Printer Friendly

Electronic safe locks: a new current.

AS YOU READ THIS, A FRUSTRATED person somewhere is trying for the third, fourth, maybe even the fifth time to dial a safe combination. "Just one more try," he tells himself, "and it will open."

He's not a thief. He's at work, carrying out his daily routine. Part of that routine is coaxing the safe open, dialing and redialing until it finally catches, " or whatever it is the lock does in there. His business day can't start until that happens.

For countless legitimate users, the safe takes on an inscrutable and uncooperative persona. It seems to function almost grudgingly, if at all, and then only if the user remembers and correctly performs a mechanical ritual.

Getting close isn't good enough. Some users pay homage to the safe several times a day-"four turns left to 22, three right to 75, two left to 44or was it 77, then 44? Three turns or four? Right or left?" Start again ! Security professionals get direct and indirect exposure to safe and vault Problems. Difficulties caused by these essential pieces of equipment can run the gamut from minor inconveniences to major operational snags and security risks.

Safe problems exact a toll of frustration, embarrassment, wasted time, vendors' fees, and diminished security. A significant percentage of safe problems are lock related.

Some common lock-related safe problems are dialing errors, locks that are hard to open, the need for regular combination changes, slow-running time locks, lost combinations, time-lock overwinds, dual-control problems, safekeeping of combination records, malfunctions, and the cost of service. The problems reinforce the widely held opinion that safes and vaults are costly and irksome-but necessary.

Over the last century the standards, designs, materials, and production methods of combination locks have changed appreciably. Despite all the changes, the basic mechanical principles by which a combination lock operates have not changed.

Now, after more than 10 decades of variations on a theme, safe and lock manufacturers are making large, ambitious technical strides. Their goal is multifaceted: to develop cost-effective, user-friendly, retrofittable safe and vault locks while maintaining or improving the security offered.

Several electromechanical and electronic locks that meet those needs are currently available, with more slated for release. The shift to electronic safe locking has begun in earnest, and the security world is feeling the first drops of a deluge of change.

You may soon be considering purchasing safes or vaults, upgradinxpg existing ones, or drafting security and usage policies for your organization. Electronic locks are among your options, and it will help You to know something about them. MECHANICAL SAFE LOCKS HAVE ALways had some well-known shortcomings, along with others that aren't common knowledge. Until recently mechanical safe locks were the only game in town. To appreciate how electronics enhances security and function, it's necessary to review some disadvantages of mechanical combination locks.

Mechanical locks are hard to operate. Many safe users consider it unusual if their safes open on the first try. They routinely dial and redial. Over a business year, extra dialing minutes add up: Three extra minutes spent every workday amount to 600 lost minutes, or 10 work hours lost every 200 workdays. Lost productive time equals asset drain.

The idea that using mechanical combination locks is hard is a self-fulfilling prophecy; if you think it's difficult, it is. Right or wrong, this perception has the same effect: frustration, lost time, and sometimes needless expense.

Many users incur needless expense by insisting to safe companies' service representatives that their safes "must be broken" because they can't open them. After users hear "There's nothing wrong with your lock - you're dialing incorrectly" a few irritating times, the idea that safes are time-consuming annoyances becomes firmly fixed.

Rather than endure frustration several times daily, users develop bad security habits. A common one is opening the safe in the morning and not locking it until night. Another is turning the dial off by just a few numbers instead of several full turns when locking at night. A third is relying on locking dials rather than scrambling combinations. In every instance, security is diminished.

ATMs would never have had a prayer of catching on if users had been required to dial their personal identification numbers PINS) in the same way safe and vault users dial combinations.

Dialing woes are the first and perhaps biggest problem eliminated by the new breed of electronic safe locks. Indeed, push-button safe opening will be to safe users what touch-tone phone dialing was to telephone subscribers. Many users will be supremely happy if this problem alone can be disposed of.

The new electronic safe locks use "smart" dials or push buttons. This change means no more 4 left, 3 "right" sequences and no more missing a setting by a hair and having to redial. It's easier, faster, and more accurate to push buttons or "dial" digitally. When a safe is easy to open quickly, users are more willing to leave it closed and securely locked during the business day.

Combinations can be hard to remember. Remembering combinations is often a problem even for people who have no trouble dialing. That's especially true when people are responsible for several combinations.

