1
00:00:00,090 --> 00:00:00,990
In this lesson,

2
00:00:00,990 --> 00:00:03,719
we're going to discuss access control vestibules.

3
00:00:03,719 --> 00:00:05,880
Now, one of the most effective physical security measures

4
00:00:05,880 --> 00:00:07,470
used by large organizations

5
00:00:07,470 --> 00:00:09,930
is the use of an access control vestibule.

6
00:00:09,930 --> 00:00:12,780
Now, an access control vestibule is a double-door system

7
00:00:12,780 --> 00:00:13,980
that's designed with two doors

8
00:00:13,980 --> 00:00:15,420
that are electronically controlled

9
00:00:15,420 --> 00:00:16,590
to ensure that only one door

10
00:00:16,590 --> 00:00:18,660
can be opened at a given time.

11
00:00:18,660 --> 00:00:21,090
This configuration prevents unauthorized entry

12
00:00:21,090 --> 00:00:23,370
while simultaneously providing a controlled space

13
00:00:23,370 --> 00:00:25,680
to validate the person's identity or credentials

14
00:00:25,680 --> 00:00:26,880
before granting them access

15
00:00:26,880 --> 00:00:29,730
to the organization's larger parts of the facility.

16
00:00:29,730 --> 00:00:31,800
Now, often, these access control vestibules

17
00:00:31,800 --> 00:00:33,000
are combined with other measures,

18
00:00:33,000 --> 00:00:35,220
like access badges and security personnel,

19
00:00:35,220 --> 00:00:37,620
to create a more comprehensive security framework.

20
00:00:37,620 --> 00:00:40,590
So let's take a look at how access control vestibules work

21
00:00:40,590 --> 00:00:42,270
as the first line of physical defenses

22
00:00:42,270 --> 00:00:43,230
against those who are trying

23
00:00:43,230 --> 00:00:45,750
to get into our organization's buildings.

24
00:00:45,750 --> 00:00:47,790
Now, whenever a person approaches your facilities,

25
00:00:47,790 --> 00:00:49,410
they're first going to enter the outer door

26
00:00:49,410 --> 00:00:51,180
of the access control vestibule.

27
00:00:51,180 --> 00:00:53,010
This door will then lock behind them

28
00:00:53,010 --> 00:00:54,690
to essentially trap them inside

29
00:00:54,690 --> 00:00:57,180
of this intermediate space between the untrusted area

30
00:00:57,180 --> 00:00:59,340
contained outside of our secure facilities

31
00:00:59,340 --> 00:01:00,600
and the inner, trusted area

32
00:01:00,600 --> 00:01:02,130
that contains all of our sensitive data

33
00:01:02,130 --> 00:01:04,140
and systems that we want to protect.

34
00:01:04,140 --> 00:01:05,940
Now, before they can open the inner door

35
00:01:05,940 --> 00:01:07,680
and access the sensitive area,

36
00:01:07,680 --> 00:01:10,770
our identity or credentials must be verified.

37
00:01:10,770 --> 00:01:12,900
This verification, once successful,

38
00:01:12,900 --> 00:01:14,520
will then let the inner door open

39
00:01:14,520 --> 00:01:17,220
and grant them access to the secured area.

40
00:01:17,220 --> 00:01:19,320
If the verification is not successful,

41
00:01:19,320 --> 00:01:21,840
that person will remains stuck inside the vestibule

42
00:01:21,840 --> 00:01:24,240
until the organization security personnel intervene

43
00:01:24,240 --> 00:01:25,770
and decide to either let them in

44
00:01:25,770 --> 00:01:28,440
or make them turn around, back out the outer door,

45
00:01:28,440 --> 00:01:30,180
and leave the facility.

46
00:01:30,180 --> 00:01:32,010
Access control vestibules provide us

47
00:01:32,010 --> 00:01:33,180
with a controlled environment

48
00:01:33,180 --> 00:01:34,710
where anybody who's trying to gain access

49
00:01:34,710 --> 00:01:36,240
to our organization's facilities

50
00:01:36,240 --> 00:01:38,790
can be screened, identified, and verified

51
00:01:38,790 --> 00:01:40,500
prior to being authorized to access

52
00:01:40,500 --> 00:01:43,260
our secure spaces inside of our buildings.

53
00:01:43,260 --> 00:01:45,690
Now, these access control vestibules can also help us

54
00:01:45,690 --> 00:01:48,150
to prevent piggybacking and tailgating.

55
00:01:48,150 --> 00:01:50,910
Piggybacking typically involves two people working together

56
00:01:50,910 --> 00:01:52,980
with one person who has legitimate access

57
00:01:52,980 --> 00:01:54,720
intentionally allowing another person

58
00:01:54,720 --> 00:01:56,310
who doesn't have proper authorization

59
00:01:56,310 --> 00:01:57,630
to enter a secure area

60
00:01:57,630 --> 00:01:59,340
to be able to go in with them.

