Information Technology Reference
In-Depth Information
table 3.1
iA
2
F V
iews: intent examples
IA
2
F Views
Statement of Intent
People
The intent of the project is to provide expedient access to
the main building for thousands of people (approximately
7,000) within a matter of minutes. Entry detection will be
automated, processing time per person will be <1 second,
and multiple people will be processed simultaneously. Each
person will be assigned an ID card with an embedded radio
frequency identification (RFID) chip. Each RFID will be
uniquely associated per person. The security requirements
of the facility are such that each RFID card will be
biometrically activated by the owner of the card placing her
right thumb (or alternatively registered finger) on a reading
device on the RFID card itself. The RFID card will only
activate for the registered owner, not another bearing the
same card.The intent of IA is to secure the entry/exit
process by preventing signal detection and theft to spoof
the RFID system, and to protect the privacy of individuals
bearing the card (e.g., secure the transmission of biometric
information to the card reader system).
Policy
Existing policies must be modified to include a requirement
that all employees register fingerprints and use a
biometrically activated RFID card to access company
facilities. Security policy should read something to the
effect of entry to organizational facilities requires expedient
validation of a highly secure claim of identity, multifactor
identification. This is accomplished through each person
presenting something she has (the RFID card) and
validating her identity by something she is (a biometric).
Business process
The current entry/exit process of checking picture
identification will remain as a backup process, but be
replaced as the primary means of tracking entry/exit.
Systems and
applications
The intent is to introduce a new entry/exit system that
includes RFID card generation, issuance, revocation, card
reader, entry/exit logs, and log analyis.
Data/information
The intent is to introduce new data into individual personnel
files that includes a digital representation of an appropriate
biometric. The intent is for a right thumb print (primary
means), left thumb print (secondary means), or alternative
given the absence of the former.
Continued