To avoid forgetting, people write combinations down and file or carry them. Thus people risk loss routinely; safes whose combinations are written are only as secure as the places where the records are kept.

Another bad habit of people who are responsible for several containers is to have every combination set to the same numbers. Losing control of the numbers for one puts all at risk.

At least two electronic locks offer alphanumeric keypads. They allow users to compose combinations from easily remembered words instead of strings of numbers. That improves security and pleases users.

The more safe combinations are changed, the higher the annual cost. Good security practice dictates combination changes when changes in access authorization occur, as is the case with employee transfers, promotions, or firings. Vendor costs add up. Previously, those charges couldn't be helped except by two obvious but flawed practices.

The first is relaxed enforcement of combination-changing policies. This practice increases the risk of untraceable "mysterious disappearances." Even an otherwise solid suspect is hard to prosecute successfully if combinations aren't routinely changed after transfers, retirements, and firings.

The second flawed cost-saving practice is having staff learn how to change combinations. This practice often generates new costs.

For example, lockouts can be caused by combination-changing errors, and even temporary denial of normal safe access can mean lost productivity. The cost of solving one such lockout can overshadow the savings of a year's do-it-yourself combination changes.

Also, having combinations changed by staff costs productive time, even when no mistakes are made. Vendors do this work more quickly and more effectively than people who don't do it daily.

Electronic safe locks feature user-changeability without a high risk of lockout-causing errors. Three of the four newest electronic safe locks require no tools for changing. These functions can be accessed quickly, via the keypads, without disassembly.

User-changeable safe locks do more than pay for themselves. The arithmetic of the dollar savings from avoiding vendor fees is irrefutable. That appeals to companies that take combination-changing policies seriously. Security is thus served, and a long-term reduction in cost is gained.

User change functions take into account the fact that it's always best when authorized users are the only ones who know a combination. Often, in the name of expediency, vendor representatives must be let in on the secret. While probably 99 percent-plus of such individuals are trustworthy, most would prefer not knowing your combination.

A mechanical combination lock has one combination. The mare people there are sharing it, the less control and accountability there is.

For example, a supermarket may have three shifts, with two people on each shift authorized to know the safe combination, meaning six people share one combination. In investigating unexplained safe losses, a thorough investigator must scrutinize every combination holder. That can complicate investigations, impair legal actions, and damage morale.

One of the new breed of electronic locks is a multifunction smart lock that accommodates multiple user codes that are selectable, changeable, and deletable by people who have been assigned higher-level master-user codes.

Multiple, individually assigned PINs would be meaningless without a time and date memory for tracking use. The same lock has a 500-event memory that can be reviewed via coded commands. That capacity provides true accountability for multiple-user safes.

if security needs dictate higher security than is provided by standard combination locks, specialized locks must be used. An example is a multicompartment market safe requiring combination locks, a holdup delay lock, a time lock for nighttime protection, and quick daytime access. The cost of the separate mechanical devices necessary for performing those functions is significant, especially if you need safes for several locations.

With procurement costs for specialized equipment come hidden costs, such as maintenance. If you skip maintenance, you can expect lockouts. Again, lockouts equal asset drain in the form of lost productivity and unplanned expenses.

Specialized mechanical locks have specialized problems. Those problems lead to more lost productivity, more frustration, and higher costs.

In terms of multiple functions, the most ambitious of the new electronic locks does it all, making it well suited for use on multiple safes under centralized control. Its functions include multiple, changeable, alphanumeric PINs; programmable time locking; holdup delay; alarm compatibility; time penalty for deciphering attempts; radio frequency shielding; delay-timer overrides for armored car personnel; dual control; master-user feature; push-button or smart-dial code entry; and an audit trail.

In the past 20 years many people have learned how to defeat mechanical combination locks, both surreptitiously and by force. Information and equipment that enable such defeats are more abundant, more diverse, and above all more available now than ever before.

No longer the stuff of movie special effects, autodialers are a new threat that has caused some concern. currently in production and available, autodialers are being marketed to safe and lock service companies. When attached to a vulnerable mechanical safe lock, an autodialer quickly and progressively dials combination possibilities.

Autodialers take advantage of design and production tolerances in mechanical combination locks. Such tolerances reduce the theoretical I million settings of a three-number combination lock by more than 85 percent. Thus, autodialing takes hours instead of days.

