Badge Cloning Alerts at a Campus Garage
A campus security operations center receives three SIEM alerts in nine minutes. A valid employee badge ID is used at the north parking garage entry at 22:14:06 and again at the south loading-dock door at 22:14:42, about 400 m apart. The loading-dock door is then held open for 75 seconds, and video shows two people entering; one wears a hooded jacket and neither face is clearly visible. The badge holder is a finance analyst scheduled off-site. The night operator wants to dispatch an armed guard, lock all garages, and call the employee at home. The site has 1,200 employees, 24/7 operations, and a policy requiring video export for any access-control anomaly.
1. Prioritize the first 15 minutes of response and state what should not be done.
Read the worked answer
First verify the alert is not a data artifact: check reader time sync, duplicate badge ID, and whether the loading-dock reader is on the same controller. Pull the access-control audit trail for the badge over 24 hours and check anti-passback or occupancy rules. Confirm the HR schedule and call the employee's supervisor, not the employee, to avoid tipping off a possible insider or causing alarm. Dispatch a guard for observation and a perimeter check, not confrontation. Do not lock all garages without evidence because that creates safety and business disruption; use targeted monitoring at the dock. Preserve video and logs immediately, with a hash and chain-of-custody, before overwrite. Keep the operator in contact with the guard and document times.
2. Distinguish plausible benign explanations from indicators of credential cloning, and list the evidence you would collect.
Read the worked answer
Benign explanations include a loaned badge, tailgating, reader clock drift, or a database duplicate. Cloning indicators include the same ID at two readers faster than travel time, after-hours use, a held door, no face match, and repeated events. Collect ACS logs, reader event codes, door-held and forced alarms, CCTV from both locations, vehicle records, visitor logs, and the physical badge. Compare the badge photo with video. Interview the employee and supervisor. Check whether the badge technology is low-frequency proximity, which is easy to clone. If cloning is suspected, deactivate the credential, issue a new one, and review all uses for the past 30 days. Preserve evidence and involve HR and legal before searching personal items.
3. Recommend short- and long-term remediation with a cost/risk rationale.
Read the worked answer
Short term: enable anti-passback and door-held alarms, add guard patrols at the dock, require badge plus PIN at the dock, and review after-hours access. Long term: migrate from proximity cards to secure credentials such as MIFARE DESFire or SEOS with mutual authentication, add video verification, and integrate access and video events. Prioritize the dock and garage because they are the observed attack path. Calculate cost per door and phase the rollout; do not replace all readers at once if budget is limited. Track metrics such as duplicate-use alerts, tailgating alarms, and response time. Training and a policy update are low-cost and necessary.