61
00:01:59,340 --> 00:02:01,680
Often, piggybacking occurs because the attacker

62
00:02:01,680 --> 00:02:04,170
convinces an authorized employee to let them in

63
00:02:04,170 --> 00:02:05,670
by using some kind of social engineering

64
00:02:05,670 --> 00:02:07,290
or manipulation technique.

65
00:02:07,290 --> 00:02:10,080
For example, when I used to work as a penetration tester,

66
00:02:10,080 --> 00:02:12,150
I would often dress up as a delivery driver

67
00:02:12,150 --> 00:02:13,740
and approach an access control vestibule

68
00:02:13,740 --> 00:02:15,390
with several boxes in my hands

69
00:02:15,390 --> 00:02:17,190
and ask some unsuspecting employee

70
00:02:17,190 --> 00:02:18,510
to swipe their access badge

71
00:02:18,510 --> 00:02:20,730
so I can enter through the access control vestibule,

72
00:02:20,730 --> 00:02:22,830
even though I wasn't authorized to do so.

73
00:02:22,830 --> 00:02:23,730
Now, you'd be amazed

74
00:02:23,730 --> 00:02:25,200
at how often this simple version

75
00:02:25,200 --> 00:02:27,720
of social engineering and impersonation worked for me

76
00:02:27,720 --> 00:02:29,130
time and time again.

77
00:02:29,130 --> 00:02:30,510
If I had to quantify it,

78
00:02:30,510 --> 00:02:32,010
I would say that I was successful

79
00:02:32,010 --> 00:02:35,220
about 50% of the time, which is pretty good.

80
00:02:35,220 --> 00:02:36,660
Now, tailgating, on the other hand,

81
00:02:36,660 --> 00:02:38,790
is much more covert in nature.

82
00:02:38,790 --> 00:02:41,160
Tailgating occurs whenever an unauthorized person

83
00:02:41,160 --> 00:02:42,240
closely follows somebody

84
00:02:42,240 --> 00:02:43,890
through the access control vestibule

85
00:02:43,890 --> 00:02:45,420
who has legitimate access

86
00:02:45,420 --> 00:02:46,620
into that secure space

87
00:02:46,620 --> 00:02:48,480
without their knowledge or consent.

88
00:02:48,480 --> 00:02:50,910
For example, if you work in a secure office building

89
00:02:50,910 --> 00:02:51,870
that uses turnstiles

90
00:02:51,870 --> 00:02:53,940
as a form of access control vestibules,

91
00:02:53,940 --> 00:02:55,020
it would be pretty easy for me

92
00:02:55,020 --> 00:02:56,190
to sneak through the turnstile

93
00:02:56,190 --> 00:02:58,020
right after you swiped your access card

94
00:02:58,020 --> 00:02:59,160
to unlock that turnstile

95
00:02:59,160 --> 00:03:00,840
even without you knowing it.

96
00:03:00,840 --> 00:03:03,120
Now, many people get these two terms confused

97
00:03:03,120 --> 00:03:05,520
because they both refer to unauthorized entry,

98
00:03:05,520 --> 00:03:07,860
but there is a distinction between them.

99
00:03:07,860 --> 00:03:10,320
Piggybacking is usually going to involve

100
00:03:10,320 --> 00:03:12,360
authorized individuals allowing an attacker

101
00:03:12,360 --> 00:03:14,250
into a facility through complicity

102
00:03:14,250 --> 00:03:16,110
or some form of negligence.

103
00:03:16,110 --> 00:03:17,280
Tailgating, on the other hand,

104
00:03:17,280 --> 00:03:19,620
is a much more opportunistic type of attack

105
00:03:19,620 --> 00:03:21,870
that's used to gain access to the secured area

106
00:03:21,870 --> 00:03:23,460
by following an authorized individual

107
00:03:23,460 --> 00:03:25,050
through the access control vestibule

108
00:03:25,050 --> 00:03:27,180
without their knowledge or consent.

109
00:03:27,180 --> 00:03:29,340
Luckily, the use of access control vestibules,

110
00:03:29,340 --> 00:03:30,750
instead of a standard locked door,

111
00:03:30,750 --> 00:03:31,583
can really help us

112
00:03:31,583 --> 00:03:33,600
to prevent piggybacking and tailgating too,

113
00:03:33,600 --> 00:03:36,060
because, a lot of times, these access control vestibules

114
00:03:36,060 --> 00:03:38,760
are only large enough for a single person to walk through.

115
00:03:38,760 --> 00:03:40,950
And therefore, you can't piggyback or tailgate

116
00:03:40,950 --> 00:03:42,810
'cause there's simply not enough room.