Some high-security mechanical combination locks are vulnerable to these machines. Devices even more sophisticated and effective than autodialers exist, though in prototypical form.

High-security mechanical locks are only required to resist 20 hours of surreptitious attempts to discover their settings, whether by manipulation, guessing, radiographics, or robotic progression dialing.

Electronic safe locks are impervious to conventional manipulation techniques. Because they are digital, they can offer all the theoretical million combination possibilities one would expect in a six-digit combination. They defeat progression tryouts with programming that penalizes excessive guesswork.

Thus, tryout times are extended far beyond 20 hours. One lock has a pre-programmed 15-minute penalty, another has a selectable one- to 99-minute penalty, and a third detects and invalidates guesswork.

If entering a combination via buttons takes four seconds, then three incorrect guesses and a 15-minute penalty would take 15.2 minutes, an average of 5.07 minutes per guess. At that rate, 100 guesses would take 8.45 hours (507 minutes). If 100 guesses proved unsuccessful, 999,899 combination possibilities would remain.

Mechanical locks are more vulnerable to drilling attacks. Contemporary Group 2 and high-security Group I mechanical combination locks conform to a standard mounting configuration. Thus several aspects of those locks are common knowledge among people who might wish to defeat them by drilling.

First, the location of the lock and its interior mechanism is a direct function of dial location. Safe drillers use dial placement as a point of reference for drilling measurements.

Drilling into a mechanical lock allows the driller to view and manipulate the components and thus open it. A keypad-actuated electronic lock can be mounted in place of a standard mechanical lock, but a viewing hole drilled into the lock case will not provide any useful insight.

An even greater advantage of electronic locks that get input via wires from a keypad is that the keypad's mounting location doesn't provide any point of reference about the lock's location. Wire runs from a keypad can be inches or feet. Placing a keypad far from the lock or varying lock-mounting locations invalidates many standard drilling measurements.

Safecracking information is readily available through legitimate channels. One locksmith magazine currently markets five volumes of specific and general how-to information on drilling safes, commercial vaults, and even bank vaults. One volume is devoted to photographs and drilling specifics for high-security safes from all over the world.

The publisher's order form stipulates that book orders must be accompanied by "some form of locksmith ID" but also says a photocopy of a business card or business license will satisfy that requirement. WHEN THE IDEA OF ELECTRONIC COMbination locks first took hold, safe makers and security professionals were skeptical. It sounded too good to be true. Pessimists said there were too many potential drawbacks. Indeed, the problems envisioned were enough to make anyone skeptical.

However, these new locks are fail-secure. "If something goes wrong, they stay locked. As for reliability, we already trust electronic controls in everything from appliances to airplanes. Why not in safes and vaults?"

Lockouts from power losses have always been a leading concern. One of the notable new safe locks uses a dial to generate its own power internally, and it doesn't require the "four left, three right" sequence that safe users find so frustrating.

Other electronic locks use common batteries that are accessible from outside the safe without compromising security. One lock can also be hard-wired and then use batteries as emergency power.

Hundreds of thousands of safes with mechanical locks are currently in use. A well-maintained security container can last for decades. Fortunately, companies whose safes use mechanical locks of standard configuration don't have to scrap the safes to take advantage of electronic locking.

The new combination locks can often replace existing mechanical locks without extensive field engineering. In many cases retrofits involve removing and replacing fewer than 10 screws and then simply attaching a wire.

What about new, as yet undreamed-of lock defeats perpetrated by electronics occultists? The war between thieves and safe and lock designers is a long-term conflict that progresses one round at a time. This latest round goes to the makers of electronic safe locks.

It would be naive to assume attempts will not be made. But although various technical defeats for mechanical safe and vault locks are known, at this writing no esoteric defeats exist for electronic safe locks.

As for cost, a couple of considerations are relevant. First, do the safes used by your organization cause any lost time, expense, or inconvenience? Second, would there be any benefit to a security upgrade?

Some people say their organizations have no safe problems or expenses. Their safes provide satisfactory fire or burglary protection, only one person knows the combination, he or she never has dialing problems, the numbers aren't written down, and they never need changing.

Those people are truly fortunate and probably wouldn't benefit from an electronic upgrade. If you can say the same about your company, be thankful. If you can't, consider an electronic safe lock.

Retrofit prices vary from lock to lock and safe to safe according to the specific lock functions needed and the technical difficulty of the retrofit.

