Elevator access control and security systems

Unique security vulnerabilities of elevators and how to solve them

When it comes to access control, securing the elevator might not be at the top of your priority list—but it should be. Elevators are high-traffic areas that are prone to a number of security vulnerabilities, and they pose additional challenges from a building security perspective. Understand these vulnerabilities, and why an elevator access control system is a better way to safeguard your facility.

Types of elevator security systems 

There isn’t just one type of elevator. While all elevators do the same job–move people throughout a building–depending on the size of the building, how many people need elevator access, and the level of security in the facility, the type of elevator can vary greatly. Understand the difference between elevator security systems to know which type is right for your business.

Single elevator access control 

As the name implies, this type of elevator access control is for one elevator only. Common in smaller buildings with fewer floors and fewer daily users, a single elevator access control system can still provide decent security. For example, installing an RFID door lock reader will require users to have an authorized credential to operate the elevator controls. Single elevator access control systems may also have the ability to set a schedule for the elevator door lock so that it’s inoperable after-hours or on weekends. 

Elevator banks security systems 

In larger buildings, you’re more likely to encounter elevator banks, which have multiple cabs to move more people at the same time. While multiple lifts are more convenient, they pose a great security risk. As part of a complete physical security strategy, more monitoring and better elevator access control are needed to make sure only authorized people are able to use the elevators. Floor-by-floor access permissions can keep elevators more secure in multi-tenant buildings, where only certain individuals need access to specific floors. In high-rise and enterprise-class buildings with multiple lift banks, certain banks will go to specific floors, further limiting who can use each elevator. Utilizing elevator card readers, elevator keypads, or mobile credentials is a smart way to control who has access throughout the building. 

Smart elevator and destination dispatch elevator security 

The newest type of elevator security, smart elevators are faster and more efficient than traditional systems. The best use case for smart elevators is in larger buildings with 10+ floors; they’re quickly gaining popularity in downtown areas with high-rise offices and hotels, and multi-tenant buildings with elevator banks. Smart elevators rely on a centralized destination control system (DCS), in which users key in which floor they’re going to, so there’s no traditional up/down buttons, and in newer smart elevators, no individual push buttons inside the elevator cab. The destination dispatch lift technology works by grouping floors and requests based on which cab is logistically the fastest. The result is fewer stops on fewer floors. This helps reduce lobby congestion, and also prevents people from cramming into elevator cabs during peak hours. 

Though more expensive than traditional options for elevator banks, destination dispatch elevator access control also offers better security. Credentials, such as elevator cards or a mobile-based app, can be permissioned for specific floors. As soon as the user presents their credential, the elevator control system calls the lift to take them to their assigned floor. A smart elevator access control system improves security by only going to the specified floor, so tailgaters can’t hop on and get a free ride anywhere else. Similar to single elevator access control systems, destination dispatch elevator security also gives building managers the ability to set schedules for the elevator door locks, and track access activity. Many organizations have their smart elevator system paired with other elevator security systems, such as turnstiles and elevator access control card readers, to further limit who can access the property. 

Elevator security vulnerabilities

There are approximately 900,000 elevators in the world giving 325 million rides a day. Here are four security vulnerabilities that every building manager with an elevator needs to consider to keep these elevators safe:

1. Elevator tailgating and hitchhikers

Whether you have a key card or smartphone-based elevator access control system, it’s natural for people without this kind of official credential to hop on board the elevator for a ride. An intruder could take advantage of this and follow someone into the elevator. Most elevator riders will not serve as de-facto security guards who challenge and stop others from hitchhiking or “tailgating” a ride – especially when the elevator has a lot of traffic.

You can combat this elevator security risk by installing turnstiles to limit access to the main lobby where people enter the elevator. This will keep unwanted visitors out of the area where elevators are in the first place. 

2. Elevator vultures

When a tailgater gains access to the elevator, it might not be possible to go to a specific floor without typing a code into the elevator security keypad, or swiping at an elevator card reader. That’s when the intruder becomes an “elevator vulture,” who hangs out in the elevator and waits for someone else to push the button for their desired floor. The busier the building, the more often the elevator goes to every floor—and the faster the vulture gets to where they want to go.

To mitigate this elevator access control risk, make sure each floor’s elevator access control requires individuals to pass through a credentialed barrier door after exiting the elevator. Installing access control readers at office doors, or additional turnstiles for larger buildings is a smart idea. 

3. Button pushers

Some individuals in your building will have an elevator card or smartphone with universal access; for example, a manager, janitor or maintenance person. These individuals might not be attentive to what’s happening after they unlock the elevator. An elevator hitchhiker or vulture might gain instant access to any level by pushing the button at just the right moment and piggybacking onto the universal access.

