the reader is transmitting data.
• Provide credentials other than those formatted in the open, industry standard 26-bit Wiegand. Not only is the 26-bit Wie- gand format available for open use but many of the codes have been duplicated multiple times. Alternatives can include ABA Track II, OSDP, RS485 and TCP/IP.
• Offer the customer cards that can be printed and used as pho- to badges, which are much less likely to be shared.
• Employ a custom format with controls in-place to govern du- plication.
• Offer a smart card solution that employs sophisticated crypto- graphic security techniques, such as AES 128-bit.
• Make available non-traditional credentials with an anti-play- back routine, such as transmitters instead of standard cards and tags. Long range transmitters offer the additional benefit of not requiring a reader be installed on the unsecure side of the door. Instead they can be installed in a secure location, such as the security closet, perhaps up to 200 feet away.
• Offer a cutting edge, highly proprietary contactless smartcard technology such as Legic® advant.
• Provide 2-factor readers including contactless and PIN tech- nologies. Suggest users roll PINs on a regular basis. If re- quired, offer a third factor, normally a biometric technology (face, fingerprint, voice, vein or hand).
Assure additional security system components are available. Such systems can also play a significant role in reducing the like- lihood of an attack as well as mitigating the impact of a hack attack should it occur:
Intrusion. Should the access control system be hacked and grant entry to a wrong individual, have a burglar alarm system in place to detect and annunciate the intrusion.
Video. If the access control system is hacked, granting entry to an unauthorized individual, have a video system in place to detect, record and annunciate the intrusion.
Guards. If the system is hacked and intruders are let in, make sure that guards in the control room as well as those performing a regular tour receive an alert notifying them that someone has physically tampered with the access control system.
We must always stay one step in front of the bad guys. With the proper tools, any of these assaults can be defended.
Adding Encryption into an
Access Control System
One aspect of securing a card’s information is to make the in- ternal numbers unusable; they must be encrypted. To read them, the system needs access to a secret key or password that provides decryption. Modern encryption algorithms play a vital role in as- suring data security:
Authentication. The origin of a message.
Integrity. Contents of a message have not been changed. Non-repudiation. The message sender cannot deny sending the
message.
Here is how it works. The number is encrypted using an en-
cryption algorithm and an encryption key. This generates cipher text that can only be viewed in its original form if decrypted with the correct key. Today’s encryption algorithms are divided into
NS6
two categories: symmetric and asymmetric.
Symmetric-key ciphers use the same key, or secret, for en-
crypting and decrypting a message or file. The most widely used symmetric-key cipher is AES (Advanced Encryption Standard), which is used by the government to protect classified information. Another common symmetric cipher, noted for its high speed of transaction, is the TEA (tiny encryption algorithm). It was origi- nally designed at the Cambridge Computer Laboratory.
Asymmetric cryptography uses two different, but mathemati- cally linked, keys: one public and one private. The public key can be shared with everyone, whereas the private key must be kept secret. RSA (named after Misters Rivest, Shamir and Adleman) is the most widely used asymmetric algorithm.
Today, 13.56 MHz smart cards are used to provide increased security compared to 125 KHz proximity cards. One of the first terms you will discover in learning about smart cards is “MI- FARE,” a technology from NXP Semiconductors. MIFARE enables 2-way communications between the card and the reader.
MIFARE Classic was an original version of the MIFARE standard used in contactless cards. It stores the card number on one of its sectors, and then encrypts the communication between the card and reader to theoretically make it impossible or, at least, very difficult to clone a card. Unfortunately, a security flaw was discovered in the MIFARE Classic standard which meant that, with the right knowledge and hardware, a card could still be cloned or another card in the series created.
The newest of the MIFARE standards, DESFire EV1, in- cludes a cryptographic module on the card itself to add an addi- tional layer of encryption to the card / reader transaction. This is amongst the highest standard of card security currently available. MIFARE DESFire EV1 protection is therefore ideal for sales to providers wanting to use secure multi-application smart cards in access management, public transportation schemes or closed- loop e-payment applications. They are fully compliable with the requirements for fast and highly secure data transmission, flexible memory organization and provide interoperability with existing infrastructures.
Additional encryption on the card, transaction counters and other methods known in cryptography are then employed to make cloned cards useless or enable the back office to detect a fraudulent card and put it on a blacklist. Systems that work with online readers only (i.e., readers with a permanent link to the back office) are easier to protect than systems that have offline readers, since real-time checks are not possible and blacklists can- not be updated as frequently with offline systems.
Don’t Let Them Hack via the
Access System You Specify
Protecting your customers’ organization(s) from hackers is im- perative. The threats have grown to include sophisticated govern- ment backed entities and teenage mischief makers. In either case, these bad actors are targeting both IT and OT systems, often with the result of imperiling our national security. With knowledge of what hackers seek and the remedies available to thwart them, anti-hacking specifications are now mandatory. If, for no other reason, the FTC is now providing new motivations.
Scott Lindley is the president of Farpointe Data.
0517 | NETWORKING SECURITY