Card, mobile credential, payment and security
T2 Systems announced a real-time integration with CBORD’s Odyssey PCS, CS Gold and OdysseyOne campus ID card systems to support quick and secure payment for parking at colleges and universities.
The T2 Flex parking management platform is a system designed to streamline all parking tasks - permit management, parking enforcement, access and revenue control, and event parking - into a single Web application, eliminating the need for multiple systems and vendors.
With its vast portfolio of campus ID card systems, CBORD offers integrated solutions that bring together various campus services like access control, security, online account management, meal plans, and stored value for payments on and off campus into one intuitive ID card application.
Emerson College and Suffolk University in Boston recently paired with CBORD to allow its students the ability to pay taxi fare using their campus card. Emerson uses CBORD’s CS Gold campus card system, while Suffolk uses CBORD’s Odyssey PCS system.
T2’s integration with CBORD’s campus card solutions extends the value of university parking management by letting students pay for parking with the same credential that they use for access, purchasing, and privileges in all areas of campus, every day.
In the aftermath of the Boston Marathon bombings, news outlets reported that facial recognition systems were not of much help in identifying the suspects from surveillance footage.
Since the Sept. 11, 2001 terrorist attacks facial recognition has been both touted as a magic bullet for spotting terrorists in a crowd and derided as an invasion of privacy. In truth, the technologies true application lays somewhere in the middle.
In the past 12-years facial recognition’s accuracy has vastly improved but it still has trouble with poor quality images, such as those gathered from surveillance footage. But in controlled conditions the technology can be accurate.
“Facial recognition is a powerful tool in the right circumstances and it continues to advance in its ability to support law enforcement investigations,” said Bob Eckel, CEO of MorphoTrust.
MorphoTrust released a graphic that depicts the best uses of facial recognition. The company’s biometric technology is used by the U.S. Department of Defense, Federal Bureau of Investigation and the Transportation Security Administration, as well as by state motor vehicle agencies and local law enforcement agencies.
Many state driver license issuer’s use facial recognition technology to spot individual’s applying for multiple licenses under different names.
Other successful deployments include:
Cash back, points toward scholarships promote card usage
More and more universities are launching loyalty programs that encourage students to use their cards beyond the dorm and dining hall. From LoboPerks to airline-style loyalty programs, program administrators are searching for ways to give students more mileage from the student ID.
LoboPerks, named after the University of New Mexico’s wolf mascot, is a discount program featuring more than 100 Albuquerque merchants. That’s quite a feat, considering the program started with just 19 in August 2011.
The program serves 29,000 students and has an impressie range of merchants, including restaurants, beauty salons, cell phones providers, computers shops, furniture rentals and fitness facilities, says Carolyn Hartley, manager of ID Card Services at the university.
Discounts can be hefty, including half-off deposits at apartment complexes or a $100 discount on used car, says Hartley. The loyalty program also serves faculty, staff and employees of the university hospital.
The LoboPerks Web site lists all participating merchants, and a student needs only present the Lobo Card to take advantage of the discounts.
Currently, the school receives nothing from the merchants, says Hartley. In fact, it costs the merchant nothing to participate in LoboPerks, other than the discounts offered.
“We are hoping to get some small revenue stream by increasing marketing opportunities for vendors but we haven’t come up with anything yet,” says Hartley.
The program includes a weekly email, an online ‘spotlight’ vendor of the week and an email list to let students know of new vendors or changing discounts.
She points out that the school doesn’t divulge the student email addresses to vendors. “It’s not intended for students to be solicited,” says Hartley. The program is not tied to the school’s LoboCash declining balance program so students can pay for discounted services however they choose, says Hartley.
Hartley modeled LoboPerks after a program at Indiana University-Purdue University. “I saw this at the NACCU conference and said this is way cool and we should have something here. I never in a million years thought this program would grow as quickly as it did.”
Advertising the program was not as difficult as she first thought. “Marketing is not my forte, but I did what I knew how to do. I talked it up, even to total strangers.” Hartley created a business card about LoboPerks that she includes in the envelope that contains the Lobo Card when students first register. “I’m getting the word out one perk at a time,” she jokes.
Instead of going with a discount program, the University of Alabama recently rolled out Crimson Spirit Loyalty Points, a system similar to airline miles. Molly Lawrence, associate vice president of student affairs, says the school was looking for a way to encourage students to participate in events that are more academic in nature rather than athletic or social.
“Students receive points for attending events like plays, athletic events with low student participation and academically-oriented events,” says Lawrence. “At the end of every semester prizes are awarded.”
All students have to do when they attend the event is swipe their ID, says Jeanine Brooks, director of the university’s Action Card program.
