Wednesday, January 24, 2007

There is no physical access control.

I was thinking about the difficulty of accurately testing physical controls and identity today. People let people in areas based on a system of signals that indicate they are safe/authorized: badge, biometric (face, voice), dress (uniform, hard hat, clipboard). Gradations in each of these attributes build to the decision to grant access. I was also thinking about how lousy this system works. Every security consultant brags about how they can get in any building by just looking like they belong there. But how hard can it be?

For example, this disturbing story about a 29 year old sex offender who enrolled in middle school. Horrific, insane, and befuddling. He shows up with a fake birth certificate and some seriously perverted "grandpa" and he's in. So long as he does his homework and show up for class.

I give up. There is no physical access control. I refuse to believe in it anymore.

No comments: