From Concept to Implementation
Recently, Robert Miller, PacificCard system manager at University of the Pacific, discussed the overall process that took place from inception through the decision stage to implementation of his current system of access control and security. Security Magazine thanks Andy Hilverda of Videx, for helping to gather this information.
Security: Can we start with a brief history of University of the Pacific?
Miller: In 1851, University of the Pacific became the first chartered institution of higher education in the State of California. Today, the university has three campus locations: Stockton, San Francisco, and Sacramento. As a private university of moderate size, we offer highly personalized undergraduate and graduate programs that place a strong emphasis on personal one-on-one education between the student and teacher.
Security: Were you experiencing problems that initiated the search for security solutions?
Miller: We were not experiencing security problems, but we could see the potential for problems in the future. Security is not a problem…it is a solution. When we deploy security, we look to deploy solutions that allow us to reduce the potential for problems. Pacific has an open, caring, supportive learning environment that benefits both students and faculty. Security can be considered intrusive and with at least 6,000 students on our three campuses our goal is to raise overall security without it becoming a barrier. We want to provide solutions that are non-invasive to daily campus life.
Security: What needed to take place before moving forward with implementation?
Miller: We are progressive in looking at what we perceive to be a need, determining where we want to be, and then getting group involvement to solve the need. This includes moving beyond the mindset of “we have always done it this way.” At Pacific we concentrated on the following:
- Full administrative backing and support.
- A clear vision of what the university wanted to accomplish.
- Dedicated funds for the installation.
- Pinpoint specific areas and needs.
- Identifying departments and processes that will be positively affected.
- Administrative costs to support the system.
- Acceptance for the system.
Most importantly, is there acceptance for the system from the top down? No matter how beneficial the system might be, if the students, staff, and employees do not accept the system, it will not be successful.
Miller: Yes, we accomplished many of our goals when we installed our ID card-swipe system in 2003. We went online with the system the very next month. University of the Pacific trademarked the card, PacificCard because of its importance to our commerce and security. Each faculty member, employee, and student is required to carry the card. The card serves many purposes: official university identification (each card includes photo identification), access to campus facilities and dormitories, entrance to the cafeteria and athletic events, participation in our meal plan, and use of retail services on campus as well as commerce at off-site merchants utilizing a self-funded account called PacificCash.
Security: So the card system is used for both commerce and access to campus facilities?
Miller: The original purpose of the card was for securing our residential facilities. Our adaptation of the system accomplishes all of that. At the same time, we raised our overall security level because everyone carries the PacificCard. For example, our Stockton campus is located in the city so anyone can walk on campus. The card helps us identify those persons that should be on our campus or in our buildings.
Security: Was the card system met with any resistance when you first introduced it?
Miller: It was met with some reluctance when it was first introduced but soon it became second nature for students, staff, and faculty to carry the card for access and commerce.
Security: What other steps have you made to elevate security in addition to the card system?
Miller: With the card system, we had security and accountability, but we were lacking in the effective control of areas that continued to utilize a traditional cut-key for access. Access was dependent upon traditional mechanical locks and keys. We began looking for a product that could be “piggybacked” on top of our existing card system which led us to implement the CyberLock electronic lock system.
Miller: First, the largest of our three campuses is located in Stockton and was established there in 1926. Concrete as well as asbestos was largely used in construction at that time. A number of the buildings have extremely thick concrete walls and ceilings that create serious cabling and pathway issues and many of the buildings have historic significance so preserving appearance and structure is very important to us. The electronic lock system incorporates our existing lock hardware so we do not have to drill through the doors and walls of our buildings or deal with asbestos containment. We convert our mechanical locks to electronic locks simply by replacing the cores with electronic cores.
Second, we had thousands of mechanical keys out there with 24/7 access to our buildings. We had no clear accountable way to know if these keys were lost, stolen, or being copied and used by unauthorized people. Going to electronic cores and electronic keys has allowed us to mitigate the risks posed by the keys that are unaccounted for. What’s more, we will never have to go to the expense of re-keying our facilities again.
