What happened?
In a guest article in Protector Magazin, Achim Schmidt, End User Business Development Manager at HID, explains how mobile access solutions are replacing traditional access control based on physical cards. Instead of RFID cards or badges, employees will increasingly use their smartphones to operate doors, lockers, printers, e-charging stations, fleet vehicles, or even snack machines. The digital identity is stored in a wallet or a company-specific app.
According to the article, physical access cards have become practically obsolete in mobile access environments. The piece highlights both the security-related and financial advantages of this shift.
The details
A key argument in favor of mobile access is the elimination of risks associated with stolen, lost, or shared access cards. Smartphones already come equipped with native security mechanisms such as PIN codes, facial recognition, or fingerprint sensors. Even if a device is shared, the article notes that multi-layered security controls can be implemented, such as biometric scanners at checkpoints in critical environments like airports, banks, or data centers.
There are also advantages for administration: access permissions can be managed centrally and granted or revoked within seconds. By comparison, reconfiguring or collecting key cards in traditional systems is significantly more labor-intensive. The article also emphasizes scalability: new employees or entire locations can be integrated into the system almost in real time.
Technical interplay as a prerequisite
The article stresses that a holistic mobile access solution is more than simply providing digital keys on a smartphone. Maximum security only results from the orchestrated interaction of the following components:
- Access readers with wireless technology such as Bluetooth Low Energy (BLE) and Near Field Communication (NFC) for secure communication between the smartphone and the access point
- Encrypted transmission protocols, current security standards, and update capability to ensure long-term investment security
- Hybrid-capable readers that can process both traditional RFID cards and digital credentials
- A central controller that processes identity data and controls doors and readers – with encrypted communication, for example via OSDP Secure
- Cloud-capable devices that enable firmware updates and feature enhancements without hardware replacement
- A cloud-based platform for managing digital identities
As a foundation, the article cites a stable, secure IT infrastructure: a segmented IP network, encrypted communication, strict certificate management, and clearly defined firewall and cloud rules. In addition, mechanisms such as device binding, biometrics, secure element storage, and audit functions are deemed necessary.
Context
The relevance of the topic is underscored in the article with reference to the NIS2 Directive. Since it took effect, numerous companies now fall under the category of critical infrastructure and must design their access control in accordance with NIS2 requirements. According to the article, inadequate security measures can, in the worst case, result in substantial fines.
As a result, mobile access is presented not only as a gain in convenience and security but also as a response to regulatory requirements that operators of critical infrastructure – for example in data centers or financial institutions – must meet.
Financial aspects
Alongside security, the article explicitly focuses on cost savings. Eliminating physical RFID cards removes expenses for production, personalization, and shipping – in other words, material and logistics costs. At the same time, administrative effort decreases, since credentials can be generated automatically from HR systems and linked directly to onboarding and offboarding processes.
Further potential savings mentioned include:
- No costs for replacing lost cards or badges, since they no longer need to be reproduced
- More environmentally friendly processes by eliminating physical card production
- Longer investment cycles for cloud-capable controllers, since new features can be rolled out via firmware updates instead of hardware replacement
- Higher administrator productivity through remote administration, reducing the need for on-site presence
Practical tips
The following recommendations can be derived from the article for companies planning a transition to mobile access:
- When selecting access readers, ensure support for current wireless standards (BLE, NFC) as well as update capability to guarantee investment security
- Plan for hybrid-capable readers that can process both RFID cards and digital credentials to enable a gradual migration
- Use controllers with encrypted communication (for example, OSDP Secure) and cloud capability to enable firmware updates without hardware replacement
- Secure the IT infrastructure as a foundation: segmented network, encryption, certificate management, and clear firewall rules
- Consider additional security mechanisms such as device binding, biometrics, secure element storage, and audit functions
- Review NIS2 requirements early if your own company falls under critical infrastructure regulations
Outlook
The article makes clear that mobile access should not be understood as an isolated technology, but as an overall system comprising hardware, network, cloud identity management, and IT processes. According to the article, companies that seamlessly integrate all these components, both technically and organizationally, can operate a resilient, scalable, and future-proof access control solution.
Given regulatory requirements such as NIS2 and the cost advantages outlined, pressure on companies to modernize existing access control systems is likely to increase. The ability described in the article to retrofit functions via firmware updates makes it easier to transition gradually, without having to completely replace existing hardware.
