Confirming someone’s identity before giving them access to facilities or work sites is crucial for security. The most common way large organizations assure identities is with photo ID cards. These have traditionally been “flash passes” that employees show to a security guard as they enter a building. The guard is trusted to verify that the picture matches the face before granting access. This passive photo ID card is sufficient for some organizations, but the limitations of this approach have led many companies to consider implementing “smart” ID cards.
Smart ID cards, or those with a computer chip, reduce security risks since the card is read automatically and access to facilities is granted or denied based on pre-defined rules. Because smart cards are much more difficult to falsify, they reduce the risk of fraud. And the risk of granting access inappropriately is reduced since machines are inherently more reliable than people for these types of repetitive tasks.
The federal government, understanding the inherent risks of mistaken personnel identification, has undertaken the most ambitious deployment of smart ID cards in the United States, first with the Common Access Card for Department of Defense employees, and more recently, the Personal Identification and Verification card for all other departments. The smart card industry originally expected private industry to adopt some subset of these standards, but that has not yet happened to any large extent.
One major reason is because smartcard ID systems are expensive and require ongoing IT support. As a result, most U.S. companies are continuing to use traditional ID cards. However, there are now technologies available that can provide many of the benefits of smart cards at much lower costs.
In many cases QR (quick response) code technology can provide a high-tech, low-cost method of meeting credential verification requirements. These codes, the now-ubiquitous black-and-white squares often found on print ads or product packaging, can be added to identification cards for little cost. Unique QR codes can be printed on photo ID cards and read with any smartphone. They can be set up to allow rapid verification of personnel, going well beyond a security officer’s judgment based solely on the card before him. A scan of the QR code can immediately display up-to-the-minute rights and authorizations for that employee or list their qualifications and credentials.
A construction company that specializes in building wind turbines, for example, began printing QR codes on all its access cards. Clients and engineers were then able to use their smartphones to perform on-site verification of the training and qualifications of any installer, reducing the risk of substandard performance and potential liability issues.
The actual production of ID cards is also changing. In the past, companies had to undertake the costly job of printing their own cards, including investing in printers, training, maintenance and supplies. Today, however, thanks to cloud-based outsourcing services, online printing options are available to turn ID card production into an relatively minor operating expense, rather than a capital expenditure.
Risks are inherent in personnel identification cards. Taking into account these measures, however, makes it easier for risk managers to re-think how their current ID card program and process can be refined.