At each event, student staffers equipped with iPods or iPads swipe student ID cards. The iPod Touch 4 fits into a sleeve that enables the card to be swiped. For an iPad, a reader is attached to the device. In either case, an app is downloaded from Apple’s iTunes store to power the service.
“The reader can be used all over campus with WiFi,” says Brooks. “We hand students the iPod, show them where the app is and they swipe cards.”
It works well and the university doesn’t have to worry about losing a $3,000 reader. “We’re giving them $500 worth of equipment instead,” explains Brooks.
The school publishes a list of events where students can receive points. “Students can go online to view their point total,” says Lawrence.
Since the points system is new, it’s too early to measure results. The school is starting a marketing push in the spring, says Brooks, which is when the program will officially launch. “We’ve been testing it on several events, specifically student government events,” says Brooks.
“SGA will take the lead promoting Crimson Spirit,” says Brooks. “We do an electronic newsletter and we’ll also utilize the school newspaper and use social media.”
Prizes will include rewards such as $100 scholarships that can be used to purchase books and related equipment, says Lawrence.
Dalhousie University in Nova Scotia, Canada offers a loyalty program similar to LoboPerks, except its discounts are capped at five percent. Its 23,000 cardholders include staff, faculty and students.
Lisa Boutilier, manager of the DalCard, says the ID enables students to earn five percent off purchases at specified off-campus merchants and at most on-campus locations.
“Purchases made at the bookstore and at food locations qualify for the five percent discount,” says Boutilier. The only thing not covered is groceries. Already more than 20 off-campus merchants offer discounts for DalCard users.
The five percent goes into what Boutilier calls the “loyalty bucket.” Each week the card office runs reports showing what the cardholder has earned. The funds are then deposited back on to the card and used for the next transactions. The next time the cardholder makes a purchase using the card, the first purse accessed is the loyalty account, says Boutilier.
The loyalty program was first established in 2000 to encourage students to use the DalCard as more than just an ID, says Boutilier. “Use of the DalCard keeps the line moving in the cafeteria and is quicker than debit or cash,” she adds.
There are several purses on the DalCard: including a convenience account, FoodBucks, bookstore and the loyalty account. When a student earns five percent in the bookstore, it goes into the bookstore account, which means it can only be spent in the bookstore, says Boutilier.
Nearly 97% of loyalty dollars earned are redeemed. “That’s phenomenal,” says Boutilier. “The program is obviously working.”
Heartland Campus Solutions, which provides campus card solutions for Dalhousie, is seeing increased interest in loyalty programs across its client base, says Fred Emery, vice president and general manager at the company. The types of programs are different depending on the school. “Sometimes we provide discounts off the purchase automatically,” he says, “most doing like five percent.” He sees more and more schools considering a points-based system as well.
“We’re constantly looking for ways to enhance the program to get students to keep using the card,” says Emery. “They really seem to love it.”
Annual CR80News Campus Card Banking survey results flat, Prepaid leaps as fees fall
The traditional model of banks partnering with colleges and universities to offer an all-in-one campus ID and bank card may be shifting.
A 2012 report from the U.S. Public Interest Research Group raised concerns about some of these program’s practices and the fees charged to students. Many of these concerns were unfounded or misplaced and most of the programs provide good value for students and institutions, but still the report brought new pressures. In the months that followed, members of Congress met with vendors and financial institutions offering the products while the U.S. Department of Education began crafting regulations to govern these programs.
Concerns stemming from the Payment Card Industry Data Security Standard (PCI) also seem to be affecting the combined ID and bank card model as some campuses consider separating the functionality onto two cards.
It’s too early to tell how these regulations will impact the market, but 2012 was a stagnant year in terms of overall new agreements, as many institutions seem to have taken a wait-and-see posture. For the first time since CR80News initiated the survey a decade ago, there was no net increase in the total number of campuses with bank card partnerships.
A bright note comes in the growing trend toward prepaid. A significant rise is occurring in the number of campus banking partnerships issuing prepaid accounts rather than traditional checking accounts with associated debit cards also known as demand deposit accounts or DDAs. Some insiders believe that use of prepaid rather than debit may stem criticism from regulators because it can eliminate the much-maligned non-sufficient funds (NSF) or overdraft fees.
“Students like the prepaid option,” says Terry Maher, a partner at Baird Holm LLP and general counsel for the Network Branded Prepaid Card Association. “It’s a good tool from the bank perspective and the customer perspective because it keeps the student within a budget and away from fees.”
Budgeting is easier with a prepaid account, says Ben Jackson, senior analyst at Mercator Advisory Group. If the money isn’t in the account a transaction won’t be approved. This removes the chance of charging overdraft fees.
Prepaid cards have not always had the best reputation because the cards often came with high fees and major limitations. This has changed with many of the modern prepaid programs. “More people looking at prepaid because you can get a no cost or low-cost account,” Maher says. “If you have money direct deposited into the account and don’t access funds at out-of-network ATMs they’re inexpensive and safe.”
Traditional debit accounts are subject to many more regulations and disclosure requirements, says Jackson. With traditional debit cards the issuer must maintain a separate account for each student. Prepaid programs, on the other hand, may pool funds in a single account, he says.
This helps keep operational costs lower for prepaid. A checking account can cost a bank as much as $200 a year but the prepaid account is much less expensive, Maher says
A properly run prepaid program can offer students the same benefits as a checking account, Maher says. “It comes down to ease of access,” he explains. “ATM accessibility is key.”
While prepaid might be making a splash now, it’s difficult to see whether it’ll be a lasting trend. “It’s too early to tell if prepaid will replace the banking models out there now,” says Whitney Bright, senior vice president for Campus Banking at U.S. Bank.
U.S. Bank implemented a prepaid program linked to the student ID at North Carolina State University in Raleigh. The school wanted to have a Visa or MasterCard branded card so students could make purchases anywhere. At N.C. State prepaid made the most sense because U.S. Bank doesn’t have branches in state. U.S. Bank also issued its Contour prepaid product at two additional campuses. The Contour offering serves as a financial aid dispersal tool for these campuses.
Prepaid is frequently used for aid dispersal and perhaps it is there that its move to campus really began. Blackboard, Heartland Campus Solutions and Sallie Mae–in addition to U.S. Bank–have all issued prepaid accounts as a means to ease financial aid distribution processes at partner campuses. By offering Visa, MasterCard or Discover branded cards as the access point for these distribution programs, the prepaid account has morphed to be virtually indistinguishable from traditional bank card offerings for most student accountholders.
Blackboard’s BbPay offering automates financial aid dispersal and provides students with a Discover-branded prepaid card. Today, 25 institutions use the BbPay service. The company believes prepaid is the way of the future for campuses because, if implemented correctly, it can offer comparable services at far lower costs while keeping regulators at bay by minimizing cardholder fees.
“The accounts are FDIC insured, include provisions to shelter against fraudulent use, eliminate NSF fees, offer widespread low or no cost ATM access and can be used to make purchases anywhere branded payment cards are accepted,” says Jeff Staples, vice president of market development, Blackboard Transact.
In the early days, prepaid was hampered by higher fees and lower access. “Today, it has come out of the shadows as progressive issuers allied with payment and ATM networks to up the number of access points and eliminated of unnecessary, burdensome fee structures,” adds Staples.
A year ago, the 2011 CR80News Banking Survey suggested that the biggest issue for banks with campus partnerships was maintaining a positive revenue stream in light of the changing banking climate. Regulators had clamped down on cardholder and merchant fees, changing the profitability matrix dramatically.
In 2012, for the first time since the survey’s creation in 2003, there was no net gain in the total number of partnerships. Though some blame the PIRG report for the lack of growth, others see it as a more holistic change.
During the year, Wells Fargo saw several campuses either change from a combined card to separate cards or discontinue the banking functions.
“In some instances the school stopped offering that specific functionality but are offering different products,” says Stephen Nixon, vice president and manager of Wells Fargo’s Campus and Workplace Banking Programs. “There weren’t questions or aspersions about what was offered, but more that institutions wanted to go in a different direction.”
The relationship also extends beyond the immediate student and university needs, says Nixon. “We’re interested in serving the higher education market with a broad range of financial services products,” he adds. For Wells Fargo, this meant losing some schools combined campus ID and payment cards in favor of alternative products.
Heartland Campus Solutions remained steady with its number of campus partnerships, but the PIRG report has impacted new business, says Bill Norwood, chief architect at the company. Vendors and universities are expecting regulations from the Department of Education and are hesitant to make a move until then. “They’re not sure which way to go,” he explains. “They don’t want to pick a system and then not have it be compliant.”
Commerce Bank realizes that the retail banking model is changing but is working to maintain the same types of services to schools. There is a caveat, however. If Commerce can’t institute sensible fees it might not be long for the campus market, says Don Becker, assistant vice president for Student & Prepaid Card Partnerships at Commerce.
“Future restrictions on our ability to assess fair and reasonable fees could limit our ability to maintain campus card partnerships and provide students with the level of convenient campus banking that they’ve come to enjoy,” Becker explains.
On the positive side, U.S. Bank has seen continued interest in campus banking partnerships, says Whitney Bright, senior vice president for Campus Banking at the financial institution. “Since the beginning of 2013 we have seen a lot of activity and are seeing continued demand,” she adds.
While fee revenue is declining from these types of accounts, some banks continue to pursue the partnerships because of the potential to build a life-long customer, Bright explains. “We want to develop the relationship and expand it with them,” she explains.
SunTrust, insiders suggest, may be exiting the campus banking business, ending its partnership with the University of Central Florida, one of its three programs. Executives from SunTrust did not respond to interview requests.
Fairwinds Credit Union jumped into the campus banking market when it signed with University of Central Florida, previously a Suntrust partner. The ID card is linked to the credit union checking account, can be used as an ATM card and to make purchases on and off campus with a PIN, says Kate Renner, vice president of marketing at Fairwinds. The credit union also has a branch on campus that opened in January.
In addition to the bad press and pending additional oversight from the past year, the existing PCI regulation is adding increased pressures. This comes as administrators realize that combined campus and payment cards might swim in murky waters when it comes to PCI compliance.
If the same ID number that is used for payments is also used for physical access, library functionality or stored in campus databases there are PCI requirements that schools must take to protect that data. However, industry sources say these precautions aren’t always taken. Fear of PCI fines and confusion over how to fully comply, is leading some institutions to separate the campus ID from payment card thus segregating the student ID number from the bank card number altogether.
Wells Fargo has taken precautions to keep its campus partners safe. “The bank card number and the student ID number are entirely different,” Nixon says. “On-campus functionality is driven by student ID or other access ID number, which is typically encoded on the cards in addition to the debit card number. This enables on-campus card readers for, say, door access to read specific positions on the mag stripe to verify student ID.”
In some cases the data is further segregated by having two magnetic stripes on the same card–one for on-campus functions and the other for banking functions, Nixon explains.
This two-stripe solution has become more and more common as campuses across the country struggle to stay clear of PCI. The pressure to take that final step and segregate the functionality to completely independent pieces of plastic is growing at a number of colleges and universities. This could ultimately change the very nature of campus card bank partnerships. While it would not necessarily mean the end of campus bank partnerships or the services currently offered, it could remove campus card programs from the equation migrating the services to other functional areas within the institution.
Between regulations and critical reports, the last couple of years have been a time of flux for banks with campus card partnerships. Financial institutions face declining fee income and regulatory scrutiny while campuses grapple with PCI compliance, negative press and the emergence of prepaid and multi-card options.
By all accounts, more oversight is almost certain to come. The U.S. Department of Education is creating regulations that will very likely impact campus banking partnerships and financial aid dispersal products, and sources say, nothing is off the table.
Agency officials would not comment for this story but industry executives familiar with the process say that new regulations could be released before the end of the year.
Only time will tell if this myriad of pressures changes the face of campus card bank partnerships or if the old model soldiers on.
Blackboard (25)
*Note: With the addition of prepaid accounts to the survey, 2012 marks the first year Blackboard’s partnerships were included.
Alcorn State University, MS
Arkansas State University, AR
Bainbridge College, GA
Bowie State University, MD
Bradley University, IL
Central Virginia Community College, VA
Clark Atlanta, GA
Coastal Bend College, TX
College of Coastal Georgia, GA
Concord University, WV
Georgia Gwinnett College, GA
Georgia Southwestern University, GA
Georgia State University, GA
Hamilton College, NY
Johnson and Wales, RI
Jones County Junior College, MS
Murray State College, OK
Quinnipiac University, CT
Salt Lake Community College, UT
Southside Virginia Community College, VA
University of Arkansas at Pine Bluff, AR
University of Texas at Tyler, TX
Connors State College OK
Chowan University, NC
Central Wyoming College, WY
Commerce (3)
Fort Hays State University, KS
Pittsburg State University, KS
The University of Kansas, KS
Heartland (23)
Bastyr University, WA
Clearwater Christian College, FL
College of the Holy Cross, MA
Colorado Christian University, CO
Concordia University of Wisconsin, WI
Harrisburg University, PA
Hillsborough Community College, FL
Florida Coastal School of Law, FL
John Carroll University, OH
Lebanon Valley College, PA
Manhattan College, NY
