EDIT article 3 apr14_riskuk_apr14 01/04/2014 00:43 Page 3
Key management
of key management solutions.” He thinks that software should provide a wide variety of customisation possibilities, both to meet the individual needs of the users and to comply with any relevant regulations for the locality or the industry where they are being used. Systems should also be scalable and modular to enable users to customise to their needs. In addition, the cabinets themselves should be rugged and resistant to tampering. Another part of the purchasing process involves future proofing the system and Pires says that users should be sure to choose a provider “who offers scalable, upgradable solutions with a demonstrated migration path from legacy systems.” For Cassady, the most important first step is to conduct a full audit of what you think you need, then talk to all levels or staff about vulnerable areas and short cuts taken both procedurally and physically. That makes good sense as human nature means that people will use systems and products that make their role easier and they will resist implementation without consultation. He says: “Not only is the input from all staff members vital for pinpointing security risks that might otherwise be missed, they will also be much more likely to take up a new procedure if they feel they were involved in the decision making process.” Beyond providing good products, Pires says the supplier should have a strong reputation for quality, durability and customer support: “Anyone investigating key management companies should look for positive references from other customers to verify this reputation.” He adds that the company should be able to demonstrate that they provide comprehensive support services and maintain a wellestablished and knowledgeable dealer network. Cassady also says that it is important to purchase high quality products from a reputable supplier that meets the requirements but adds that an installer should be able to ‘fit and forget’ solutions with minimal servicing. Buyers should look to buy equipment that meets certain standards. Cassady says that systems with locking mechanisms should have been rigorously testing to both UL and EN1300: “The procedures will test against manipulation, forced entry and random code generation.” His systems comprise of a control safe racked out with master keys and full audit lock, working in tandem with simpler key vault units, that can be integrated into existing master key systems which leads neatly onto the issue of integration. Integration with other security systems is important because as Pires puts it, “in today’s
increasingly integrated environment, no system can stand alone - key control has to provide security and business intelligence that is useful to management in addition to its basic utility of securing and controlling keys.” As with other business systems like human resources, fleet management and logistics, a good security system should be open and interoperable with other relevant systems. For example, when an employee is terminated, their key access privileges should automatically terminate at the same time and Pires thinks that creating this kind of interaction between departments is a great asset to security. Cassady reasons that if you can link key control with existing systems and restrict
Oldham Council First Response Service Team Oldham is the administrative centre for the Borough of Oldham and part of the Borough of Greater Manchester. Local safety is protected by the Manchester constabulary and by the services provided by the Oldham Council First Response Service team that monitors the public space video surveillance cameras and various alarm systems. The service also maintains the security of public buildings and other critical infrastructure facilities. When an alarm is triggered from any of the 500 plus properties under the services’ watch, operators try to notify key holders to respond. If an owner/key holder cannot be located, the service team will respond. Controlling and storing the hundreds of keys at various locations throughout the command centre was a manual procedure and the systems in place ranged from wall mounted key safes with a single lock on them to vehicle-mounted cabinets. Plastic ID access cards and key fobs were stored in a plastic box and kept in the control room. A manual logbook was used to keep track of key access and return with only an honour system in place to ensure the recording activity. The service was unable to keep track of sets of keys and found it a common occurrence for the staff to go home with keys in their pockets or leave keys in the vehicles. With shift patterns it could be up to four days before they returned, with the keys, for their next shift. The solution for Oldham was Morse Watchmans KeyWatcher automated key control and asset management system. The system comprises three 96-key cabinets and one 8-key cabinet. The smaller key cabinet is used to house the vehicle keys and the larger cabinets house all other keys. All staff has access to the four cabinets but not access to all the keys. Staff can only remove a key to which they are authorised to use by entering his or her pre-programmed PIN code or, on the larger cabinets by swiping their ID card through the integrated card reader. The system also allows management to set user restrictions or parameters for optimum key control and management.
33 www.risk-uk.com