Interesting article about student using their personal mobile device to replace traditional keys for physical access. As the article points out…
“The line between corporate-owned and personal devices is blurring, according to a recent survey by Information Systems Audit and Control Association. Two-thirds of employees between the ages of 18 and 34 in the survey said they use a personal device that they also use for work, ISACA found”
The world is quickly gravitating toward consumerization of IT. The traditional IT desktop provisioning process is quickly been replaced by “How do we enable employee access on their smart device?” and “How do we authenticate user on their smart device?”.
The finding does raise an interesting question, “What if the student lost their device?”. Or what if the student dropped their phone? What is the alternate method to regain access. Last thing anyone wants is to have a student to stay outside the dorm in a -30 degree Celsius temperature because he/she forgot the phone at the library.
For many, the term “Password Management” implies password issuance, reset, and synchronization. However, the term “Password Management” is an over simplification for credential life cycle management. And in this case, how do you recover your dorm access at 12:30am in the morning with -30degree Celsius temperature.
The problem is not new, but seemed to have been overlooked by many. The solution is often fall back to the most accessible mean of communication (although the student may decide to throw a rock at his roommate’s window to have him/her open the door).
Most likely, what many people usually end up doing is calling someone for help. In this case, that someone you’re calling could be a computer that recognizes your voice signature on the other side of the phone to provide you with an access code for the next 30 minute. And by the caller id or GPS coordinates, the system recognize the proximity location of the caller is located as a second form of authentication. The system could also lookup the student residency database to make sure the student actually staying at that particular dorm. Perhaps the system could also notify the Resident Assistant of the student floor to let the person assist the stranded student.
How would you design your strong authentication solution today?