University Security All-purpose cards includeMasterCard debit function
May 1, 1999 12:00 PM
Northeastern University supplies security for an on-campus debit card printing facility.Security capabilities at Northeastern University in Boston have facilitated a unique single-card system for students and faculty members.The Husky Card - as it is called - provides access to residence halls, labs, the recreation center and other campus facilities. It serves as a library card and a balance card for campus services such as vending machines, laundry facilities, student centers and dining halls. The card also functions as an ATM card and an Express Check debit card for banking transactions and debit purchases at establishments accepting MasterCard.
"This is a new category of the student campus card, the only one with off-line debit capability carrying the MasterCard logo that enables purchases to be made anywhere in the world," says Heidi Harring, director of the Bank of the Future division of BankBoston, whose name appears on the Husky Card as the issuing institution.
Perhaps even more unusual, at a secure campus-based facility, students can apply for the cards and wait while they are personalized by a DataCard card printer. "Because the University has blank MasterCard stock, which is worth a lot in the wrong hands, there were strict security requirements for this facility," Harring says. "Cameras record activity in the facility 24 hours a day. There are alarms on the doors and windows. The safe with the card stock is in a secure room within the facility and has a dual access locking system. In other words, it takes two people, each with half the access code, to get into the safe."The design proved to be the deal-maker in the University's drive to provide the on-campus card service. During negotiations, BankBoston persuaded MasterCard to consider allowing the University to print and issue the cards. In the agreement, strict guidelines included security design.
The first security design surpassed budget constraints. "MasterCard and the bank produced detailed physical and electronic security requirements, which meant the cost of securing this relatively small office would be extreme," says James Ferrier, associate director of public safety for Northeastern's Public Safety Division. "Their specifications approached the project as if it were a stand-alone banking facility. They wanted a CCTV system monitored from our campus security center. In addition, they wanted us to build an access control system cabled back to the security center.
"All of that would have added extensively to the cost, especially considering that we would have had to put in fiber-optic interfaces and amplifiers to move the CCTV signal across campus." Ferrier discussed these issues with BankBoston and MasterCard representatives. He pointed out that the facility was not a stand-alone building, but an office within a large administrative building connected to a well-tested, long-standing campus-wide alarm system by Mosler Inc., Hamilton, Ohio, which could accept inputs from a new access control system. In other words, there was no need to pull new cables to link the card facility's access control system to the security center. Ferrier also said the campus employs a 24-hour police force, well-trained to respond quickly to the existing campus network of intrusion alarms and panic buttons.Finally, Ferrier argued against the need for monitoring the CCTV system from the security center. "Our existing alarm system already secured the facility with triple-redundant burglar alarms," he says. "CCTV won't catch a burglar at night. The alarm system and our police officers will catch a burglar. The real function of CCTV in this facility would be to protect against internal theft."In the end, Ferrier's reasoning prevailed. The final specifications fell within the budget.
The facility resides on the first floor of a campus administration building. Card applicants enter from a main corridor through a public access door. Once inside, they approach a deal window with a transaction tray set into a wall, which rises above the drop ceiling to the true ceiling. The walls here and throughout the facility are made of double-thick sheet rock mounted on both sides of the frame.
Employees enter through another corridor door equipped with a Mosler access control system. To get through the door, employees must swipe a card through a reader and enter a personal identification number on a keypad. Inside the first door is a small foyer and another door leading to the office. To pass through the second door, the first door must close and lock. Then employees must swipe their cards through a second Mosler reader and enter their identification numbers on another keypad.
The readers and keypads in the card facility connect to the campus alarm network, a Mosler Comsec system, and send a record of all activity to the security center. The Comsec alarm monitoring system is slated to be replaced this year with a Y2K-compliant Mosler GMS 32 system.Contractors and vendors arriving to handle maintenance chores or repair equipment must sign into the facility under the supervision of an employee.Inside the office, employees deal with card applicants through the teller window in the wall. Students enter from the main building corridor, approach the window and retrieve applications through the transaction tray. They complete the applications and return them. The information on the application is keyed into the system and transmitted to the bank using encryption software supplied by BankBoston and MasterCard. The BankBoston system processes the card information, assigns a MasterCard account number and ships the data, encrypted once again, back to campus.
During processing, which requires only minutes, students are photographed. A Vivitar digital camera, mounted on the office side of the wall, takes the picture through a small opening and transfers the image data to the computer files.
Once the BankBoston system approves the card, the process moves into the personalization room of the office. The personalization room also is secured with double-thick walls running all the way up the true ceiling and another access controlled door.A small number of employees have received clearance to enter the personalization room. To enter, these employees must swipe a card through another Mosler card reader and enter an identification number. Inside this room is the card printing station and a Mosler vault housing the card media. Two authorized employees must open the vault together. Each has half of an electronic-digital combination to the lock.
Three Ikegami cameras monitor the personalization room and the office. A 24-hour, time-lapse videocassette recorder and a Pelco multiplexer record the video.
For the most part, the front office of the facility is staffed 24 hours a day, although cards are only issued between 8 a.m. and 8 p.m. "When the office closes, a public safety officer staffs the front window and provides general information to students and visitors," Ferrier says. "This particular room served as a public safety substation before we installed the card facility, and we have continued that function after-hours."What happens on holidays? "During holidays and recesses, the office is left unstaffed," Ferrier says. "To handle this, we have installed an alarm system separate from the card-swipe access control system used during business hours. This supplemental system includes a redundant set of door contacts on each of the perimeter doors plus interior motion detection and glass break sensors. Mosler provided these devices as well."
Despite the sophistication of the security technology used at the Husky Card facility, Ferrier relies largely on people and procedures backed up by basic technology to provide security across the university's grounds.For example, to gain access to the campus residence halls at Northeastern, students present their Husky Cards to a community receptionist stationed in a booth constructed in the front foyer of each residence hall. The receptionist swipes the card through an access control reader to confirm that the card belongs to a student assigned to the residence hall. The receptionist also compares the picture on the card with the holder. After verification, the receptionist returns the card and buzzes the student into the building."The card access system is only used to interrogate the database," Ferrier says. "We have a person monitoring to prevent tailgating."The residence hall systems operate separately from the campus-wide alarm system and serve only to control access to individual residence halls. Synergistics Inc., Natick, Mass., supplies Northeastern's residence hall access control devices.
If a problem develops at a residence hall entrance, the receptionist presses a lock-in panic button supplied by Allen-Bradley, a subsidiary of Pittsburgh, Pa.-based Rockwell International. The panic button sends an alarm through the Mosler system to the dispatcher in the security control center. The lock-in feature requires officers to respond to all panic button signals. Only an officer with a key can turn off the alarm. Ferrier has installed such panic buttons across campus in offices where problems might arise. He has also placed 60 emergency telephones by Ram Tech, Johnston, R.I., in parking lots and along walkways. The phones have red emergency call buttons that automatically dial the security center and another call button to dial campus extensions. "We encourage people to use our campus assistance phones for routine calls, as we call them, because that helps to remind people where those phones are located in case one is needed for an emergency," Ferrier says.Advanced redundant technology backed up by people characterizes Ferrier's approach to securing the Husky Card production facility at Northeastern.
Conversely, people backed up by technology characterize university security systems designed to protect students and other members of the university community. "Technology can provide back-up, but it's people who protect people," Ferrier says. "You can protect a facility with technology."