North Lobby Tailgating and Suspected Credential Sharing
A 14-floor financial services office in a dense downtown has 620 employees, 140 daily contractors, and 12 optical turnstiles across three lobbies. The north lobby handles 62% of morning entries. PACS logs for the last 30 days show 1,140 door-held-open events and 38 tailgating alarms per day; 71% occur between 08:10 and 09:00. Badge data shows three active 125 kHz prox cards used at the north lobby and the loading dock 210 m away within 40 seconds on four occasions. Reader firmware is four years old, and the access control system still accepts the default facility code. Security has $180,000 capital and can either deploy a biometric or mobile-credential pilot at six doors or re-card all 760 people and upgrade firmware. Guards currently reset turnstile alarms with a single click and do not log outcomes. Contractors are sponsored by Facilities, and sponsorship is not reviewed after 90 days.
1. What does the evidence most likely indicate, and how should the $180,000 be prioritized? Justify your answer with the specific indicators.
Read the worked answer
The simultaneous-use events are the strongest signal. Covering 210 m in 40 seconds requires 5.25 m/s, which is faster than normal walking and consistent with either a runner carrying two cards or a cloned credential used at two readers. Three cards repeatedly appearing at both locations is not random tailgating. The 38 tailgating alarms per day and the 71% morning concentration point to a process and culture problem at the north lobby, not just a hardware problem. The default facility code and legacy 125 kHz prox technology make cloning low-skill and likely, so the access-control configuration is a critical finding independent of the tailgating volume.
Prioritize in this order: (1) immediate containment at near-zero cost-change the facility code, enforce anti-passback, pull the four events, suspend the three cards, and interview sponsors; (2) fix the alarm workflow because 1,140 held-open events with no dispositions means the data cannot support investigations; (3) review contractor sponsorship and add badge-sharing sanctions; (4) spend on multi-factor authentication at the six highest-consequence doors-north lobby, loading dock, data center, and critical riser rooms-rather than a blanket re-card. Re-carding 760 people without anti-passback and alarm discipline simply reissues shareable credentials. A defensible split is roughly $25,000 for firmware and analytics, $120,000 for six-door MFA, and $35,000 for staffing and training, with biometrics piloted only after privacy review.
2. Design a replacement alarm-response procedure for the north lobby and the metrics that would show it is working.
Read the worked answer
Treat the 38 alarms per day as a queue, not noise. Because they concentrate in a 50-minute window, the rate is roughly one alarm every 80 seconds at peak; one guard cannot investigate each on foot. The procedure should: send a 10-second video clip and turnstile image to the guard station on alarm; require acknowledgment within 20 seconds; classify the event as tailgate, forced entry, held-open, or equipment fault; challenge or dispatch a second officer within 90 seconds for a suspected tailgate; and record a disposition code with a case note for every event. A supervisor should review all 'unknown' outcomes and repeat-badge events at shift handover.
Add a temporary lobby host from 07:45 to 09:15 rather than buying another camera, because the data shows a peak-period supervision gap. Metrics should be median acknowledgment time, percentage of alarms with a disposition, alarms per 1,000 entries, repeat-card count, verified tailgates, and contractor sponsor reviews completed-not raw alarm count alone. Target a 50% reduction in raw alarms and more than 95% disposition completion after 60 days, with no increase in door-held-open duration. If guards still clear alarms with one click, the system is producing audit fiction rather than security information.
3. A contractor badge is found to have been used by a coworker at the loading dock. Outline the investigation and the policy changes you would recommend.
Read the worked answer
Preserve the PACS event history, video from the loading dock and north lobby, and the badge reader transaction sequence before anything is overwritten. Build a timeline for the three suspect cards, identify the cardholder and the person using it, and interview both separately with HR and the contractor's employer present. Suspend the badge and the sponsor's ability to request new badges pending review. Check whether the event is sharing, cloning, or a lost-card failure by comparing reader behavior, facility code use, and whether the card was also used elsewhere at the same time. Notify legal and data-protection staff before circulating images, and keep the investigation record access-controlled.
Policy changes should close the lifecycle gap: require contractors to sign a badge-use agreement with explicit sanctions for sharing; require sponsors to attest monthly that each contractor still needs access; integrate contractor roster termination dates with PACS so badges expire automatically; require lost or stolen badges to be reported within one hour; and audit a random sample of contractor badges each month. Add a rule that a sponsor's approval is revoked after two policy violations. The goal is not only to punish this incident but to make shared credentials detectable and unattractive.