Every time you badge into an office, punch a code into a keypad or unlock your phone with your face, you are using some form of access control: a system designed to decide who is allowed into a space or a resource, and who is not. While a simple lock and key is technically a form of access control, modern security relies on several layers of technology working together. Understanding the basics helps make sense of the security choices businesses and buildings make every day.
The three factors of authentication
Security professionals generally describe access credentials in terms of three broad factors:
| Factor | Description | Examples |
|---|---|---|
| Something you have | A physical object that grants access | Keys, access cards, fobs |
| Something you know | Information memorized by the user | PIN codes, passwords |
| Something you are | A physical characteristic unique to the person | Fingerprints, facial recognition, iris scans |
Combining two or more of these factors — for example, a card plus a PIN — is called multi-factor authentication, and it is significantly harder to defeat than relying on a single factor alone.
Mechanical keys: the original access control
Traditional mechanical locks work by matching the unique pattern of a key to pins inside the lock cylinder. When the correct key is inserted, the pins align at a specific point called the shear line, allowing the cylinder to turn. Mechanical keys are simple and require no electricity, but they have real limitations: keys can be copied without the owner’s knowledge, and if one is lost, the lock often needs to be replaced or rekeyed entirely to stay secure.
Card and fob-based systems
Many offices and buildings have moved to electronic access cards or key fobs, which communicate wirelessly with a reader using a technology called RFID (Radio-Frequency Identification) or the newer NFC (Near-Field Communication) standard. Each card carries a unique identifier that a central system checks against a database of authorized users before unlocking the door.
This approach has clear advantages over mechanical keys:
- Lost or stolen cards can be deactivated instantly without changing the physical lock;
- Access can be limited to specific hours or specific doors for each person;
- Every entry attempt can be logged, creating an audit trail of who accessed what and when.
PIN codes and keypads
Numeric keypads are a low-cost way to control access without issuing physical cards to every user. Their main weakness is that a PIN can be shared, written down, or observed by someone standing nearby — a risk known as “shoulder surfing.” For this reason, PINs are frequently combined with a card or a badge as a second factor in more sensitive locations.
Biometric access control
Biometric systems verify identity based on a unique physical trait rather than something a person carries or memorizes. The most common types include:
- Fingerprint scanners, which map the unique ridges and valleys of a fingertip;
- Facial recognition, which analyzes the geometry of facial features;
- Iris or retina scanners, which read the unique patterns in the eye, used mostly in very high-security environments.
Biometrics are convenient because they cannot be lost or forgotten the way a card or password can. However, they raise legitimate privacy questions, since biometric data is permanent and sensitive — unlike a password, a fingerprint cannot simply be changed if it is ever compromised.
How access control ties into a broader security system
In most modern buildings, access control does not work alone. It is typically integrated with video surveillance, alarm systems and visitor management software, so that an unusual access attempt (such as someone trying to enter outside of normal hours) can trigger an alert or be reviewed later on camera footage. Centralized software also allows security teams to instantly revoke access for an employee who has left the company, something that was far more cumbersome with traditional keys.
Choosing the right system
The right access control setup depends heavily on the context. A small office may only need a basic keypad or card reader at the front door, while a hospital, data center or government building may require multiple layers: a card plus a PIN to enter the building, and biometric verification for restricted areas inside. Balancing convenience, cost and the sensitivity of what is being protected is the central challenge in designing any access control strategy.
Access control is one of the foundational topics in the private security field, alongside surveillance, patrol procedures and emergency response. If this area interests you as a career path, Cursa offers courses that cover the practical and theoretical sides of property and private security work.
