A Key for Casinos

Maintaining tight control to minimize loss

• By Fernando Pires
• Sep 01, 2013

With so much money flowing throughout casinos, these establishments are a highly-regulated world within themselves when it comes to security.

One of the most critical areas of casino security is physical key control because these instruments are used for access to all of the most-sensitive and highly-secured areas, including counting rooms and drop boxes. Therefore, the rules and regulations that relate to key control are extremely important to maintaining tight control, while minimizing loss and fraud.

Manual Logs

Casinos that are still using manual logs for key control are at constant risk. Not only are there inherent inaccuracies with this system, including signatures that are missing or illegible, but this sign-out process is time consuming.

Analysis, reporting and investigation are extremely labor intensive due to digging through piles and boxes of log sheets, making it difficult to keep an accurate account of key usage while having a negative impact on compliance.

Choosing the Right Solution

When choosing a key control and management solution that meets the needs of the casino environment, there are important features to consider.

Multiple layers of security. Before accessing any key in the system, each individual user should face at least two layers of security. Biometric identification, a PIN or an ID card swipe to identify the user’s credentials are not enough separately.

The cabinet door should not open until the system verifies that the user has permission for the specific key requested.

Three-man rule. For certain keys or key sets that are highly-sensitive, compliance regulations may require signatures from three individuals, one each from three separate departments, typically a drop-team member, a cage cashier and security officer. A secure key management system should be programmable to recognize these keys or key sets and only open the cabinet door and release them once the three required logins are complete and the credentials verified. A system designed for user convenience will prompt for the additional logins only once, regardless of how many sets were initially requested.

Returning highly sensitive keys may be even more highly regulated, with multiple levels of security required. For example, “Full Secure” would require that the same users who removed a key must return the key, while “Department Secure” would only require the first user’s credentials to match exactly while the two other users would have to match by department. The key control system should be configurable to handle these levels and others as well.

Limitation of access. Access to drop boxes outside of scheduled hours is another regulated area that requires specific functionality from a key control system. In the case of an event like a machine jam, customer dispute, machine relocation or maintenance, the user would typically be required to include a predefined note and freehand comment with an explanation of the situation before removing keys. In a casino environment, specific keys or key sets should be configurable so that the user is prompted for this. Reports detailing unscheduled access, including the reason why the access occurred, should be available, as required by many state and tribal gaming agencies. Additionally, emails and/or SMS text messages should automatically be generated any time those sets are accessed for unscheduled drops.

Access to table game drop box release keys is limited to the specific employees who are authorized to remove the table game drop boxes from the tables. These same individuals would be precluded from having access to table game drop box contents keys at the same time they have the table game drop box release keys out. Again, this functionality should be easily and conveniently configurable in a key control solution.

Reporting. Gaming regulations require a number of different types of audits on a regular basis to assure the casino is in full compliance with regulations. For example, when employees sign the table game drop box keys in or out, Nevada Gaming Commission requirements call for maintenance of separate reports indicating the date, time, table game number, reason for access, and signature or electronic signature.

An “electronic signature” includes a unique employee PIN or card, or employee biometric identification validated and recorded through a computerized key security system. The key management system should have custom software that enables the user to set up all these and many other types of reports. A robust reporting system will greatly assist the business to track and improve processes, ensure employee honesty and minimize security risks.

Convenience. It is useful for certain keys or key sets to be quickly available to their authorized users. With an instant key release feature, the user only needs to input their credentials, and the system knows whether they already have their specific keys or not. If not, the system unlocks and their keys are immediately available to them. Returning keys is just as fast and easy. This saves time, reduces training and sidesteps any language barriers. Personnel like housekeepers and slot floor attendants can be organized into “groups”. For them, the hotel and casino would have multiples of the same respective key sets available; the system releases the next available set to each authorized user from a group, which cycles through the sets so that each gets equal usage.

Gaming requirements vary from state to state, and from tribe to tribe. The key control and management system chosen for deployment in a casino environment should be flexible to accommodate for any of the above regulations and. It should also be modular and scalable, so the number of keys and the scope of features can change and grow along with the business.

Finally, it should be easy to use, as training time can be costly and many different employees will need to be able to access the system.

By keeping these elements in mind, a casino can manage their key control system wisely.

This article originally appeared in the September 2013 issue of Security Today.