Mississippi Delta Community College, MS
Mount Holyoke College, MA
North Central Missouri College, MO
Northwest Florida State College, FL
Palm Beach Atlantic University, FL
Pittsburgh Technical Institute, PA
Reinhardt College, GA
Slippery Rock University, PA
St. Thomas Acquinas, NY
Tompkins Cortland Community College, NY
University of Massachusetts Lowell, MA
Waukesha County Technical College, Wa
PNC (26)
Allegheny College, PA
Arcadia University, PA
Bowling Green State University, OH
Carnegie Mellon University, PA
Case Western Reserve University, OH
Cornerstone University, MI
DePaul University, IL
Duquesne University, PA
Edinboro University, PA
Florida Institute of Technology, FL
Georgetown University, DC
Grove City College, PA
Indiana University of Pennsylvania, PA
Marymount University, VA
Mercyhurst University, Erie, PA
Morgan State University, MD
Mount St. Mary’s University, MD
Olivet Nazarene University, IL
Penn State University, PA
St. Joseph’s University, PA
Saint Xavier University, IL
Temple University, PA
University of Cincinnati, OH
University of Delaware, DE
University of Pennsylvania, PA
University of Pittsburgh, PA
SunTrust (2)
Florida State University, FL
Mary Baldwin College, VA
TCF Bank (5)
Northern Illinois University, IL
St. Cloud State University, MN
University of Illinois, IL
University of Michigan, MI
University of Minnesota, MN
U.S. Bank (55)
Austin Peay State University, TN
Bellevue College, WA
Benedictine University, IL
Bethel University, MN
California State University Fullerton, CA
California State University San Bernardino, CA
Capital University, OH
Carroll University, WI
Central Washington University, WA
College of Mt. St. Joseph, OH
Colorado State University Pueblo, CO
Concordia University Chicago, IL
Creighton University, NE
Drury University, MO
Everett Community College, WA
Gonzaga University, WA
Hamline University, MN
Harris-Stowe State University, MO
Henderson State University, AR
Iowa State University, IA
John Carroll University, OH
Johnson County Community College, KS
Kirkwood Community College, IA
Metropolitan State University of Denver, CO
Milwaukee Area Technical College, WI
Minnesota State University Moorhead, MN
Missouri Baptist University, MO
Missouri Western State University, MO
Morehead State University, KY
Normandale Community College, MN
North Carolina State University, NC
North Dakota State University, ND
Northern Kentucky University, KY
Northwest Missouri State University, MO
Northwestern University, IL
Oakland Community College, MI
Pacific University, OR
Saint Louis University, MO
San Diego State University, CA
San Jose State University, CA
Seattle University, WA
Southwest Minnesota State University, MN
St. Cloud Technical & Community College, MN
Thomas More College, KY
Truman State University, MO
University of Central Missouri, MO
University of Denver, CO
University of Missouri Kansas City, MO
University of San Diego, CA
University of Wisconsin-Eau Claire, WI
University of Wisconsin-Stevens Point, WI
Washington State University, WA
Waukesha County Technical College, WI
Wisconsin Lutheran College, WI
Xavier University, OH
Wells Fargo (36)
California State University-East Bay, CA
California State University-Los Angeles, CA
California State University-Sacramento, CA
California State University-Stanislaus, CA
Colorado Mesa University, CO
El Paso Community College, TX
Elon University, NC
Fayetteville State University, NC
Florida A&M University, FL
Florida International University, FL
Georgia Perimeter College, GA
Guilford College, NC
Mercer University, GA
Midwestern State University, TX
Minnesota State University-Mankato, MN
New Mexico State University, NM
North Carolina A&T State University, NC
North Carolina Central University, NC
Northern Michigan University, MI
Riverside Community College District, CA
Texas A&M University-Corpus Christi, TX
Texas State University-San Marcos, TX
University of Arizona, AZ
University of Florida, FL
University of Nebraska-Kearney, NE
University of Nebraska-Lincoln, NE
University of Nevada-Las Vegas, NV
University of Nevada-Reno, NV
University of North Carolina-Chapel Hill, NC
University of North Texas, TX
University of Northern Colorado, CO
University of Texas-Arlington, TX
University of Texas-Dallas, TX
University of Texas-El Paso, TX
Villanova University, PA
Virginia Commonwealth University, VA
The University of Chicago, together with the campus Police Department, is launching a new smart phone application called Pathlight that will enable students an easy-to-use way to increase their own safety.
Developed by The CBORD Group, the same company that maintains the university’s campus ID-based building security system, Pathlight enables students to opt into GPS tracking services for their phones so that location information is transmitted to campus dispatchers or security office personnel in case of an emergency.
If a student, for example, is walking alone at night across campus, all they need to do is launch the app, enter the required information and press “Follow Me Now” to initiate tracking. The University of Chicago Police Department (UCPD) would then be able to remotely track the student’s presence and progress until the walk is over, simulating somewhat of a virtual safety escort, but that is less resource-intensive for the UCPD.