117
00:03:42,810 --> 00:03:44,250
Now, you may have heard me mention

118
00:03:44,250 --> 00:03:46,740
that authorized personnel will usually have an access badge

119
00:03:46,740 --> 00:03:49,470
as a form of identification and verification

120
00:03:49,470 --> 00:03:50,970
as they're passing through a checkpoint,

121
00:03:50,970 --> 00:03:52,860
like an access control vestibule.

122
00:03:52,860 --> 00:03:54,840
Now, most access badges are designed

123
00:03:54,840 --> 00:03:57,300
to act as an individual's key to unlock doors,

124
00:03:57,300 --> 00:03:59,430
systems, or access control vestibules

125
00:03:59,430 --> 00:04:02,250
to gain access to a protected or secured space.

126
00:04:02,250 --> 00:04:04,350
These access badges are often equipped

127
00:04:04,350 --> 00:04:05,550
with embedded technologies,

128
00:04:05,550 --> 00:04:08,670
like RFID, or radio frequency identification,

129
00:04:08,670 --> 00:04:10,650
NFC, or near-field communication,

130
00:04:10,650 --> 00:04:13,080
or the older, legacy magnetic strips,

131
00:04:13,080 --> 00:04:14,880
like you have on the back of your credit card,

132
00:04:14,880 --> 00:04:16,470
in order to communicate with badge readers

133
00:04:16,470 --> 00:04:19,260
to authenticate the holder's identity and validate them

134
00:04:19,260 --> 00:04:20,970
as having the right access privileges

135
00:04:20,970 --> 00:04:22,860
for that specific area.

136
00:04:22,860 --> 00:04:24,840
Access badges work by having an employee

137
00:04:24,840 --> 00:04:26,700
present their access badge to a reader

138
00:04:26,700 --> 00:04:28,410
by sliding it through the magnetic reader

139
00:04:28,410 --> 00:04:29,820
or holding it close to the reader

140
00:04:29,820 --> 00:04:33,390
if you're using RFID or NFC-enabled access badges.

141
00:04:33,390 --> 00:04:35,430
These badges will provide detailed information

142
00:04:35,430 --> 00:04:36,300
about the person

143
00:04:36,300 --> 00:04:38,310
so the system can cross-reference their identity

144
00:04:38,310 --> 00:04:40,050
with a centralized database.

145
00:04:40,050 --> 00:04:42,600
If the access badge holder has the appropriate permissions

146
00:04:42,600 --> 00:04:44,190
for that given area or system,

147
00:04:44,190 --> 00:04:45,990
they will then be granted access.

148
00:04:45,990 --> 00:04:48,480
If they're not authorized, they'll be denied access

149
00:04:48,480 --> 00:04:50,460
or an alert will be sent to a security guard

150
00:04:50,460 --> 00:04:51,960
for further remediation.

151
00:04:51,960 --> 00:04:54,870
Usually, access badge access is a swift process

152
00:04:54,870 --> 00:04:56,400
that only takes a few seconds

153
00:04:56,400 --> 00:04:59,070
per individual walking through one of these checkpoints.

154
00:04:59,070 --> 00:05:00,690
Now, the great thing about access badges

155
00:05:00,690 --> 00:05:01,710
is that they can be programmed

156
00:05:01,710 --> 00:05:03,510
to grant different levels of access

157
00:05:03,510 --> 00:05:06,240
based on the individual's role within the organization.

158
00:05:06,240 --> 00:05:09,390
For example, I used to work at the National Security Agency

159
00:05:09,390 --> 00:05:12,150
and we used access badges on nearly every office door

160
00:05:12,150 --> 00:05:13,320
to prevent unauthorized people

161
00:05:13,320 --> 00:05:15,450
from accessing different offices.

162
00:05:15,450 --> 00:05:17,460
Even though a person might have a top-secret clearance

163
00:05:17,460 --> 00:05:18,990
to access the entire building

164
00:05:18,990 --> 00:05:21,480
going through that access control vestibule in the lobby,

165
00:05:21,480 --> 00:05:23,010
many of the individual offices

166
00:05:23,010 --> 00:05:24,720
had a separate access badge reader

167
00:05:24,720 --> 00:05:26,370
to provide a second level of verification

168
00:05:26,370 --> 00:05:27,630
for each office.

169
00:05:27,630 --> 00:05:30,150
For example, I worked in the cyber-defense area,

170
00:05:30,150 --> 00:05:32,160
and I was granted access to those offices,

171
00:05:32,160 --> 00:05:34,470
but since I wasn't hired as a translator,

172
00:05:34,470 --> 00:05:36,990
I couldn't access the foreign language translation offices

173
00:05:36,990 --> 00:05:39,870
because my badge didn't have those access rights.

