PIN Codes and Access Control
By Tom Piston, East Coast Sales Manager
The use of the PIN Code, or Personal Identification Number, as an access control credential is common and has been employed for just about as long as electronic access control systems have been available. They certainly have some advantages:
- They are free.
- When used in combination with another credential (e.g. a card or fob), the level of security is greatly enhanced.
The best way to make use of the PIN code is to require its use in conjunction with another credential, like an access control card or fob. This provides what is called 2-factor authentication:
- Factor 1 is the card/fob; something you have.
- Factor 2 is the PIN; something you know.
Neither credential works without also using the other, making it a very secure combination of access control credentials.
PIN codes, however, are often used as the only credential. With that in mind, proper management and thoughtful implementation of PIN codes is critical to making sure you have a secure access control solution.
Here are some things to consider when relying solely on PINs. They also apply even if a PIN is used along with another credential.
- The longer the better. Access control PINs are typically 4 to 6 digits. Use as many as you can.
- Avoid sequential numbers like 1234, or 456789.
- Avoid repeating numbers like 1111 or 7777.
- Avoid patterns on the keypad. In the case of a typical 3x4 keypad, like the Farpointe P-640, a pattern to avoid might be 1397 (all 4 corners). When using a 2-column keypad, like the P-620, a similar 4 corner PIN to avoid would be 1209.
- Avoid sequential numbers on the columns of the keypad. Using the P-640 as an example, you would want to avoid 2580 (straight down the middle). If using a 2-column keypad, like the P-620, a number like 4680 should be avoided. Straight down the right-hand side.
- Assign unique PIN codes to each user so that you can know who is gaining access.
- Avoid issuing a common PIN, as it is easily shared, and extremely vulnerable.
Another thing to keep in mind is that not all PIN pads are created equal. Some comprise the entire access control system, by storing the user codes (PINs), and initiating the unlocking process. In these types of applications, a simple internet search can reveal ways to bypass the PIN pad and cause the lock to open. A better solution is a PIN Pad reader, like the P-620 or P-640, that simply sends the PIN code to a complete and robust access control panel, which makes the access decision. This type of reader cannot be bypassed at the door.
When managed and implemented properly, PIN codes are a useful, economical, and reliable type of credential for use in access control applications.
Tom Piston
East Coast Sales Manager