If a student feels in immediate danger at any time, a “Help” button allows student to trigger a silent alarm which immediately notifies dispatches of the student’s location and need for immediate assistance. In this way, Pathlight functions almost as a portable blue light.
Read the full story here.
Legacy 125-kilohertz proximity technology is still in place at around 70% to 80% of all physical access control deployments in the U.S. and it will be a long time before that changes, says Stephane Ardiley, product manager at HID Global.
The above scene, however, is starting to play out more frequently as corporations, educational institutions and government agencies migrate from older technologies to contactless. Case in point, U.S. federal agencies are replacing prox or in some cases even magnetic stripes with contactless smart cards in order to comply with government mandates, Ardiley explains.
Still, it will be years before contactless card shipments overtake proximity in the Americas. IMS Research predicts that in 2016 contactless shipments will eclipse proximity, says Paul Everett, senior manger for the security team at the consultancy. Obviously, obstacles to contactless adoption still remain, even more than a decade after international standards were first released and nearly two decades following wide scale product availability.
Opinions vary as to the root cause of the delay. Many cite high replacement costs for some enterprises. Others blame the supply chain, noting that physical access control dealers and local security integrators have been slow to push clients to new technology. They believe it is easier and more profitable to stick with the older solutions that they have been selling for years and fully understand.
Still there are many reasons a migration from older access technologies is inevitable. The biggest is the increase in security. “Proximity cards and mag stripes are basic technologies when it comes to physical access control,” Ardiley says. “There is no security, they’ve been hacked, there’s no protection of data, no privacy, everything is in the clear and it’s not resistant to sniffing or common attacks.”
Unlike prox technology, contactless smart cards are resistant – some would say impossible – to clone
In most cases the cards have the ID number printed on the back. If someone obtains the card they can take that number, encode a new card and use it to gain access, Ardiley says.
Unlike prox technology, contactless smart cards are resistant – some would say impossible – to clone. The data in the card is encrypted and the communication between a card and reader is secure, says Ardiley.
Despite the security risks, prox isn’t going away anytime soon, says Jason Hart, executive vice president for identity management and cloud solutions division at the Identive Group. “Some people are oblivious to the risk and those who aren’t accept prox as a convenience tool rather than a physical security tool,” he explains.
Many of the enterprises that feel this way deployed prox a long time ago and simply haven’t looked back since, Hart explains. “Customers were sold on that fact that it’s secure and they never really questioned it,” he says. “They deployed in the early 1990s and haven’t done any assessment of the security technology since then.”
The lengthy lifecycle of a physical access control system is another reason prox remains prominent, Hart says. Physical access systems can have life spans as long as 20 years and swapping out can be time consuming and expensive.
IMS Research puts the life spans anywhere between 10 and 15 years, Everett says. When new systems are deployed they typically choose smart cards, so at least enterprises are not replacing old prox systems with more prox technology, he notes.
Some enterprises don’t feel the need to move because the security profile doesn’t demand it, says Dave Helbock, a senior security specialist at XTec. “Do you want to keep the local populace out or do you want high security?” he asks. “Do you need to card into every door or suite or do you just have one on the front door and in the garage?” Depending on an enterprise’s answers to questions like these, they may find prox sufficient for their current needs.
Some contactless cards are comparable in price to prox so the main issue Comes down to the cost to swap out readers
The other factor is that prox technology still works very well for its intended function – passing a short numeric string to a reader quickly and reliably. “Prox is very well established and the problem you face is that if it works, why change it?” says Everett. “People are resistant to change because it does the job on the low security side.”
A security breach can lead to change. Hart says the use of prox technology – due to either cloning or lax access rules – has enabled unauthorized individuals to access facilities.
Often such breaches lead to a discussion about high-security credentials, but so too can an IT department’s desire for convergence of credentials, Hart says. In addition to greater security, smart cards create opportunities for additional applications such as logical or network access control.
“Enterprises need to think about physical access control as one piece of a larger ecosystem,” Hart says. “Pick one point and then grow from it.”
The same contactless technology that gets an employee in the front door securely could also then be used to make purchases from a cafeteria or vending machines. Even more importantly, the credential could be used for logical access to secure networks and web sites, Ardiley says.
The issue of costThese reasons would seem on the surface to be enough to encourage mass migration if other factors were not at play. But factors such as replacement cost fight against migration at every turn.
Vendors are understandably hesitant to talk about cost as quantity and a host of other variables can factor in, but this does not remove the reality of the issue.
Typically, prox cards cost $3 to $5 each, sources say, though it is not uncommon for small volume issuers to pay double this amount. Price can vary depending on printing options, lead times, quantity and other features.
