Smart Cards and Security

May 1, 1998 12:00 PM, STUART EVANS

Smart cards are coming; are you ready? For many years, smart card technology has been a classic example of a solution in search of a problem. As of 1998, this is definitely no longer the case. Europe is well ahead of the United States in smart card use and development, and there is much to learn from the European pioneers. Every security manager, consultant or specifier needs to understand smart cards well enough to make appropriate use of them in access control and security systems now and in the coming years. Look around you: n Many of your employees already have smart cards for their personal use: mobile phones; satellite TV; pay phones; loyalty cards. n Your own organization may be planning or using smart card solutions to advance its business mission. n Your information services department may be using smart cards to protect corporate data networks - especially as the Internet becomes more important. n Your suppliers may be offering systems and solutions in which smart cards are more or less essential - cafeteria/cashless vending is a popular, though mundane, example.

Beyond the current momentum, in the next few years expect to see bank/credit cards routinely include a smart chip. In addition, several public transport organizations will be making extensive use of contactless smart cards for fare collection.

Despite all the progress, it is important not to get carried away. The technology is moving fast, but it is still at the "early adopter" stage; products and systems are still evolving. Standards are emerging but are not yet comprehensive or robust. They are, however, backed by major players, and it is almost certain we will have meaningful standards eventually. For the time being, however, even products from the same company are not always compatible. And most smart card suppliers are currently more interested in small numbers of large orders rather than large numbers of relatively small orders, which will characterize access control. Despite this, more than 200 million smart cards per year are forecast to be sold in access control and vending by the turn of the century (see table).

Five steps to smart card savvy: 1. Get educated - and stay that way. If you attended a smart card seminar more than six months ago, you are already out of date! The pace of change is so rapid that you need to find a way of keeping current. (See sidebar for information sources.)

2. Be flexible. Most current examples of smart card access control applications are based on multiple uses for the card - cashless vending, time and attendance and access control being a typical combination. The driving force will not normally be access control, so the security practitioner will often have little choice but to accept a smart card chosen by someone else. This should not be a technical problem with most modern access control systems.

Remember also that the term "smart card" means different things to different people - at least partly dependent on the application or technology being used. For example, we often see the term being used to describe the familiar proximity card. Indeed, we expect to see an increased blurring of the boundaries between proximity and smart cards, especially as contactless smart cards become more popular.

3. Acknowledge smart cards are secure. By most objective measures, smart card technology is incredibly secure. This is not surprising given its early use in banking and finance. Any thoughtful implementation of smart card technology should be at least as secure as most commercial access control systems today.

4. Embrace but don't reach out - yet. I have seen several examples of organizations that think they should choose smart cards for their next access control system but don't know why. It is fine - and not very difficult - to incorporate smart cards into your system if there is a good reason to do so - typically because they are already being used for other applications in your organization. Embracing smart cards in this way is clearly appropriate, but do not reach out for smart cards "just in case."

5. Don't hold your breath or stop what you are doing. In many ways, this relates to the previous point. Despite the cards' future importance and widespread adoption, there is no need to defer any current plans for access control because of concerns that smart cards will become important "really soon now."

Additional resources

There are several organizations you can join and publications you can subscribe to for initial and ongoing education.

n An excellent starting point is The Smart Card Report (4th Edition, just published) and the monthly Card Technology Today newsletter, both published by SJB Services; 800-328-9623 or www.sjb.co.uk.

n Other magazines/newsletters include Smart Card News as well as Card Technology, published by Faulkner and Gray; 800-535-8403 or www.faulknergray.com.

Finally, there are many suppliers of smart card products and services who can provide a good deal of information about their own products as well as smart cards generally. Listed below are two Web sites that provide good general information, as well as multiple links to suppliers and other relevant sites: n Smart Card Industry Association: www.scia.org n Smart Card Forum: www.smartcrd.com

about the author Stuart Evans (sevans@cotag.com) is chief executive of Cotag International, a manufacturer of proximity cards and readers. He has more than 15 years experience in the field, and gave his first presentation at a smart card conference in 1987. Evans is a graduate of Cambridge University and Harvard Business School. He previously worked for IBM in the banking industry, and was a management consultant with McKinsey and Co. For more information, visit www.cotag.com, or write to Cotag International, Suite 300, 19111 Dallas Parkway, Dallas, TX 75287-3106; 972-733-6000 or 800-886-9088; fax 972-733-6091.

Want to use this article? Click here for options!
© 2008 Penton Media Inc.

This month in Access Control

• Opening Up About Door Closers
• An Enterprise Approach
• The Framework For Open Systems
• On A Higher Plane
• More from April's issue