In this lesson,
we're going to discuss access control vestibules.
Now, one of the most effective physical security measures
used by large organizations
is the use of an access control vestibule.
Now, an access control vestibule is a double-door system
that's designed with two doors
that are electronically controlled
to ensure that only one door
can be opened at a given time.
This configuration prevents unauthorized entry
while simultaneously providing a controlled space
to validate the person's identity or credentials
before granting them access
to the organization's larger parts of the facility.
Now, often, these access control vestibules
are combined with other measures,
like access badges and security personnel,
to create a more comprehensive security framework.
So let's take a look at how access control vestibules work
as the first line of physical defenses
against those who are trying
to get into our organization's buildings.
Now, whenever a person approaches your facilities,
they're first going to enter the outer door
of the access control vestibule.
This door will then lock behind them
to essentially trap them inside
of this intermediate space between the untrusted area
contained outside of our secure facilities
and the inner, trusted area
that contains all of our sensitive data
and systems that we want to protect.
Now, before they can open the inner door
and access the sensitive area,
our identity or credentials must be verified.
This verification, once successful,
will then let the inner door open
and grant them access to the secured area.
If the verification is not successful,
that person will remains stuck inside the vestibule
until the organization security personnel intervene
and decide to either let them in
or make them turn around, back out the outer door,
and leave the facility.
Access control vestibules provide us
with a controlled environment
where anybody who's trying to gain access
to our organization's facilities
can be screened, identified, and verified
prior to being authorized to access
our secure spaces inside of our buildings.
Now, these access control vestibules can also help us
to prevent piggybacking and tailgating.
Piggybacking typically involves two people working together
with one person who has legitimate access
intentionally allowing another person
who doesn't have proper authorization
to enter a secure area
to be able to go in with them.
Often, piggybacking occurs because the attacker
convinces an authorized employee to let them in
by using some kind of social engineering
or manipulation technique.
For example, when I used to work as a penetration tester,
I would often dress up as a delivery driver
and approach an access control vestibule
with several boxes in my hands
and ask some unsuspecting employee
to swipe their access badge
so I can enter through the access control vestibule,
even though I wasn't authorized to do so.
Now, you'd be amazed
at how often this simple version
of social engineering and impersonation worked for me
time and time again.
If I had to quantify it,
I would say that I was successful
about 50% of the time, which is pretty good.
Now, tailgating, on the other hand,
is much more covert in nature.
Tailgating occurs whenever an unauthorized person
closely follows somebody
through the access control vestibule
who has legitimate access
into that secure space
without their knowledge or consent.
For example, if you work in a secure office building
that uses turnstiles
as a form of access control vestibules,
it would be pretty easy for me
to sneak through the turnstile
right after you swiped your access card
to unlock that turnstile
even without you knowing it.
Now, many people get these two terms confused
because they both refer to unauthorized entry,
but there is a distinction between them.
Piggybacking is usually going to involve
authorized individuals allowing an attacker
into a facility through complicity
or some form of negligence.
Tailgating, on the other hand,
is a much more opportunistic type of attack
that's used to gain access to the secured area
by following an authorized individual
through the access control vestibule
without their knowledge or consent.
Luckily, the use of access control vestibules,
instead of a standard locked door,
can really help us
to prevent piggybacking and tailgating too,
because, a lot of times, these access control vestibules
are only large enough for a single person to walk through.
And therefore, you can't piggyback or tailgate
'cause there's simply not enough room.
Now, you may have heard me mention
that authorized personnel will usually have an access badge
as a form of identification and verification
as they're passing through a checkpoint,
like an access control vestibule.
Now, most access badges are designed
to act as an individual's key to unlock doors,
systems, or access control vestibules
to gain access to a protected or secured space.
These access badges are often equipped
with embedded technologies,
like RFID, or radio frequency identification,
NFC, or near-field communication,
or the older, legacy magnetic strips,
like you have on the back of your credit card,
in order to communicate with badge readers
to authenticate the holder's identity and validate them
as having the right access privileges
for that specific area.
Access badges work by having an employee
present their access badge to a reader
by sliding it through the magnetic reader
or holding it close to the reader
if you're using RFID or NFC-enabled access badges.
These badges will provide detailed information
about the person
so the system can cross-reference their identity
with a centralized database.
If the access badge holder has the appropriate permissions
for that given area or system,
they will then be granted access.
If they're not authorized, they'll be denied access
or an alert will be sent to a security guard
for further remediation.
Usually, access badge access is a swift process
that only takes a few seconds
per individual walking through one of these checkpoints.
Now, the great thing about access badges
is that they can be programmed
to grant different levels of access
based on the individual's role within the organization.
For example, I used to work at the National Security Agency
and we used access badges on nearly every office door
to prevent unauthorized people
from accessing different offices.
Even though a person might have a top-secret clearance
to access the entire building
going through that access control vestibule in the lobby,
many of the individual offices
had a separate access badge reader
to provide a second level of verification
for each office.
For example, I worked in the cyber-defense area,
and I was granted access to those offices,
but since I wasn't hired as a translator,
I couldn't access the foreign language translation offices
because my badge didn't have those access rights.
Also, every time you use your access badge
to pass through a checkpoint or access control vestibule,
this action is going to be logged.
This logging of your access creates a nice audit trail
that can be reviewed if a security breach
or other concern is raised.
Now, technology does play a significant role
in modern security systems,
but this human element cannot be understated.
Most access control vestibules are set up
at the entrance of the building,
and they'll also have security guards stationed there
at the front desk or at access control points
to provide us with a visual deterrent,
verification assistance,
and an immediate response capability, if required,
at those access control vestibules.
Now, security guards do serve as a great visual deterrent
because their mere presence can deter potential threats.
These security guards also provide assistance
with verification of your identity,
especially if your electronic badging system fails
or goes offline for some reason.
Also, if a visitor arrives to your building,
they're not going to have their own access badge,
so that security guard can follow the procedures
for checking the visitor's identity
and granting them limited access to the building
with a temporary badge per your organizational policies.
Finally, our security guards also provide us
with an immediate response capability
in case a security breach is going to occur.
In these cases, the security guards
can provide an immediate response
to determine whether they need to confront the intruder
or initiate their emergency response protocols.
So remember, an access control vestibule
is a double-door system that is designed
with two doors that are electronically controlled
to ensure that only one door can be opened at a given time.
These access control vestibules are usually integrated
with electronic badges and operated by security guards
at the entrance to your secure facility or office building.
These access control vestibules, access badges,
and security guards create a multi-layered approach
to increasing our physical security.
Each component compliments the other ones
to ensure the potential vulnerabilities
are going to be minimized.
As threats continue to evolve,
it's essential to understand
how these access control vestibule systems work
and continually refine them
to ensure that our facilities remain secure
and accessible only to those
with the correct access permissions.