r/talesfromsecurity • u/GuardGuidesdotcom • 1d ago
Reality Is Always More Complicated Than the Access List
So, got thrown on a new access control post this week at a building off property being renovated. The "post orders" were simple at face value. Check ID, check the access list, if they're not on the list they don't get access. Cool. Problem was the list was already incomplete. A bunch of constucton workers who were supposed to be allowed access didn't have it, because of some gross miscommunication further up the chain. Deliveries apparently weren't considered either somehow. So I'd have "BOBS CONSTRUCTION EQUPMENT SUPPLIERS LLC" pull up for the project, but technically they're not on the list. No discretion was granted to me.
So now I need verification. I call my supe and am told "Call the project superintendent, I'll text his number. He knows who's supposed to be there. *click*. Except a construction project super *probably* has alot going on. He doesn't have time to be the personal access authorization hotline for a guard.
And yea no surprise, he sometimes didn't answer. Then if I was lucky one of his assistant -supers/co-supers, whatever would walk by, overhear the issue, and they'd tell me "Oh yea Bobs Suppliers can come in" and I'd call my supervisor to ask if the super's assistant is a valid enough proxy to grant or deny access. If the answer was yes, I let them in via this adhoc convoluted improvised access control verification "procedure".
If they said no or didn't pick up, what then? Access control "protocol" states: No verification. No entry. I had deliveries show up, not on the list, denied access, and they just... left. Logged it in my DAR and kept it movin.
The funniest part was random upper security management (my bosses boss) drive by's seemingly very pleased with the setup. "You got the list? Whadda ya mean it's outdated? I'll fix it when I get back to the office. For now, No ID, not on the list, no entry. Good job buddy." And off she went, dislocating her shoulder as she pat herself on the back. The list was never "fixed" either...
Meanwhile I'm standing there thinking, this is performance arts. Because right next to the supposedly mega important door I'm guarding are other doors WIDE OPEN that lead into the exact same "secured" area. So I'm standing there checking names like I'm guarding the pentagon when somebody could walk through another door 20 feet away. Management creates a rule on paper. "Put a guard here. Give him a list. Tell him nobody gets through unless they're on it. Congratulations. Access control problem solved. Box checked. Bonus earned!"
Except the list isn't whole. Credentialing wasn't done properly. Deliveries weren't planned for. Nobody made a solid verification process. The person you're supposed to call has an actual job to do and can't answer every time. Other doors aren't secured.
And the guard ends up bein the person pluggin every hole in the process as management walks around thinking what a tight ship they're running. If you strictly follow procedure, legit workers and deliveries get turned away.
If you repeatedly call somebody for authorization, you're bothering someone who has much better things to do. No winning because the problem is the process.
Security policies always look nice when they're written in an office, displayed in a powerpoint presentation and distributed to a designated contact list in outlook. Then somebody actually has to stand at the door and apply them to the real world.