Pricing for contactless cards runs the gamut. Contactless smart cards with small memory and older technology are often cheaper than prox at just $1 to $2 per card, sources say. There are many mid-range options that are comparable in price to prox as well. At the expensive end of the spectrum, contactless smart cards with large memory, high-end cryptographic capabilities and the latest security features can cost $8 to $12 or more, sources say.
Some may scoff at the cost of the higher end cards but vendors say the tangible and intangible benefits of increased functionality and security warrant the added expense.
As for the readers, again, on the low end the cost for contactless readers is often lower than or comparable to prox, sources say. Multi-technology readers with different features are more expensive but can provide greater longevity and the flexibility to support legacy cards as the migration to contactless proceeds.
Since some contactless cards are comparable in price to prox, the main issue for an enterprise often comes down to the costs to swap out readers. A smaller organization with a handful of doors might not think twice, but for an enterprise with hundreds or even thousands of doors the cost of readers can be intimidating.
While the capital investment up front may be daunting, there are potential long-term savings from making the switch to an open-standard contactless smart card. Theoretically, open standard products free end users from being locked into a single vendor for cards and readers. “Contactless smart cards enable a move away from a proprietary to a vendor neutral position,” Ardiley says.
Contactless smart cards operate on the ISO 14443 or ISO 15693 standards. If an enterprise deploys technology that uses one of these technologies it should be able buy cards and readers from any vendors as long as the standards are supported. “You don’t want to get locked into one technology,” Hart says. “We’ve seen a lot of problems sticking with a one vendor implementation.”
Using standards-based technology also means a certain amount of future proofing. As long as the new technology adheres to the same standard, enterprises should be able to upgrade without ripping and replacing, Hart says.
The access control supply chain has grown accustomed to proprietary technology and, sources say, the idea of open standards and open sourcing makes some dealers and system integrators nervous. They want to protect the lucrative recurring sale of cards and readers into their client base, but they fear that the switch to open standards – where these products could be purchased anywhere – could hurt business, insiders say.
“Prox is easy and repeatable and they are making handsome profits on legacy systems and repeat sales,” says one security source. “Replacing a physical access system is a big deal and usually stays in place for a decade or more. Where is the incentive to move to new, more secure system? Prox works today for physical access – even though it’s a weak system.”
There’s also a comfort level with prox that many dealers may not have with contactless technology, sources say. They know how it works and how to deploy the system quickly and easily. With contactless there is still a learning curve some are struggling to get over.
These same industry sources, however, stress that the progressive dealers and integrators who are embracing contactless and other new technologies stand to benefit in the long run. Like with any other supply chain, in the end the laggards are ultimately left behind.
For an enterprise considering a switch from prox to contactless there are a number of issues to consider. To start an organization should conduct a thorough site survey to find out what kind of card technologies and formats are already deployed, Hart says. “A lot of times it’s difficult for an organization to know all the different card technologies deployed,” Hart says. “A satellite office might use a different technology and the car park might use something else.”
Depending on the technologies deployed and the vendor’s involved this can be a difficult task. “Sometimes the vendor will have proprietary information and won’t want to provide it,” Hart says. There are inexpensive software and hardware tools available that can enable an enterprise to independently check the card formats and systems they have deployed.
Next an organization needs to determine where they want the new technology to be deployed, Hart says. Are there additional doors or areas that need to be secured, and if so, what needs to be done to enable those locations?
The next step is either a pilot or full rollout, depending on how an enterprise wants to move forward. XTec recommends having a small group of employees with new cards tap against a reader for a period of time just to make sure the cards are working correctly, says Helbock. “You can do a storage room or other space just to make sure everything works,” he says.
Once the proof of concept is completed and bugs are worked out, Helbock recommends a phased rollout. “It’s difficult to convert all cards and switch out all readers at one time,” he says.
Once a population has the new contactless cards, it’s best to make the switch as quickly as possible. “There will be a little bit of pain but the quicker you do it the better off you’ll be,” Helbock says.
Some organizations will opt for new readers that can accommodate both contactless and prox to ease transition, Hart says.
On the back end, if the prox physical access system uses the Wiegand Protocol it will work with the new contactless smart cards and readers, Ardiley says. “It’s changing the physical reader but the rest of the components should be able to accommodate the changes,” he adds.
There are some exceptions, says John Schiefer, manager for system deployment at XTec. In the case of a federal PIV deployment the legacy infrastructure will work. If PIV-I is being used with the same system, however, an additional physical access controller might be necessary to handle and check the other data.
An issue that too often goes unnoticed when making the switch from prox to contactless is the end user’s experience, Ardiley says. Whereas the prox credentials could come in the general vicinity of the readers and open the door, contactless smart cards might require a tap and hold before the transaction is completed.
