Access Control
Purpose
Access control ensures only authorized people, vehicles, and materials enter, move within, or leave a protected area. It rests on three ideas: identification, verification, and authorization - who are you, is that true, and are you allowed here now?
Key concepts
- Credentials: badges, key cards, PINs, biometrics. Distinguish something you have (card), something you know (PIN), and something you are (biometric).
- Tailgating and piggybacking: tailgating is following an authorized person through a door without their knowledge; piggybacking is with their consent. Both are breaches; the fix is one person per swipe and polite challenge.
- Challenge politely: "May I see your badge?" is the standard. Escalate if refused.
- Visitor management: sign-in, ID check, escort rules, visitor badge, sign-out.
- Need-to-know and least privilege: access should be the minimum required for the job.
- Logs and audits: access records support investigations; incomplete logs are a finding.
Traps
- Believing a friendly face means no check - familiarity is not authorization.
- Assuming a valid badge means valid access to this area.
- Letting a delivery driver or contractor in "just this once."
- Confusing tailgating (unwitting) with piggybacking (witting).
Worked example
A person in a company jacket walks in behind an employee who badged in. Best action: politely stop the second person, ask for their badge, verify access, and direct them to sign in if they lack one. Rule of thumb: One badge, one person; when in doubt, verify.