29 Mar Accessing the power of the cloud
Doors are opening to the cloud for access control. Timothy Compston asks are there any hurdles that still need to be overcome for the cloud’s wider adoption for access control?
As more and more business functions become reliant on the cloud – essentially off premises computing and storage – the security world too is looking to see how this architecture can be rolled out to unlock opportunities for areas like access control, including offering access control as a service. Are there any hurdles that still need to be overcome for the cloud’s wider adoption for access control?
One vendor at the forefront of cloud driven developments is Slovenia-based Spica International in the shape of an access control platform targeted at the commercial market that is, appropriately, called Door Cloud. Andrija Pušic, product director for Door Cloud, explains that this offering has been in the works for three to four years now and is in the late ‘beta’ stage of development following proof of concept testing and the adaption of some existing access control products. Pušic confirms that Spica is now in the process of cooperating with its partners – and listening to feedback – to refine Door Cloud, and that, crucially, plans are in place to start charging end users through the vendor’s partners in the very near future.
Not surprisingly Pušic is an enthusiastic proponent of the benefits of taking a cloud and access control path: “Throughout the whole IT industry you can see a huge movement towards the cloud so the right question to ask is: why not access control? We do not see special things about access control that wouldn’t play better in the cloud.”
Drilling down into the operational advantages of moving to the cloud through a solution such as Door Cloud, Pušic says that, at a practical level, it is possible to operate and manage access control from anywhere at any time using a browser or mobile phone – mobile app: “That’s huge. There are other things that come with the cloud/mobile such as opening your door, with a mobile app, so you don’t need cards anymore. This is not something that you strictly need the cloud for, but it goes very well with the cloud.”
In addition, Pušic believes that the ‘huge leap in convenience’ that is very much a feature of cloud-based security management also opens the door to better overall security: “You are going to be able to dedicate more of your attention to your security systems because you are going to be updated in real-time using the means of communication which are much more convenient than those traditionally applied. Your mobile phone actually gives you all the information you are interested in as an administrator or manager, whenever you want.”
He also points out that with a solution like Door Cloud it is possible to deal remotely with alarms and give – and take away – access rights amongst other things: “We like to offer up the example of a person who receives an alarm when they are on a fishing boat that a door is being forced open in another part of the world. If they are in the escalation line of the management system, they can now work on it from the boat and escalate it further as required.”
Controller security
Asked if there are any challenges or issues associated with access control and the cloud, Pušic says that one of the critical things to bear in mind before venturing into the cloud is the security of the controllers themselves: “Your controller has to a be a proper Internet security equipped device. This is not something that you get with your traditional controller, you need a new generation designed for the open Internet. The mode of operation is very different as a cloud access control device operates as an Internet client and security client and not vice versa.” He adds that, consequently, Spica International’s controllers are ‘cloud ready’ and that the vendor’s Door Cloud is based on these controllers: “This means that we have very tight integration and very good control of all security aspects of cloud access control.”
Pušic contrasts the access control situation with that of IP cameras where many have been brought to market without a serious level of security. In the case of such cameras he suggests that it may not always matter if someone can see your footage but the same cannot be said of access control: “You cannot say well this is my access controller and I really don’t care who can open it, open my doors. Any kind of cloud access controller has to have proper cloud security built-in.”
Advantages for access
Talking about the direction of travel for access control and the cloud, John Davies the managing director at TDSi – whose GARDiS platform has been rolled out with the cloud in mind – argues that working with cloud storage delivers many advantages. Systems can, for example, be more readily installed, monitored, upgraded, and changed to suit the developing needs of an organisation: “New hardware components can be integrated into the security network via an IP connection and authorised people can access the system from anywhere, on virtually any Internet-enabled device,” says Davies. He adds that, from a cost of ownership perspective, this level of integration makes the price of purchasing and maintaining these systems far more attractive.
Addressing head-on some of the security concerns that have been voiced around the cloud becoming a bigger element of access control solutions, Davies responds that as most of us happily complete the most secure transactions online – such as banking – the question should really be: why not physical security? “In the past many people believed physical security systems should only be hosted onsite to ensure nobody could hack them remotely. However, this silo mentality also means that remote security teams can’t take control in an emergency either. With high levels of online security now available there is no reason to run a security network like a medieval castle under siege,” he says.
With regards to access control management software – like the vendor’s latest GARDiS offering – Davies stresses that if, in the past, it was possible to install and trust security software onsite it should not be a ‘wild leap’ for users to trust it as a cloud-hosted system: “This [the cloud] makes it far easier to supply [software] as a service [SaaS] and transforms the way that security provision is delivered and maintained.”
Workplace Experience
Turning to the thoughts of Wisam Yaghmour, regional sales director, MEA with HID Global, he says that by leveraging the cloud, mobile IDs and IoT (Internet of Things) connections, it is now possible to create more seamless and intuitive workplace experiences that are built on access control infrastructure: “It also enables data analytics to be used for new capabilities, including remote reader configuration, predictive access control system maintenance and intent detection.” There is also the potential, according to Yaghmour, for subscription-based services that make it easier for a company to order and manage mobile IDs.
In terms of the rationale for the launch of the HID Origo cloud platform, which was unveiled at Intersec 2019 earlier this year, he explains that one of the key drivers was the growing adoption of mobile identities in today’s more connected world. Alongside this, he flags-up the accelerating demand in the market for a unified mobile and cloud-based experience, that integrates more and more applications, so that users need only carry their smartphone as they enter and exit buildings and access applications and services.
Looking at HID Origo in more detail, Yaghmour says that the solution readily combines the vendor’s technologies for mobile IDs – and location-based services in future – with access control architecture: “This brings together physical security and a wide range of building applications, services and IoT use cases via a unified cloud experience.”
Moving to a secured and connected cloud architecture, says Vaghmour, brings numerous advantages for the whole access control chain, from application developers to end users: “Developers will be able to shift from having to create an entire vertically integrated solution to simply layering an app experience on top of our existing access control infrastructure of millions of PACS readers, controllers, panels and locks, worldwide, already connected in the cloud and made easily available through APIs and SDKs.”
He continues that, ultimately, for end users, cloud-based access control enables more intuitive, seamless, and consistent service delivery and user experiences: “There is also better workflow planning, regulatory compliance, remote hardware configuration, and predictive access control capabilities,” concludes Yaghmour.