Building Converged Access for Enterprise Security
Most large organisations run two identity systems for the same employee. Facilities issues a badge that opens doors. On the IT side, that person also gets a login and an authenticator app. Separate teams own each one, and the two rarely change at the same moment.
Converged access puts both on one credential. The same smart card that opens the building signs its holder in to their laptop and cloud apps. For enterprise security teams managing dozens of sites, it closes a gap that widens with each new building and staff change.
The problem with two separate ID systems
Joiners and leavers get handled twice
When physical and logical access run apart, every staff change goes through two teams. A new hire can wait days for a badge after their laptop arrives. A departing contractor can lose network access on their last day and keep a working badge for weeks.
Why passwords and codes fall short
Passwords add a second risk. They can be phished or reused, and a stolen one works from anywhere in the world. Authenticator codes help, but modern phishing kits can relay them to an attacker in real time.
What a converged credential does
A converged credential is a smart card or security key that carries two kinds of protection. One part handles doors, using encrypted contactless technology such as MIFARE DESFire. The other handles sign-in, using public key cryptography.
How FIDO2 protects sign-in
On the sign-in side, the key standard is FIDO2. A FIDO2 credential holds its private key on the card, and that key never leaves it.
When a user signs in, the service checks a signature the card produces. Each service gets its own key pair, so a fake login page has nothing worth stealing. PIV, the US federal smart card standard, applies the same principle to Windows smart card logon and certificate-based access.
One card for the building and every account
A SecurePass DUO card combines FIDO2 with DESFire, giving employees one card for the building and their accounts. It connects over NFC to phones and tablets, or through a card reader at a desk.
Matching credentials to risk
Different users need different levels of assurance. For general staff, the DUO card covers doors and everyday sign-in. Administrators and other privileged users are better served by a FIDO2 smart card, which is FIPS 140-3 certified and adds PIV and OpenPGP support alongside FIDO2.
Securing the door side
Encrypt reader traffic with OSDP
The door deserves the same care as the desktop. Readers should connect to their controllers over OSDP with Secure Channel switched on, so card data travels encrypted. Mx controllers support this from Velocity 3.8 onwards.
Store credentials at scale
Head offices and campuses with large user populations need room for every credential. With the SNIB3 network board fitted, a single Mx controller can store up to 500,000 PIV credentials locally at the door hardware.
Running it across the estate
One audit trail across every site
Converged access pays off at scale, and scale needs central management. Velocity, a security management system, runs access control across hundreds of facilities, from a single high-security room up to multi-building, multi-location campuses.
Operators work through a browser on almost any device, and door events across the estate land in a single audit trail. When a credential is revoked, the record of who changed it and when sits where auditors can find it.
Where to start
Pilot with your highest-risk users
IT administrators make a good first group, since attackers target their accounts first and they can give technical feedback early. Pair them with your most sensitive doors, such as the data centre and executive floors.
Roll out site by site
From there, move one building at a time, retiring passwords and old badges as each one switches over. Agree early who owns the credential lifecycle. Converged access works best when IT and facilities run joiners and leavers as a single process.
Plan for lost credentials
Plan the lost-credential process before the pilot starts. Issuing each user a backup key alongside their primary card is standard practice with FIDO2, since a missing credential otherwise locks someone out of the building and their accounts. Agree who issues the replacement and how quickly, then settle interim access while the old credential is revoked.
Conclusion
Converged access closes the gap between the badge and the login. Staff carry one credential, and IT and facilities work from one record of who can go where. For organisations planning the move,solutions as Hirsch’s enterprise security solutions cover the credentials people carry as well as the controllers and software behind every door.
