Facilities

Facilities

Large enterprises demonstrate the need to have a coordinated, cohesive approach for the overall administration and operation of their physical access control systems.

A case in point is the U.S. Department of Homeland Security (DHS), which operates in buildings and other facilities owned by the government, in leased spaces, and in contractorprovided facilities.

DHS also provides directives to other U.S. government agencies, and organizations that support those agencies, about meeting their roles in critical infrastructure protection. In doing so, DHS' approach to PACS demonstrates the application of several security concepts, access control models and techniques.

PACS, as used by DHS, are divided into four areas that operate independently at the direction of the PACS administrator:

Identification

Requires an individual's personally identifiable information (PII) so it can authorize physical access to the facilities. PACS sensors read the information on an individual's personal identity verification (PIV) card to verify access.

Visitor management

Visitors and construction and service contractors who have not been issued a PIV card must be identified before being granted access.

PACS issues and tracks parking permits and determines eligibility. Upon issuance, personnel enters name and email address of the permit holder, the permit number and type, issue date, and expiration.

Alarm monitoring and intrusion detection

The alarm monitoring application allows personnel to monitor the intrusion detection system (IDS). A record is created of all IDS alarm activations or other issues, such as communication and power failures. The IDS consists of sensors, lights, and other mechanisms through which the security officer can detect the unauthorized intrusion of persons or devices. The only PIl collected by the PACS IDS suite is the first and last name of the individual authorized to activate or deactivate the alarm system and the corresponding PIN the individual enters on the keypad.

You'll note that it seems as if DHS views the controlling of access to physical facilities as a separate and distinct set of problems requiring separate policies, rather than providing access control to information systems.