Any such expenditures should be approached with a view to long-term benefits. The cumulative saving in reduced access time is a function of how often a safe is opened. The immediate saving is a function of how often the combination is changed, as each change represents a fee that would otherwise have had to be paid out. Enhanced security can't always be quantified on a spreadsheet, but it's worth something.

This article is not an obituary for mechanical combination locks. Mechanical locks are far from obsolete. Their design and function are reliable, and there will always be applications for them. The difference is that now safe users with specialized needs and concerns no longer need to work around their shortcomings. Kenneth Dunckel is a security consultant whose company, SAFECRACKER, offers specialized safe- and vault-related services. He is a member of ASIS. The Numbers Game

HAVE YOU EVER WONDERED HOW many combinations are possible in a particular combination lock? Has an employee ever asked you what the odds are that a thief can open a combination lock he or she has been issued? If asked one of these questions, you probably answered, "I don't know, " or " I'd have to call the manufacturer for information like that."

On the other hand, you could have impressed everyone with your omnipotent security knowledge by quickly figuring out the problem before their very eyes.

A fairly simple statistical formula exists for just this sort of thing. It is called the permutation formula. For this type of problem the formula is P = n[sup. r], where P equals the total number of permutations or possible combinations, n equals the number of numbers on the dial, and r equals the number of numbers in the combination.

We assume that all possible numbers will work. In reality, most mechanical locking devices have limitations. Of course, if the thief doesn't know the particular limitations of your lock, this formula is still valid.

Suppose you issue a padlock to an employee, and the employee asks how many possible combinations it has. You know there are 60 numbers on the dial because it goes from 0 to 59, so n = 60. You also know that every combination used has three sets of numbers, so r = 3. (Some locks open on the last changeable number, and some have an additional nonchangeable number such as zero. If the last number is standard or nonchangeable, we do not include it in our calculation.)

Plugging the numbers into our formula, we have P = n[sup. r] = 60[sup. 3] = 60 x 60 x 60 = 216,000. The answer is 216,000 possible combinations. The odds of a thief getting the correct combination on the first try is one in 216,000, or less than .0005 percent.

Now assume you do not allow repeat numbers in your combinations. In other words, combinations like 5025-50, 10-10-10, or 8-8-16 are not permitted. The permutation formula for counting the total number of different permutations is
 P = _____
 In our example we now have
 n! 60! 60!
 P = ____ = ____ = ____
 (n-r)! (60-3)! 57!

If you have a calculator with a factorial key (!), just punch in the numbers. (A factorial is the product of all possible integers from one to a given number. For example, 4! equals 4 x 3 x 2 x 1.) If your calculator does not have a factorial key, just simplify further: 60! 60 x 59 x 58 x 57! 57! 57 ! 60 x 59 x 58 = 205,320 The answer is 205,320 possible combinations with no repeat numbers. The odds of a thief getting the correct combination on the first try is one in 205,320, still less than .0005 percent.

Let's look at another example. An electronic keypad used for area access has buttons or keys with numbers from 0 through 9. To enter the restricted area, you press four keys in the correct sequence and the door opens. What is the total number of possible combinations? P = n[sup. r] = 10[sup. 4] = 10 X 10 x 10 x 10 = 10,000, so 10,000 combinations are possible. The odds of a thief getting the combination correct on the first try is one in 10,000, or .01 percent. With no repeat numbers, the odds are about .02 percent.

So the next time someone asks, "How hard is it to guess a combination?" just pull out your formula and amaze him or her with your statistical knowledge. John W. Plifka is manager of government security at Rosemount Inc. in Burnsville, MN. He is a member of ASIS.
COPYRIGHT 1991 American Society for Industrial Security
No portion of this article can be reproduced without the express written permission from the copyright holder.
Copyright 1991 Gale, Cengage Learning. All rights reserved.

Article Details
Printer friendly Cite/link Email Feedback
Title Annotation:Special Issue; includes related article
Author:Dunckel, Kenneth; Plifka, John W.
Publication:Security Management
Date:Nov 1, 1991
Previous Article:Armoring ATMs against attack.
Next Article:Rural surveillance: it's no walk in the woods.

Related Articles
Safe lock up.
The key to campus security.
Lock in a good key policy.
Electronic locking system.

Terms of use | Copyright © 2017 Farlex, Inc. | Feedback | For webmasters