Enterprises need to educate employees on how the technology is different than prox so that they use it properly. If there are complaints of cards not working it may well be a simple case of user error.
Making the switch from prox to contactless is a big step but it offers users the ability to accomplish more with a lesser risk of intrusion. With contactless credentials enterprises can achieve additional functionality, flexibilty and increased security. The perception of higher cost is often a misperception, but it continues to inhibit deployment. It’s really a matter of educating enterprise on the true costs and benefits of these systems, and then finding a progressive local dealer to assist with rollout.
Contactless smart cards and the ISO 14443 technology are far from new technologies as electronic passports that use the same technology have been in circulation for almost six years and the technology had deployment even prior to that.
The existing, entrenched prox infrastructure is the main reason the technology has been slow to spread in the U.S., says Paul Everett senior manager for the security team at IMS Research. Prox technology accounts for about 40% of revenue for physical access control technologies and represents 45% of the unique shipments.
Contactless smart card shipments will overtake prox by 2016, Everett predicts. Most enterprises aren’t making the switch now because the systems they have work. Until those systems reach end-of-life there’s not a lot of need to upgrade a system that is still functional. “New installations will use smart cards but those with a large installed base of prox are not going to swap out unless there’s another reason to do so,” he adds.
Physical access control provider, Quantum Secure, sees U.S. interest in contactless smart card mainly within the federal government and its contractors, says Vic Ghai, vice president and chief technology officer for products at the company. In other sectors, it has been more pilots than installs. “Historically we have seen many pilots for contactless smart cards but it doesn’t go beyond that,” he adds.
Quantum Secure has more than 80 customers in the U.S., 10% of which use contactless smart cards, Ghai says. Those customers are either federal agencies or enterprises that have contracts with the government.
Outside of federal agencies and contractors, interest has been primarily from health care and airport sectors, says Ghai.
Just as contactless takes hold in the U.S, near field communication is coming quickly on its heels purporting to do away with the plastic card format all together.
Most agree that if this is to become reality, it is still many years away. It’s will be years before NFC becomes a standard feature, like Bluetooth, in handsets, says Paul Everett senior manager for the security team at IMS Research.
NFC has to find its way into the majority of devices for it to be a viable option. Even then there are some concerns with how one handset manufacturer may deploy the technology versus another, says Jason Hart, executive vice president for identity management and cloud solutions division at the Identive Group. There have been issues with some of the early NFC handset antennas and problems with data transmission.
There are also the ever-present issues with “bring your own device,” such as who owns the data on the handset and how can we manage the security issues when one device is used for both personal and corporate access, Hart says.
Enterprises that opt for contactless smart cards based on open standards, however, should be better prepared to make the transition from cards to handsets down the road as both technologies use the same family of ISO standards.
While widespread use of NFC for physical access is certainly a ways off, it hasn’t stopped vendors from creating applications, Hart says. Identive has a PIV applet that can mimic the same functions as the government credential and another that uses the PLAID contactless standard for mutual authentication of credentials and readers.
The CBORD Group and the Illinois Institute of Technology (IIT) have been recognized for a new mobile-enabled security solution for door access.
CBORD’s solution, dubbed CS Access, serves IIT’s more than 7,700 students and staff and was recently awarded the 2013 Innovative Technology Award by the National Association of Campus Card Users (NACCU). The Chicago based IIT — a Ph.D.-granting university in engineering, sciences, architecture, psychology, design, humanities, business and law — has implemented a number of new mobile-based security features.
IIT’s adoption of CS Access enables its students to access residence hall rooms and other doors on campus by simply opening CBORD’s mobile app — CBORD Mobile ID — or by sending a text message reading “Open MyDoor” to gain physical access. CBORD’s CS Access manages both mobile access methods.
The solution is mindful of student convenience, using mobile devices that every student possesses, a mobile phone. Moreover the text message method of access ensures that those students without smart phones are still able to interact with the solution.
As an additional failsafe for student access, campus staff can be assigned temporary, elevated door access privileges using a “MasterKey” text-enabled function. Elevated privilege can only granted with management’s approval with any occupants of the room receiving prior notification of entry.
The MasterKey function has provided an added layer of security by doing away with the riskier metal master key. Additionally, the solution cuts costs associated with manufacturing and replacing lost metal keys.
The NACCU Innovative Technology Award recognizes institutions that implement unique, technology-based solutions on campus, and was presented to IIT during the 20th Annual NACCU Conference— a four-day event for the global campus card community— held in Orlando.
See CBORD’s video for more on the CS Access solution at IIT.