Third, even with advanced technology in mechanical keys and locks that have assurances that your key can only be used at your organization, you still have a key or master key that can be as easily lost as with any traditional mechanical key. If a key is lost, your security becomes compromised and the only option is to go to the expense of re-keying the facility or ignoring the lost key entirely. If someone loses the electronic key, the key can be quickly blocked from the system, making it inactive, and the electronic keys cannot be duplicated.
Security: You integrated the electronic lock system with your card system?
Miller: Yes. In May 2007 we began replacing our mechanical lock and key system with the electronic lock system. We have not changed the way people do things. The electronic key works just like the mechanical key they have always used to access our buildings. The electronic lock system works hand-in-hand with both our online and off-line card systems. Now, we not only control who and when someone accesses a building, but we make it easy for anyone inside a building to lock out intruders.
Security: Does everyone on campus carry both the card and the electronic key?
Miller: No. Students carry the PacificCard, only. Faculty and staff members carry both the PacificCard and the electronic key. They use the electronic key to open up facilities for common use or their own area of responsibility such as classroom doors and file cabinets.
Previously we issued mechanical keys that allowed 24-hour access. Also, we had no way to track traffic through our buildings. Now, with the electronic lock system in place, each person’s electronic key is programmed with their own individual access privileges and time schedules. In addition to scheduled access, the electronic lock system gives us an audit trail.
Security: Earlier, you mentioned accountability. Has the electronic lock system provided this for you?
Miller: The audit report the electronic lock system provides us has certainly raised the bar of security on our campus. It also reduces our exposure to HR incidents. We can tell who and when someone has accessed particular buildings at any given time through the audit reports. If they do not have access or are trying to gain entry at an unauthorized time, the electronic lock and key store a record of that event.
Security: What is the single, most important thing the electronic lock system provides you?
Miller: The audit trail is of utmost importance. The system shifts more responsibility onto people when they know that every time they enter a building, it is being recorded.
Miller: The Cowell Wellness Center located on our Stockton campus uses the electronic lock and key system in conjunction with the online card-swipe system. We interfaced the two systems so we can make sure that only authorized people are entering the facility. We have card access on the exterior of the building. When someone arrives to work they swipe their card and then proceed to a key lockbox on the wall where they insert their electronic key, which unlocks the front door so they can enter the building. This is all communicated to the online system. If someone arrives early, the building cannot be accessed because they are out of schedule.
The facility has a prescription medication cabinet area. Before we incorporated the electronic lock system, we were not sure who had keys to the building or who was accessing the prescription medication cabinet. Although the cabinet was supposed to be locked at all times, occasionally someone would either forget to lock it or leave it open because they were returning shortly. Some key-sharing was also taking place.
We installed an electronic lock on the prescription cabinet so any time someone accesses the cabinet the audit trail shows us who and what time they got into the cabinet. The audit trail also tells us if an unauthorized person tries to access the cabinet as only certain people have access rights to the cabinet.
Security: Does University of the Pacific have a department of security?
Miller: The Stockton campus has its own public safety department. Pacific is only one of two private universities in California that have sworn police officers with full police officer powers. Our officers receive and maintain state-mandated training. The safety and physical security of each member of the University’s community are Public Safety’s first priority and their primary jurisdiction is the Stockton campus.
Security: Do you have a security inspection/maintenance system in place?
Miller: We set fixed target dates for the removal and replacement of batteries, reader cleaning for our card-swipe system, APC battery maintenance, and inspection and cleaning of camera housings and lenses. Our preventive maintenance schedule is on-going. The electronic locks require very little maintenance, if any. This has reduced, if not all but eliminated, drill-outs and lock core replacements we used to do.
Security: Is your security system affected by power outages?
Miller: With the card system, any of our buildings have up to two weeks of access if the power goes out. The electronic locks are not affected by power outages and continue to function normally.
There will never be a “the only thing you need” product on the market. Security is part of a comprehensive, multifaceted plan that is implemented at various levels, from education and public awareness to enforcement and penalty. We are not complacent that everything is now safe and secure because we have the card and electronic lock systems in place. We follow up with on-going training, management, and enforcement.