174
00:05:39,870 --> 00:05:42,210
Also, every time you use your access badge

175
00:05:42,210 --> 00:05:44,730
to pass through a checkpoint or access control vestibule,

176
00:05:44,730 --> 00:05:46,710
this action is going to be logged.

177
00:05:46,710 --> 00:05:49,440
This logging of your access creates a nice audit trail

178
00:05:49,440 --> 00:05:51,060
that can be reviewed if a security breach

179
00:05:51,060 --> 00:05:52,800
or other concern is raised.

180
00:05:52,800 --> 00:05:54,810
Now, technology does play a significant role

181
00:05:54,810 --> 00:05:56,100
in modern security systems,

182
00:05:56,100 --> 00:05:59,130
but this human element cannot be understated.

183
00:05:59,130 --> 00:06:01,110
Most access control vestibules are set up

184
00:06:01,110 --> 00:06:02,520
at the entrance of the building,

185
00:06:02,520 --> 00:06:04,320
and they'll also have security guards stationed there

186
00:06:04,320 --> 00:06:06,930
at the front desk or at access control points

187
00:06:06,930 --> 00:06:08,550
to provide us with a visual deterrent,

188
00:06:08,550 --> 00:06:09,690
verification assistance,

189
00:06:09,690 --> 00:06:12,390
and an immediate response capability, if required,

190
00:06:12,390 --> 00:06:14,580
at those access control vestibules.

191
00:06:14,580 --> 00:06:17,430
Now, security guards do serve as a great visual deterrent

192
00:06:17,430 --> 00:06:20,220
because their mere presence can deter potential threats.

193
00:06:20,220 --> 00:06:22,110
These security guards also provide assistance

194
00:06:22,110 --> 00:06:23,910
with verification of your identity,

195
00:06:23,910 --> 00:06:25,943
especially if your electronic badging system fails

196
00:06:25,943 --> 00:06:28,230
or goes offline for some reason.

197
00:06:28,230 --> 00:06:30,450
Also, if a visitor arrives to your building,

198
00:06:30,450 --> 00:06:32,340
they're not going to have their own access badge,

199
00:06:32,340 --> 00:06:34,860
so that security guard can follow the procedures

200
00:06:34,860 --> 00:06:36,390
for checking the visitor's identity

201
00:06:36,390 --> 00:06:38,130
and granting them limited access to the building

202
00:06:38,130 --> 00:06:41,430
with a temporary badge per your organizational policies.

203
00:06:41,430 --> 00:06:43,530
Finally, our security guards also provide us

204
00:06:43,530 --> 00:06:45,120
with an immediate response capability

205
00:06:45,120 --> 00:06:47,370
in case a security breach is going to occur.

206
00:06:47,370 --> 00:06:48,990
In these cases, the security guards

207
00:06:48,990 --> 00:06:50,100
can provide an immediate response

208
00:06:50,100 --> 00:06:52,110
to determine whether they need to confront the intruder

209
00:06:52,110 --> 00:06:55,170
or initiate their emergency response protocols.

210
00:06:55,170 --> 00:06:57,330
So remember, an access control vestibule

211
00:06:57,330 --> 00:06:59,310
is a double-door system that is designed

212
00:06:59,310 --> 00:07:01,410
with two doors that are electronically controlled

213
00:07:01,410 --> 00:07:04,440
to ensure that only one door can be opened at a given time.

214
00:07:04,440 --> 00:07:06,840
These access control vestibules are usually integrated

215
00:07:06,840 --> 00:07:09,210
with electronic badges and operated by security guards

216
00:07:09,210 --> 00:07:12,360
at the entrance to your secure facility or office building.

217
00:07:12,360 --> 00:07:14,820
These access control vestibules, access badges,

218
00:07:14,820 --> 00:07:17,130
and security guards create a multi-layered approach

219
00:07:17,130 --> 00:07:19,080
to increasing our physical security.

220
00:07:19,080 --> 00:07:21,000
Each component compliments the other ones

221
00:07:21,000 --> 00:07:22,500
to ensure the potential vulnerabilities

222
00:07:22,500 --> 00:07:24,030
are going to be minimized.

223
00:07:24,030 --> 00:07:25,440
As threats continue to evolve,

224
00:07:25,440 --> 00:07:26,580
it's essential to understand

225
00:07:26,580 --> 00:07:28,890
how these access control vestibule systems work

226
00:07:28,890 --> 00:07:30,090
and continually refine them

227
00:07:30,090 --> 00:07:31,920
to ensure that our facilities remain secure

228
00:07:31,920 --> 00:07:33,360
and accessible only to those

229
00:07:33,360 --> 00:07:35,163
with the correct access permissions.