Thursday, July 10, 2014

Badges, we don't need no stinking badges

Badge blurred for
obvious reasons. It lists my real title as
"Grand Security Bison of the
Loyal Order of the Water Buffalo"
Recently someone pointed out the way I wear my work badge is "unusual". The picture to the left illustrates my particular "style" of wear: no lanyard, clipped to the collar of my shirt. Why do I do this?

This is one of the many ways that I take security seriously as a security professional. If you mind all the small things, like how you wear your badge, often the big things will follow suit.

Just having a badge or access card is "Check box Compliance" as a past manager once told me. Company has photo badges: Check!, No one can see them on their belts: Check!, Lanyard rotates the photo around making the photo useless for identifying someone in a hall: Check!, No one cares if a person walking in the data center doesn't have an ID badge visible: Check! Check box compliance does nothing. Utilizing the tools required by compliance does everything.

ID badges allow for quick identification of individuals and empower anyone in the organization to make a determination if that individual should be in a given area. I prefer wearing my badge this way because it avoids many of the common issues that take a very valuable security tool, like a identification badge, and turns it into one more thing those tinfoil hat wearers in security require that everyone will ignore.

After the jump I will break down my reasons why the way most people wear their ID or access badge defeats the point of the ID in the first place. I will also discuss what you can do to make the ID and access badge process more valuable to securing your organization.

Let's start with this statement: Chances are the way you wear your badge is in direct violation of your corporate security policy. "You have never read my security policy you bald security freak," you may be thinking to yourself. True, but name calling is simply unnecessary. However, I would bet no small amount of money if you work at a company that has combination access card/ID badge system a line exists that reads something like this in your company's security policy:
Identification badges shall be visible at all times to allow for easy identification of all <YourCompanyNameForRealz> employees. <YourCompanyNameForRealz> employees will wear their identification badges at or above above the waist at all times.
This is pretty standard and almost completely ignored everywhere since the beginning of time. I won't lecture on policy violations right now. Instead, let's talk about why how you wear your badge is just as important as the fact that you have one.

1. By clipping my badge to my collar people can feel comfortable looking quickly down from my face to my badge to read my name. This helps foster relationships and is good for security. The best security is accomplished by everyone working together. If you see someone that is out of place in a secure area being able to see their name, report them to security, or simply start a conversation easily to determine if they should be where they are increases the overall security of a location. Placing your badge on your belt means people have to awkwardly gawk at your crotch to try and read your badge. Most people will naturally avoid this. (Most, not all.) If everyone has a badge easily visible the person without one easily stands out and may indicate they are in an area they should not be. 

Such badge. Much ID.
Very Blank. Wow. 
2. Lanyards and retractable badge holders can block badges from view. How many times have you seen someone with a lanyard or belt clip and you can't read their name? The frequency of this occurrence is often proportional to the embarrassment you feel because you need to ask them a question and cannot remember their name. Badge holders that allow the ID to "hide" itself only destroys the value of having ID badges in the first place. Lanyards and retractable holders create an environment where not being able to see identification is acceptable. The clip style badge holder does not rotate and keeps the ID facing forward where it can be easily seen.

3. Lanyards and retractable badge holders often break causing people to loose their badge. Retractable badge holders fall off belts easily. One may find they have been without their badge for hours when it popped off their belt during a walk to the break room. If their badge has access to secured areas someone could find and utilize their access badge before the owner is aware it's missing! Having my badge near my peripheral vision means as I turn my head I am consistently reminded that I have my ID/access badge on my person and in my control. 

4. By wearing my badge near my head it would be very difficult for someone to attempt to grab my badge without me not knowing. A lanyard serves this similar purpose, but suffers from the above mentioned problems. A retractable badge holder on your waist can be easily grabbed or pulled out and the string cut in crowded area without the owner noticing. Wearing my ID badge near my collar means an attacker will need to get very close to attempt to steal my ID/access badge.

Is the way I wear my ID/Access Badge the best way? I think so, but it is not the only way. Consider your organizational needs, how often employees use their badge, and what you really want to get out of a physical access control and ID system. Make sure the corporate policy regarding the display of identification reflects these requirements and then enforce the policy!

The only way to bring value to ID badges and access control is by enforcing policy. Everyone from interns to the CEO must follow policies related to ID badges when inside a company facility. No exceptions. Just like herd immunity policies work best when everyone takes part. If everyone wears their badge and everyone holds others accountable for being able to see proper identification in secured areas spotting an interloper becomes much easier.

Wear your badge where others can easily see it. This one little thing can create a domino effect that makes your entire organization more secure.

No comments:

Post a Comment