The badge nobody turned off

Every organization with badges has an offboarding step that says collect the card, and almost every one treats that step as the end of the physical access question. It is a reasonable belief and it is the wrong object. The card is a token that carries a number. What opens the door is a record in an access system saying that number is allowed, and that record is untouched by the plastic changing hands.

So the interesting question is not whether the card came back. It is what happened to the record, in every system that holds a copy of it, and how long the gap was. At most sites nobody has ever been asked, which is why the answer is worth finding out before somebody else does.

Why does a returned badge leave the access open?¶

A returned badge leaves access open because the two facts live in different systems and nothing joins them. Termination is recorded by whoever runs payroll and onboarding. Door permission is held in an access control platform, usually administered by facilities or by a contractor, frequently on a server in a closet that the IT team does not consider theirs. The join between those two is a human being remembering to send a message.

That works while the organization is small enough for one person to know everyone. It degrades in a specific and predictable way: it survives the planned departures, where there is an exit interview and a checklist, and it fails on the unplanned ones, which are the departures where revocation matters. A resignation with four weeks of notice gets processed. A dismissal on a Friday afternoon gets processed on Monday, if the person who does it is in.

The second copy is the one people forget. Contractor badges, temporary credentials issued at a front desk, a visitor card that was never returned to the pool, and the credential issued to somebody who changed roles rather than left. None of those has a termination event to hang the revocation on, so none of them is reached by a process built around leavers.

What does the panel do when the server is unreachable?¶

A door controller with no route to the head end falls back to a list it already holds, and it opens doors from that list. This is not a defect. It is the property the system was bought for, because the alternative is a building where a network outage locks everybody out of their own offices, and the fire code has views about that.

The consequence is that revocation is not an event, it is a propagation. A permission removed at the head end reaches a controller when that controller next syncs, and a controller that has been offline since Tuesday is still holding Tuesday's answer. Nothing about this is visible from the administrative screen, which shows the intended state rather than the distributed one. The screen says removed. The door says yes.

Ask two questions of whoever maintains the system. How long, at most, between a change at the head end and that change being true at the furthest door. And what the system does when that sync has not happened for a week: does it report the staleness anywhere, or does it continue regardless. The second question is the one that separates a platform that can be audited from one that can only be believed.

What is on the wire between the reader and the panel?¶

On most installed sites the reader-to-panel link is Wiegand, which sends a card number as a sequence of pulses with no encryption, no authentication and no supervision of the line itself. A device spliced into that run can read every number that crosses it and can present a number of its own, and the panel has no means of telling the difference, because the protocol gives it none.

The replacement exists and is not new. OSDP, the Open Supervised Device Protocol (opens in a new tab) carries a secure channel. The Security Industry Association describes it as "high-end AES-128 encryption (required in federal government applications)", and says the protocol "constantly monitors wiring to protect against attack threats". It communicates in both directions rather than one. The IEC approved it as an international standard in May 2020 and published it as IEC 60839-11-5:2020.

The reason this belongs in an argument about revocation is that supervision and bidirectionality are what make a door answerable. A one-way protocol cannot report that a reader was removed from the wall, cannot confirm that a credential list arrived, and cannot be asked anything. Replacing it is a capital project rather than an afternoon, and it does not have to be done everywhere at once. It has to be done at the doors where the answer matters.

Is this over-engineering for a building with one door?¶

For a single-tenant office with one controlled entrance and twelve staff, most of this is over-engineering and saying otherwise would be selling. One person knows everyone, the list is short enough to read, and a quarterly look at the credential list finds anything that has gone wrong. The argument earns its cost somewhere specific, and it is worth naming the threshold rather than implying it is universal.

Three conditions make it real, and one is usually enough. The site has doors that protect something other than office furniture, such as a plant floor, a pharmacy cupboard, a server room or a bonded store. The population includes people the organization does not directly employ, because contractors and agency staff are where the credential lifecycle has no owner. Or there is an auditor, an insurer or a customer who will at some point ask for evidence rather than assurance.

Where none of those holds, collect the card and keep the list short. Where one of them holds, the cost of finding out during an incident is the entire reason to find out now.

The audit that settles it¶

Take five people who left in the last twelve months, chosen to include at least one contractor and at least one unplanned departure. For each, ask the access platform a single question per controlled door: would this credential be accepted at this reader right now. Not was it removed. Would it be accepted.

Three outcomes are possible and each tells you something different. The system answers in minutes and every answer is no, which means the process works and you now have evidence of it rather than a belief. The system answers and some answer is yes, which is a finding with a name, a door and a date attached. Or the system cannot answer the question in the form it was asked. That is the most common result and the most useful one: a platform that cannot report its own effective state cannot be audited by anybody, including the people relying on it.