Access Control Vestibules

(OBJ 1.2)

Double-door system that is designed with two doors that are electronically controlled to ensure that only one door can be open at a given time
Access control vestibules are combined with other measures to create a comprehensive security framework
Before they can open the inner door, identity has to be verified, if it is not verified the person will be trapped until security personnel intervenes
Provide a controlled environment for anyone trying to access an organization's facilities

These access control vestibules can also help prevent piggybacking and tailgating
Piggybacking
- Involves two people working together with one person who has legitimate access intentionally allows another person who doesn't have proper authorization to enter a secure area with them
- Often occurs because an attacker convinces an employee to let him in by using some kind of social engineering technique
  - Think of the pizza deliverer
Tailgating
- Occurs whenever an unauthorized person closely follows someone through the access control vestibule who has legitimate access into the secure space without their knowledge or consent
The key difference between Piggybacking and Tailgating
- Piggybacking uses social engineering to gain consent of the person with legitimate access
- Tailgating doesn’t use or obtain the consent of the person with legitimate access, it is more of an opportunistic kind of attack.
With access control vestibules there is very little room for 2 persons to fit in the cage, which prevents both piggybacking and tailgating

Access control vestibules are usually integrated with electronic badges and operated by a security guard at the entrance to a secure facility or office building
Badges contain
- RFID (Radio-Frequency Identification)
- NFC (Near-field Communication)
- Magnetic strips
They work by having an employee present their access badge to a reader by sliding or holding close to it
These badges will provide detailed information about the person so the system can cross-reference their identity with a centralized database.
Only takes a few seconds per individual
Every time an access badge is used, the action is logged
- Creates a nice audit trail that can be reviewed in case of a security breach