Sailing Through Security

Port authorities look to TWIC as a common identity credential

SINCE the terrorist attacks of 9/11, the federal government has begun implementing new security procedures at U.S. ports. Designed to fill security gaps and prevent acts of terrorism, these new regulations have accelerated the development of revolutionary physical access control (PAC) strategies and technology. The new approach replaces isolated physical access control systems, or systems limited to one facility, with a comprehensive and interoperable framework that can scale to support many sites.

New smart card technology has enabled the development of a single, common credential and thus, a consistent level of trust among disparate ports. In order to maximize smart card investments, ports must ensure deployed card readers can support rapidly changing smart card requirements.

A Common Credential
To address potential security weaknesses in U.S. transportation modes, the Transportation Security Administration began testing a system-wide credential for transportation workers requiring unescorted physical and/or logical access to secure areas of the U.S. transportation system. The program and credential, known as the Transportation Workers Identification Credential, was tested during the prototype phase at 28 sites in three geographic areas between late 2004 and June 2005.

TWIC is a non-transferable smart card that contains biometric information unique to the cardholder. The TWIC card enables port facilities to verify the identity of a worker and prevent unauthorized individuals from gaining access to restricted areas. Moreover, the TWIC program requires ports and other transportation sites to standardize on a common credential and eliminate the need for port workers to carry multiple identification cards. In the eventual nationwide rollout, more than 12 million workers across all transportation modes, including seaports, ships, airports, rail, bus and pipelines will possess a TWIC card.

By definition, a credential entitles a person to confidence, credit or authority. Historically, ports have relied on a guard simply looking at a driver's license to verify a worker's identity. In more sophisticated environments, proximity cards or badges have been used as an automated method for verifying an employee's identity and access privileges. A proximity card functions in a read-only mode, supplying a static, factory-loaded identity number. User registration requires entering the card's serial number into a PAC system's access control list, linking a particular card number to an employee and determining that employee's access rights to the facility. Proximity cards can be transferred to another employee by changing the name and access rights in the central system.

In Close Proximity
While a proximity card system is easy to manage and implement, it is a particularly weak and flawed approach to security, as proximity cards can easily be lost, borrowed or stolen. More importantly, proximity cards do not require strong authentication for identity verification of the cardholder. This means that anyone can pick up another employee's proximity card and use it to access secured sites and sensitive data.

Many facilities issue their own proximity cards, making the card useless at other facilities because there is no chain of trust that can be linked back to the card issuer. If a worker needs unescorted access at another port or terminal, he or she will likely need to be issued a separate card specific to the second location, oftentimes with the same set of access rights as his or her previously issued card. This redundancy wastes time and money, and negatively impacts worker productivity.

System configurations for proximity card-based access control systems are straightforward; readers connect to a physical access controller that receives and processes all reader requests, including the granting of access and unlocking of doors or opening of gates. In more advanced configurations, the PAC system's controller is subordinate to a security management server that also monitors alarms and video surveillance. The TWIC approach provides a way to leverage existing physical access control and security infrastructures while replacing weak proximity card-based systems with interoperable smart card-based credentials.

Biometrics Step In
Biometrically enabled smart cards, such as the TWIC card, can be used to irrefutably prove that the cardholder is the person to whom the card was issued. To gain access to a secured site, a TWIC cardholder passes their biometric smart card near a contactless reader and touches a sensor that scans his or her fingerprint. If the submitted fingerprint matches the fingerprint data stored on the smart card, the worker is confirmed to be the legitimate cardholder. Next, an access request for this unique card is sent to the PAC system. The PAC system can determine if the card is still valid by checking the unique cardholder number against a list of revoked or expired credentials. The PAC system will then determine if this person has privileges to enter the facility through this particular gate or door, and at this particular time and date. If each of these steps is confirmed, the door will then automatically unlock to permit unescorted entry to the facility.

While the process sounds very complex, it is actually very fast -- taking less than two seconds -- and it's easy for the port worker to use. By implementing a common standards-based, biometrically-enabled smart card for all workers requiring unescorted access to sensitive transportation facilities across U.S. transportation modes, businesses can achieve interoperability between facilities, much higher levels of security and eliminate multiple badging systems that are redundant and costly.

A Port Worker's Identity
It may take many months for all port facility workers to be issued a TWIC card. However, many ports and terminal operators would like to take advantage of advanced smart card and biometric technology immediately to better secure facilities now and prepare to quickly transition to the TWIC card when it becomes available. But the data models and software may be different between the two implementations.

To accommodate such a transition, ports and terminals should consider more sophisticated smart card/biometric readers that support a flexible data and software model. Some smart card readers are designed to support a single card data format and application software, and any change requires a major system overhaul. In fact, updating a reader to support new card data formats and software can be very expensive, requiring an on-site technician visit with component swap and re-attach. To further maximize port technology investments, readers should be easy to upgrade remotely using standard network communication protocols such as TCP/IP. Such an advanced reader can even be programmed dynamically to require additional authentication factors, such as a biometric plus a PIN in times of elevated threat levels.

In addition to remote administration and enhanced security capabilities, physical access smart card/biometric readers also should be flexible enough to be used in both indoor and outdoor environments. Many entry points in port facilities are outdoors and exposed to the extremes of heat, cold, dust, moisture, salt and vibration. Due to these demanding environmental conditions at most seaports, TWIC technology providers developed a smart card/biometric reader that is capable of withstanding extreme weather, including dust and moisture.

In a deployment for Florida's seaport gate control project, Saflink Corp. began implementing a TWIC-compliant smart card/biometric reader to enhance physical access security at the state's 12 deepwater seaports. The initial installation included more than 1,000 fixed-mount smart card biometric readers at port vehicle and pedestrian entry gates and doors. This approach allows critical facilities to respond to heightened security events more efficiently.

Advances in smart cards and supporting readers have made it easy for ports to increase security quickly and further refine security practices. Large-scale smart card implementations, such as TWIC and the Florida seaport initiative, have proven to be a highly efficient method for quickly verifying the identity of a worker and establishing a consistent level of trust among disparate, but related sites. To ensure the flexibility and cost effectiveness of a smart card deployment, organizations must ensure that card readers match the flexibility of the smart cards themselves. Smart card deployments with insufficiently flexible readers may require significant and costly system overhauls to accommodate future routine smart card upgrades.

Featured

  • Secure Your Home During the Holidays

    The most wonderful time of the year can easily transform into a nightmare. Being vigilant, while still enjoying the holiday season, is possible. The holiday season is the perfect time to start implementing security measures to protect one’s home and ensure security while out and about. Read Now

  • Five Cybersecurity Trends Predictions for 2024

    According to Cybersixgill, threat research experts, AI’s evolution will continually improve both organizations’ cyber defense efforts and cybercriminal activities. At the same time, increasingly complex regulatory requirements, continued consolidation of cybersecurity tools, a widening attack surface, and heightened global geopolitical issues will all play a significant role in driving the direction of cybersecurity. Read Now

  • AI on the Edge

    Discussions about the merits (or misgivings) around AI (artificial intelligence) are everywhere. In fact, you’d be hard-pressed to find an article or product literature without mention of it in our industry. If you’re not using AI by now in some capacity, congratulations may be in order since most people are using it in some form daily even without realizing it. Read Now

  • NSA Report Focuses on How to Protect Against Evolving Phishing Attacks

    The National Security Agency (NSA) and U.S. partners have released a new report describing the latest techniques in phishing attacks and the defenses organizations can deploy against them. Read Now

Featured Cybersecurity

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance. 3