When Trouble Comes To Visit
Sep 1, 2003 12:00 PM
By MICHAEL FICKES
Recent workplace murders have renewed interest in the need to screen visitors entering public as well as commercial buildings. The hope is that proper screening will winnow out people who might cause problems. Separating the vast majority of welcome visitors from the one or two aiming to cause trouble is the purview of visitor management systems.
Systems That Manage Visitors
Companies manage visitors with one of several systems today. The first and most basic approach is a manual system, in which a visitor presents credentials to a receptionist or security officer and signs a logbook. At a minimum, the entries should include the visitor's name and company, the date, the time and the person being visited. Experts believe the protocol of a simple manual system will deter some percentage of unwanted visitors.
A second way to manage visitors simply automates the manual approach. Most of the major access control software packages on the market offer screens that receptionists can use to record visitor information. Automated records improve on manual systems by providing fast basic searches. Ask who visited the building on July 26th, and a list of names will appear. Unlike handwritten lists, automated records are more legible; however, the reporting capabilities of basic systems go no further. On the plus side, visitors entered into access control systems can be issued access control cards.
The third option, stand-alone visitor management systems, automate the sign-in process and can offer photo-identification badges with a digital photo system or scanners that capture pictures from photo-ID's carried by visitors.
Stand-alone systems include powerful reporting functions: Who was on the fourth floor at 2 p.m.? What visitors remain in the building at 6 p.m.?
One of the most important features of stand-alone visitor management is the watch list, which may include anyone who poses a threat, from estranged spouses or partners to terminated employees. Should an unauthorized visitor attempt to enter the facility, the management system will flag the guest, prompting the receptionist to call for help.
Stand-alone systems can also operate at self-registration kiosks that visitors can use to sign themselves in, thus saving work for receptionists. Watch-listed visitors attempting to self-register will be denied access beyond the lobby. Another feature of these systems enables company employees to log onto a Web site and pre-register their visitors.
While stand-alone systems provide many features, integration with access control systems can be difficult. Stand-alone systems can only print visitor passes; they cannot issue access cards. A user can issue access cards from building access control systems and link card numbers to visitors. But to track visitor movements later, a user must check the visitor system for the access card numbers and ask the access control system for a report on the card number. It's clunky, but sometimes practical.
A number of companies offer stand-alone visitor management systems today. STOPware Inc. of San Jose makes a product called PassagePoint. In Des Moines, Iowa, CI3 Software offers a product called Access Sentry. Security Identification Systems Corporation (SISCO) of West Palm Beach, Fla., makes Fast-Pass.
Although none of the visitor management systems on the market today provide access control, it's not hurting business, because access control companies have generally decided against adding building visitor management features into their systems.
"Visitor management is a different kind of application than access control," says Mark Goldstein, a product manager for Software House, Lexington, Mass., which makes the C-Cure 800 access control system. "We offer a basic visitor enrollment component in our software, but companies using visitor management want features such as self-enrollment and pre-enrollment."
That said, the fourth visitor management option integrates visitor management with access control. To promote integration, visitor management companies are forming partnerships with access control companies. "We're working with AT&T, Honeywell, Johnson Controls and Ingersoll Rand," says Becky Rosado, a spokesperson for SISCO.
Which Visitor Management System Should You Choose?
Selecting an appropriate system depends on the type and size of the building or campus, according to Henry Garcia, vice president for Chicago-based Kroll Inc., a security services company.
Small office buildings may not justify automated visitor management technology either. "You can write down visitor names in a log book easily enough," Garcia says.
Experts recommend that managers of larger buildings with thousands of tenants, sophisticated access control systems, and hundreds of daily visitors consider some kind of automated visitor management.
Case History: Adobe Systems Inc.
About 50,000 people visit Adobe Systems Inc.'s offices every year. The developer of software applications employs 3,000 people who work primarily in two high-rise buildings in the company's headquarters city of San Jose, Calif.
About 100 visitors enter each of these buildings daily. Until two years ago, the company used a manual visitor management system, says Mark Domnauer, security operations manager at Adobe. Under this system, visitors to each facility stopped at a reception desk, showed their identification and signed in.
The system worked fine, and Adobe reported no incidents. But there were two problems. First, it took a while for a visitor to get into the building ¡ª an inconvenience that Adobe wanted to eliminate. Second, a security officer interested in finding out when a particular visitor was in the building would have to search thousands of paper files.
To solve these problems, Domnauer has turned to a stand-alone STOPware PassagePoint visitor management system. The system runs on Adobe's network and helps manage visitors in each of the company's facilities.
