If you’re familiar with cybersecurity, you know how valuable user credentials are — and how crucial it is to protect sensitive information with multifactor authentication (MFA). MFA requires users to verify their identity with at least two types of credentials before accessing certain information, devices, or physical areas.
You likely use MFA every day. To unlock your phone, you might use facial recognition or a fingerprint scan, with a passcode required as a backup. To access online banking, you enter a username and password, followed by a unique code texted or emailed to you. At work, you might connect to a VPN with a password and a randomly generated code.
Just MFA protects your digital assets, a tiered approach helps protect your physical keys and fobs. Here’s how.
Before you can implement an MFA-inspired approach to key control, you must first digitize your key management. Keeping keys on a pegboard, in a drawer, or any other easily accessible place is like posting sensitive personal data on a public blog platform. Sure, you don’t share the link and you exclude the page from search engines. However, if anyone knows how to find that site, your sensitive data is there for anyone to swipe.
Likewise, anyone who knows how to find and access your keys can take them and use them to access your assets, whether they’re vehicles, sensitive data, or private rooms.
Protect your keys or key fobs by storing them in an electronic key control system that can automatically authenticate users.
Once you’ve secured your keys in a key management system, you’ll set up user login credentials. MFA involves login options from at least two of the following categories:
Using these principles, you could combine several of the below authentication methods for your key control system:
To give you an idea of how you could implement these methods at your organization, take a look at the example scenarios below.
This isn’t an exhaustive list, of course. Every situation is unique, and these examples don’t apply to everyone. To find the best methods for authenticating your key system users, consider the types of keys you manage, the employees who use them, the physical location of your keys, employee schedules, and any other factors that affect key use.
After you’ve put in the effort to digitize your key control and set up multifactor authentication, it’s important to develop a culture of security throughout your organization. Security isn’t just the IT department’s responsibility. It belongs to everyone. Set up regular employee training on key security best practices. If you already have regular cybersecurity training, consider rolling your key management training into that. Also check with your key control technology vendor to see what system training is available to you.
Once employees know what’s expected of them, hold them accountable. If someone isn’t following your key control policy, address the issue immediately. On the flip side, reinforce good behaviors by acknowledging when employees follow security best practices.
As criminals develop new ways to bypass security, don’t let your physical keys become an easy target. A layered defense is still your best offense.