Utilize your elevator management system settings to help prevent this vulnerability. Requiring elevator riders to use their smartphones or key cards both when calling the elevator and when choosing the desired floor can solve this security concern. Limit the elevator access control system to accept only one button push per swipe. By connecting outputs from the elevator buttons as inputs to the elevator access control system, the elevator control system will reset and require another credential authorization after each button push, effectively preventing piggybacking. This will also provide better reporting on exactly who has sent the elevator to which floor and when. 

4. Fire mode vulnerabilities

Building codes require every elevator to have a “fire service mode” as part of the elevator control panel. Unfortunately, hackers have discovered ways to bypass elevator security systems with the fire service mode. When activated by pressing a readily visible button, this necessary emergency feature allows you to bypass all the security features and elevator access control systems. Although the button calls the police and fire department, an intruder could gain fast access to any level by pressing the emergency button.

In addition, fire service keys are usually the same for all elevators built by a specific brand. Fire departments use these keys to override the elevator security system in emergency situations, but they’re readily available for purchase online. A criminal in possession of this key gains immediate access to any floor.

Configure your elevator management system and elevator access control to send out an automatic alert to security personnel, office managers and other important parties as soon as anyone activates the fire service mode or uses a fire service key. This allows you to dispatch police and investigate the matter quickly. Integrated elevator security cameras can give you a quick visual of the situation as it’s happening, too.

Which type of elevator security technology is right for your business?

To take your elevator security to the next level, it’s time to go beyond just pushing a button to access your floors. Installing access controlled commercial door locks is the first step to improving your elevator security posturing, but there are additional factors to take into consideration. Choosing the right elevator access control system components can make all the difference in securing your space.

Elevator security keypad and PIN readers

With an elevator security keypad, users need to type in a passcode or PIN in order to use the elevator controls. One of the benefits of elevator security keypads is that building managers won’t need to issue key cards or fobs to each user, making this a more cost-conscious option. However, it’s easy for people to share their access code or PIN number, so it’s not the most secure choice. Plus, elevator keypads are not a touchless solution. In large and busy buildings, elevator security keypad access is a cumbersome solution, and would be difficult to accommodate people going to different floors within the same cab. But elevator keypads may be a good option if you just need to add extra security to access a specific floor in a smaller building.

Elevator card readers 

A popular option, this type of elevator access control requires users to swipe or scan a key card or fob at the elevator card reader installed inside the cab. Using RFID technology, elevator card readers can accommodate many different types of credentials, and are easy to use. One of the downfalls of using key fob and card systems for elevator security is that the credentials are commonly lost or shared between coworkers, and key cards are easily compromised. For the best security and auditability, use an elevator access control card reader that can track unlock activity, and always choose cards with the highest levels of encryption. Before installing elevator card readers, check your elevator control system’s power and wiring needs. An elevator access control system could get expensive if rewiring is needed.

Mobile elevator access control credentials

To future-proof your elevator access control, consider updating to a mobile-based system. Rather than physical badges or key cards, mobile elevator access control uses smartphone apps and digital credentials to allow access. Mobile elevator security systems are more convenient for users, and more secure. As a truly touchless, smart elevator security option, Openpath’s mobile system features Wave to Unlock, which lets users trigger an unlock with a quick wave of their hand. By associating each individual user with a specific floor, mobile credentials can improve security, and prevent unauthorized individuals from getting into places they shouldn’t be. 

Mobile credentials can be used in a commercial keyless entry system for any type of lift, whether you have a single elevator or multiple. Smartphone-based access control is a great option for buildings with destination dispatch and smart elevators. The mobile technology is easier to manage than elevator cards, especially for enterprise-class businesses with thousands of users.

Cloud-based elevator system management 

One of the best ways to fortify your building security is to invest in cloud-based elevator system management. Today’s businesses need to be agile enough to respond quickly to any security vulnerability, and the cloud allows that flexibility. With the ability to access the elevator system management platform from anywhere, cloud-based security software is ideal for managing any number of buildings or locations from a centralized dashboard. Remote access not only gives administrators visibility into building activity on any device, it’s also a key factor in faster incident response times, more efficient security management, and improving the user experience.

Cloud-based elevator system management is essential for auditability. With detailed reporting of who accessed which floors, and which credentials were used at certain times, building managers can quickly run audits in the event of a security breach. In addition, cloud-based systems have the benefit of custom and granular permissions for elevator controls. By setting access privileges at the user level, administrators can better control who has access to specific spaces and buildings, even across an entire multi-site enterprise. The remote features of a cloud-based system also allow admins to be able to give access to employees or visitors from anywhere in the world. With greater visibility, control, and access to key security settings, cloud-based technology is becoming a must-have for enterprise-class elevator security management systems.