Computers at the reception desks in each of the two main San Jose buildings have access to PassagePoint's screens. So do security officers stationed at the entrances to the parking garages beneath each building.
Approximately 95 percent of those visiting Adobe's two headquarters facilities drive into the parking garage before entering the building. A security officer in a booth at the entrance of each garage registers visitors as they arrive. Registration includes entering the name of the visitor, the name of the person being visited, nature of business to be conducted, date, time, and license number of the visitor's vehicle.
The visitor receives a parking pass, parks, proceeds to the lobby reception desk and gives his or her name and the name of the person being visited. The receptionist calls up the list of pre-registered visitors and looks for the visitor's name. Finding it, the receptionist asks the visitor to agree electronically to a non-disclosure statement and prints a visitor badge. Visitors that enter the buildings from the street without parking in the garage go through the registration process with the receptionist.
If the buildings did not have underground garages, Domnauer would have set up the system differently. "We would have used self-registration kiosks in the lobby," he says.
Pre-registering visitors in the garage offers search benefits. At the garage entrance booth, a digital camera connected to Adobe's CCTV system grabs a picture of the driver and the license plate of the vehicle.
While the digital video system and PassagePoint are not linked, the procedure makes it possible to retrieve photos of visitors. "To match the data between the two systems, we can run a report on the visitor and retrieve the date and time of a visit as well as the license plate number," Domnauer says. "Then we search the digital video system for the date, time, and license plate and come up with a photo."
The search process also works the other way around. A security officer could begin with the photo of an individual and the license plate taken on a certain day and then search PassagePoint for the license plate and learn the individual's name, who that person was visiting, and why.
Case History: Deere & Company
The larger the company, the more offices it has and the more complex it is to manage visitors. The complexity of the process is driving the integration of visitor management and access control.
Deere & Company, Moline, Ill., for example, provides access control cards for 30,000 employees working at more than 70 sites around the world. The company has used MDI SAFEnet for access control since 1997. Recently, Wesley R. Eller, manager of John Deere Worldwide Security, began upgrading the original system to SAFEnet 2000. As part of the upgrade, he bought PassagePoint from STOPware, with the goal of integrating access control with the management of 50,000 annual visitors.
Eller is currently pilot-testing an integrated PassagePoint-SAFEnet system that involves three buildings at the company's six-building world headquarters complex.
The most challenging element of the integration has been database compatibility. Large companies generally use SQL or Oracle databases on their network servers. The early version of PassagePoint did not work with the SQL databases on the Deere network.
STOPware recently released a SQL version of PassagePoint, and the new product does work on the network, thus enabling Eller to move his integration plan forward.
It's a bumpy ride, though. For example, Eller uses an extract program from the company's human resources database to load employee information into both the access control system and the visitor management system. The visitor system needs a list of employees to link to arriving visitors. "If SAFEnet and PassagePoint were truly integrated, we could use the same employee information tables," he says. "But it isn't that way."
Integration is only one challenge for large companies getting started with visitor management. For example, Eller believes that capturing photos for visitor badges would add to security. "We're looking at this," he says. "But there are privacy concerns. Visitors will provide certain information. But they don't want their photos in our database. And they don't want to give out their driver's license numbers."
While thinking through this issue, Eller is providing visitors with temporary access cards from SAFEnet.
Case History: Sun Microsystems
Sun Microsystems Inc., Santa Clara, Calif., has taken an entirely different approach to managing its 125,000 visitors per year. The company has decided to build its own visitor management system and tailor it to the requirements of its existing InfoGraphics access control system, provided by GE Interlogix, Garden Grove, Calif.
Sun operates out of 300 offices around the world. About 55,000 employees and vendors carry the company's access control cards.
Sun commissioned AP UNIX, San Diego, to develop a visitor management system from scratch. "Available visitor management systems run on Windows," says Steven Kruschke, manager of new technology and applications at Sun. "We use our own Solaris operating system, and we want something that will run on Solaris."
A Windows system would not only conflict with Sun's marketing image, it would require the purchase of Windows hardware. A Solaris system will operate on Sun's own desktops. According to Kruschke, building a proprietary visitor management system will probably cost less than buying a system, given the savings on hardware.
The system being developed for Sun will operate on freestanding lobby kiosks as well as receptionist desks. Visitors will be able to register themselves and print their own passes or go through the receptionist. In addition, employees will be able to log onto a Web site from their office to pre-register their visitors.
The new visitor system will connect to Sun's database in human resources and several other databases. It will also be integrated into the InfoGraphics access control system.