Why Active Directory Represents the Future of Physical Security

Transcription

1 Why Active Directory Represents the Future of Physical Security A White Paper Revised September 2012 Active Directory has the inherent ability to render control hardware obsolete Written By Stephen Pineau President and CEO of Viscount System Inc.

2 Executive Summary and Background Microsoft Active Directory is the software application used by most governments and organizations for logical access control. Conceptually, there is no real difference between logical access control (Active Directory) and physical access control. Active Directory assigns permissions to logical assets defined by schedules, groups and times. Physical access assigns permissions to physical assets based on schedules, groups and times. This white paper discusses how Active Directory is now poised to become the software application used by most governments and organizations for physical access control as well.. Physical security simply becomes a schema extension of the existing logical security (Active Directory) platform. For the past forty years, physical access control has required masses of expensive proprietary control hardware that hold the decision database which in turn links to the user database and programming GUI. With this new paradigm expensive control panels are eliminated. In their place Viscount provides low cost IP encryption bridges that receive messages from the logical security software layer to trigger locks and monitor doors. In essence, the physical security Active Directory schema assigns permissions for existing users and groups to defined roles based on the functions of each IP bridge and associated MAC address. This is little different from the standard logical security Active Directory schema except instead of MAC addresses associated with printers, PC, files and photocopiers the MAC addresses are physical assets such as doors, elevators, and alarms. For the end user, unified logical/physical security systems provide a wide range of benefits from ROI advantages to simplified systems management and cyber security improvements. By eliminating the bulky control panel infrastructure Green benefits are realized by reduced energy consumption and a reduction of up to 90% of the traditional electronic footprint. As a software rather than a hardware centric architecture Freedom provides Cloud benefits at a greatly reduced cost. Other benefits include the simplification of system audits and compliance through the unification of logical and physical logs and the ability to create direct relationships between logical and physical security functions.

3 Active Directory as a Physical Security System An Active Directory structure is a hierarchical framework of objects. Each object represents a single entity whether a user, a computer, a printer, or a group and its attributes. In general, there is no difference between an Active Directory object and a physical security object. In physical security typical entities would be users and devices (door readers, elevators, and locking hardware). In Active Directory an object is uniquely identified by its name and has a set of attributes the characteristics and information that the object can contain defined by a schema, which also determines the kinds of objects that can be stored in Active Directory. So, for physical security the objects and attributes will be contained within a physical security schema extension within Active Directory. The first advantage of the unified platform is the elimination of a separate user database of physical security. As shown in the first Active Directory screen shot below, the physical security Active Directory schema uses the existing logical schema. Users and groups between logical and physical permissions are often common so the data does not need to be stored in two places, as is the case with control panel type physical access systems. Use Existing Users and Groups Security devices are managed MAC addresses However, because traditional control hardware provides additional functions required to control doors, sensors and physical alarms, the challenge to developing an Active Directory Physical Security system is low cost IP bridges (see Freedom bridge hardware below). The second diagram shows how physical security IP bridges can be added and maintained within Active Directory. To an IT network there is no difference between access to a physical security IP device and a printer. Active Directory provides permissions to users to print paper from a certain printer. It can now also provide permission for users to trigger specific door locks. The screen shot below represents typical security functions being managed within the Freedom Active Directory schema.

4 All security functions, alarms and events can now be hosted within Active Directory. To the system there is no difference between a logical security alarm and a physical security alarm. For audit and compliance purposes a unified set of physical/logical logs and functions has numerous benefits. For example, a unified platform allows new types of rules. If an employee is not in the facility then if someone attempts to log in to their desktop an alarm can be created. Or, in the event of a breach, a single set of logs will show the employee was not in the facility when the network was accessed. For compliance and audit there can now be a single set of logs that relate the physical security and logical security history for any user.

5 All security reporting and log functions are held directly within the Active Directory physical security schema. An overall architectural diagram is shown below. Active Directory is with the messaging protocol applet. Unlike control hardware, instances of Active Directory can be replicated to provide greater system reliability and integrity. For Enterprise and Azure Cloud applications, the architecture provides the client the ability to have onsite replication to support Azure in the event of network disruption.

6

7 Freedom IP Encryption Bridge Hardware by Viscount Instead of control panels Freedom allows users to connect readers (biometric, wiegand, iclass, FIP 201) directly to a network through inexpensive IP encryption bridges. Freedom Bridge options include 1, 2 or 4 door configurations with all the necessary inputs and outputs to secure each door. Most are POE enabled with a power input where necessary. Specialized bridges allow additional security functions within Active Directory including the control of elevators, alarms, and other sensors. The standard size of each bridge is appox. 2 x3. This reduces power requirements and reduces the electronic footprint by up to 90%. When a card is presented at a reader, the reader sends a message to the bridge that encrypts the message. The message is sent to an Active Directory server for validation and a message is then sent to the bridge to enable door control. High availability and synchronized Active Directory servers can supply redundancy not possible with control panels. Bridges reduce cabling and conduit by using the existing IT network (POE)

8 Each Freedom Bridge is designed with fault tolerant software that will allow the bridge to connect to any synchronized server on a network. For example, if a server in facility A fails, the bridge will simply contact other servers B thru X within the Enterprise to find an open path for door control. Summary Viscount sees the future of physical security as one in which card readers and sensors will simply be managed devices within an IT platform and user databases will be managed within the framework of existing logical security databases. For large Enterprises, further integration with XACML, SAML, and SPML policy servers will allow physical security policies to be written and enforced from the enterprise access control policy store. This is simply not possible with today s technology that is based upon proprietary control panels. For end users, this represents a more sensible and much more affordable approach to physical security. This new architecture represents a severe technological disruption to the business model of control panel suppliers. However, for major IT suppliers this represents an excellent opportunity to enter an otherwise closed market due to the presence of control panels. They can now provide physical security as a software application using their existing IT architecture and within their existing market channels as simply a subset within the framework of overall identity management. The leading initiative in this area is the US Federal Government through FIPS 201. In essence, the US Government through FIPS 201 has endeavoured to create a common credential for both physical and logical security. The Freedom Active Directory schema and IP Encryption bridge architecture provides a platform for full and seamless compliance.