Elevator security cameras

Elevator access control is just one component of a good elevator security system. To add visual verification of what’s going on inside your lifts, you’ll also want to install elevator security cameras. Not only do elevator security cameras deter criminals who don’t want to be caught on video, they’re also helpful for auditing any security incidents. When integrated with the elevator access control system, building administrators can easily associate all access activity with a real-time video feed. The best types of elevator security cameras are easy to install and configure, and have additional features such as zoom, tilt, and low-light settings to optimize the visual monitoring experience.

Supplement your elevator security cameras with additional video surveillance for better awareness throughout the building. Access control video readers can provide a better facial ID than a camera installed high up on the wall, for example. You’ll also want cameras placed near the elevator banks, and on each floor to monitor any activity once somebody exits the elevator.

Elevator control panel

When you need to call an elevator or select a floor, you rely on the elevator controls to do the work for you. That’s why the right elevator control panel and controller technology is essential to the everyday functions of the system. The elevator control panel, which houses the elevator controller boards and power supply, is responsible for securely conducting all the elevator operations: elevator door lock control, cancelling lift calls, measuring car load, and floor selection. The panel communicates over the network with the elevator control system software for tasks including user authorization, door lock scheduling, and communication with input/output devices connected to the elevator control panel. For the greatest flexibility and adaptability in your elevator controls, look for panels that have additional relays and auxiliary I/Os with end-of-line monitoring to securely connect additional readers and sensors to your elevator control panels.

Using the elevator shouldn’t be complicated. That’s why elevator control panel design also matters. Elevator access control reader placement, button organization, and door elevator controls should be easy to use and navigate by any user or visitor. In addition, pay attention to where elevator controls and readers are installed to ensure your elevators are ADA compliant. In touchless elevators with destination dispatch, you may consider an elevator control panel with no buttons inside the cab, since users are automatically routed to their specified floor via the destination operating panel after credentialing in.

Integrated elevator access control security

As IoT-connected devices continue to flood the commercial market, your elevators are no different. One of the best ways to improve security posturing in workplaces and office buildings today is to offer touchless, convenient access to users through destination dispatch. An integration with Openpath’s elevator access control and braXos’s destination control system offer businesses a touchless elevator access experience, plus added security. It works by letting users control the elevator door locks with their smartphones. Floor-by-floor mapping and granular access permissions limit which users can access which floors, and the whole elevator control system is completely contactless.

Integrated elevator security also allows the system to take automated actions based on triggers from other building platforms. For example, in the event of a fire alarm, an integrated elevator security system can automatically lock down the lifts, and send an automated alert to security personnel and first responders.

With Openpath’s integrated elevator access control and visitor management, the guest experience is easier and more convenient. Once a registered visitor, contractor, or vendor checks in, they’d automatically receive digital guest pass credentials for their specified floors and timeframe. This type of integration makes it easier to route visitors through the building, without compromising security. 

Best practices for complete elevator security

It’s important to remember that your elevators will always represent an access security vulnerability. Following these elevator access control system best practices helps keep your building safe from common threats and vulnerabilities.

• Even the best elevator access control systems are only one method of reducing security risk in a commercial building. Always include additional access control and security methods to limit who can gain entry into high-security spaces. 

• Combine multiple forms of access control to prevent intruders from gaining unauthorized access. This can include access control readers at the front door, lobby turnstiles, and requiring elevator card or mobile credentials to access elevator door locks.

• Personnel should be able to easily monitor access to your elevator banks. This can include a reception area or stationed security guard, as well as elevator security cameras installed in each lift. Utilize the remote functionality of cloud-based elevator security cameras and integrated solutions to optimize security monitoring.

• If you don’t have destination dispatch or smart elevators, consider installing an elevator card reader or keypad both to call the lift, as well as inside each cab to select a floor.

• Take advantage of automated triggers and security alerts through your elevator management system for faster response times from on-site personnel and emergency teams. 

• Install video surveillance around elevator bank lobbies, as well as elevator security cameras in each lift for better visual monitoring capabilities. By tying access activity to video footage, you’ll have a visual record of exactly what happened, where it happened, and who was present.

• Choose your elevator access control credentials carefully. Keep in mind that elevator cards and keypads are more vulnerable to misuse than smartphone-based credentials. 

• Building and office managers also need to educate employees and residents on common elevator security concerns, such as elevator tailgating, and how to avoid them.

• Smart elevators with destination dispatch can be configured for a totally touchless elevator access experience. Give your employees, staff, and visitors greater peace of mind by using contactless mobile credentials to grant specific floor access, and the option to use digital QR codes for visitors.