Key Control: From Lockbox to High-Tech Management

There was a day when most organizations controlled their keys by using a simple lockbox fastened to a wall. Typically, a camlock provided all the security that was necessary. In fact, this form of key control remains in use, although in relatively small facilities where security and accountability are managed by a specific department or individual, depending on the size and nature of the organization.

Inside a typical key-control lockbox, keys hang from hooks, each one uniquely identified by a number — typically printed or written on a key tag. Aside from the camlock, no means of accountability typically is contained inside or outside the box. Some models come with a clipboard on which users can sign out a key by hand.

Significant drawbacks include illegible handwriting and a lack of access to the lockbox when a lockbox key holder is unavailable.

Even more troublesome is the amount of time and effort that must be expended to locate a missing key, particularly when it has been missing for some time. Unlike software-driven electronic access control (EAC) systems, where access entries can be tracked in a matter of minutes or even seconds, a manager now must sort through reams of paperwork to find whom it was who removed the key last and failed to return it, assuming it was signed out properly in the first place.

The Move to Electronics

As the necessity for larger key-control systems increased, it didn’t take the industry long to see that an EAC-style method of accountability was necessary.

“In this remote-working world, an administrator no longer has to be on premises to hand out keys,” says Gene Cronin, Medeco XT product line manager. “Authorized individuals can access and remove keys during their scheduled access period without having a supervisor on duty.”

In the case of an automobile rental agency in a large airport, by using a high-tech key-management system, such as Morse Watchmans’ KeyWatcher Touch or Medeco’s Intelligent Key Cabinet (IKC), it’s possible for whomever is at the desk to access the box by using a unique PIN to issue a vehicle key to someone who wants to rent a vehicle.

“KeyWatcher and the whole line of Morse Watchmans products offer a new level of security, trackability, accountability and connectivity over legacy keyed systems,” says Tim Purpura, vice president, global sales and marketing with Morse Watchmans. A variety of  access options allow companies to tailor the system to their workforce. “And the ability to connect disparate systems over a local network makes for a simple setup and seamless usability.”

What makes this type of system so powerful in any facility is that a record of an opening is logged automatically into system memory. Anyone authorized to do so can access it to review the details of the event. Through this log, it can be determined who removed a specific key, when it was removed and when the key was returned — if it was. Armed with a detailed audit trail, the result is the rapid retrieval of missing keys, thus lowering the amount of money spent on replacements over the long term. All of these are selling points to the end user.

To make all of this happen, today’s key-management systems are software-based. An ordinary computer connects to a secured key box, thus opening the door for a high degree of data retention and analysis. This is ideal, because a full report of all missing keys can be generated automatically at the end of each day or whatever interval the user would like. It also heightens the degree of security, because special programmed events can be made to trigger any number of responses to gain the attention of management.

Additional Features & Benefits

This is only the tip of the iceberg. Additional features in electronic key cabinets typical to some makes and models enable management to establish a discernible chain of custody that goes well beyond merely entering a PIN to open the door of a cabinet and remove or replace a key.

Through advanced programming capabilities, you can create access levels to maintain even tighter control of an organization’s high-security keys. This includes the specification of days of the week and the time frame that specific users can open a cabinet.

In some cases, as with the Medeco IKC, dual authentication is supported where two forms of identification are required. A good example of dual authentication is the use of a PIN in addition to a fingerprint. Another option is a user PIN with a proximity card. Combinations of these three credentials — PIN, biometrics and prox card — are available as an option on the IKC, which allows for added security and control, Cronin says. 

The IKC also uses a camera that takes a snapshot every time an event occurs. Now, when you have a biological trait, the user’s PIN and an image, no one honestly can say, “It wasn’t me!”

In addition, the Medeco IKC securely locks in place and charges Medeco XT keys so they’re ready for use. By adding an optional Medeco XT IPD programming device, XT keys can receive programming updates while they charge.

Enterprise-Level Key Management

There are applications that require enterprise-level key control. These systems consist of a series of high-tech key-control lockboxes that connect to a cloud-based system, based on the software-as-a-service business model. These key boxes connect to the internet, typically through a corporate network, through which data is managed on a facilitywide basis.

When many facilities are under one corporate umbrella, the head-end actually might be contained in a computer processing center at a single location — anywhere in the world. If the servers at that center are capable of making near-real-time on-demand changes in processing power, storage capacity and other areas of operation, that’s considered to be a cloud-based system.

Because these key-control systems connect with the cloud, top-level managers can review all security issues or compliance problems that might exist systemwide. For example, if a single facility experienced the majority of “missing keys” notifications each day, steps could be taken to solve the problem.

In some cases, you can connect a client’s key-management system into the software that controls their physical access control system. For example, Morse Watchmans’ KeyWatcher and KeyBank Touch integrate with AMAG’s Symmetry SecurityManagement Software, Purpura says. This streamlines security and eliminates the necessity to program in users who already are in AMAG’s system.

The advantage here is the ability to combine databases. This is a labor-saving feature that also unlocks the power of traditional access control software for the purpose of tracking keys and allows filters, such as time of day, days of the week, one-time pass, etc. Other systems use access control-style software that provides the same functionality as the client’s regular access control system. In either case, the learning curve after installation will be less pronounced, which typically results in fewer mistakes and more efficiency.

So, if you don’t work with high-tech, high-security key-control systems, perhaps it’s time that you consider offering them to your customers. Not only is the initial revenue substantial upon installation, but there also is a recurring monthly revenue component that can’t be ignored. Ongoing maintenance also should be considered, not only from a long-term perspective, but also where it comes to maintenance contracts. These can be rolled into the monthly recurring contract associated with the cloud-based service that you provide.

Allan B. Colombo is a longtime trade journalist and professional in the security and life-safety markets. Contact him at [email protected], 330-956-9003 or www.tpromocom.com.