Access Control: Card, Fingerprint or Face, and Which Door Gets Which?

Not every door needs the same method

The question we hear most is "should we use cards or face scanning?" The honest answer is both, on different doors. Access control answers one question: who can go where, and when. There are three ways to prove identity: something you have (card, phone), something you know (PIN) and something you are (fingerprint, face). One method is fine for an ordinary door. Server rooms and cash rooms should combine two.

Cards: not all are equally secure

Plenty of buildings in Laos still run on 125 kHz or MIFARE Classic. If yours does, treat the card as a key anyone can copy.

Want to move off them without reissuing every card in one day? Install multi-technology readers that read both old and new cards. Hand out new cards one department at a time, then switch off the old technology on a fixed date. Don't let that overlap drag on for a year.

Comparing credential methods

A good face terminal needs liveness detection, such as an infrared or dual-lens camera, so it rejects printed photos and videos on a phone. Before you accept the installation, hold up a staff member's photo on a phone. If the door opens, that terminal doesn't belong on an important door.

Choose by location

General offices: DESFire cards or phones, tied into time attendance.

Server rooms, cash rooms: card + PIN or card + face, with anti-passback so nobody can hand a card back to the person behind them.

Construction sites and mines: hands covered in dirt or oil, or in gloves, mean fingerprint readers fail and the morning queue backs up. Face or card works better. Choose IP65 or better, and give the terminal a roof against sun and rain.

Hotels: guest-room key cards are a separate system. Access control is for staff areas, stores and plant rooms.

Hospitals: touchless methods (face, card) are better for hygiene.

Example 1: a 150-person office, 12 doors

• 10 general doors: DESFire card readers
• 1 server room door: card + face
• 1 main entrance: face terminal that also feeds time attendance
• Networked controllers with UPS and backup batteries for the electric locks
• Decide what each door does when power fails: fail-safe (unlocks) for escape routes, fail-secure (stays locked) for high-risk rooms, coordinated with the fire alarm

Power cuts are frequent in the rainy season, so fail-safe versus fail-secure isn't a theoretical choice. It gets tested several times a year.

Example 2: a mine gate at shift change

Say 400 workers arrive for the morning shift through two turnstile lanes. Estimate time per person, including walking through:

Fourteen extra minutes every morning, multiplied by 400 people, is a lot of paid time spent standing in a queue. That's why we don't recommend fingerprint at site gates. If the queue is still too long, add a lane rather than hoping for a faster terminal.

The hardware behind the reader

The reader is the part you see. The real security is in what's behind the wall.

• Wiegand or OSDP: most readers still use Wiegand, which is one-way and unencrypted, so anyone who reaches the wiring can capture and replay card data. OSDP runs over RS-485, talks both ways, reports when a reader is removed, and its Secure Channel mode encrypts traffic with AES-128. For new systems, specify OSDP with Secure Channel turned on.
• Electric locks: magnetic locks are easy to fit and fail-safe by nature. Electric strikes suit doors that already have a mechanical lock and can be chosen fail-secure. Glass doors that catch strong wind need enough holding force.
• Supporting parts: a door contact so you know when a door is forced or held open, a request-to-exit button inside, and a green break-glass unit that cuts lock power directly.
• Controller on the secure side: mount the controller inside the protected area, never in a box next to the outside reader.

Connecting to other systems

The system becomes far more useful when linked to CCTV: a forced door or rejected card pops up the clip from that door straight away. Link it to time attendance and HR and nobody has to key in attendance by hand. Lifts can limit floors by card. Visitors get temporary cards or QR codes that expire on their own.

Before picking a brand, ask whether the controllers and software support what you need: OSDP for readers, an API for HR, cloud or on-premises management. If the site's internet is unreliable, the controller must be able to decide on its own and open the door without waiting for the cloud.

Contractors and visitors

On mine and construction sites, the hard part isn't staff. It's the subcontractors who change every week. Give each contractor company its own access group with an end date, so every card in that group stops working the day the contract ends. Require a safety induction record before a contractor's card is activated, and print the photo on the card so the guard can check it. For office visitors, a QR code sent by message that works only on the day of the visit saves the reception desk from collecting plastic cards.

Keeping it working

An access system that nobody maintains slowly turns into a set of doors held open with wedges. Every three months we'd check lock holding force, door closers, exit buttons and backup batteries, and test the fire-alarm release on every escape door. Every month someone should review the list of active cards against the HR list. Clean outdoor readers and face terminals in the dry season, when dust builds up on the lens.

Biometric data: collect little, protect it well

You can't change a fingerprint or a face the way you change a password. Good practice: store encrypted templates rather than full images, limit who can access them, tell staff what the data is for, offer a card alternative for anyone who objects, and delete the data when someone leaves.

Mistakes we see often

1. 125 kHz cards chosen because they're cheap, then cloned.
2. Controller mounted on the outside of the door. Pull off the reader, bridge the wires, door opens.
3. Doors not linked to the fire alarm.
4. Staff who left weeks ago with cards that still work.
5. No UPS. Power goes, doors stick locked or stick open.
6. No door contacts, so a door propped open with a rock goes unnoticed.

What we recommend

For a new system, use encrypted cards (DESFire EV2/EV3 or equivalent), not 125 kHz or MIFARE Classic, with OSDP readers. On dusty sites where people wear gloves, use face recognition with liveness detection. Connect HR to the system so access is removed the same day someone leaves. More on our access control and time attendance pages.

Have a floor plan? Mark the doors you want controlled and send it over. We'll suggest which doors get cards, faces or two factors, and which should fail safe or fail secure.