About physical security and visitor badges

An interesting conversation came up today. Our building houses multiple tenants and uses a web-based app to pre-register visitors. When they arrive and identify themselves, they receive a printout (think of a ticket) so they can go through the electronic turnstile. Once they arrive in our suite, they identify themselves with the receptionist and are handled to the employee in charge of them. They are not tracked once they leave. Someone mentioned that our company should have a separate system for tracking visitors, possibly a regular label or badge so they can be quickly identified as visitors.

Based on the above, do you think implementing our own visitor tracking would be overkill? I have my opinion but want to see what the community thinks.

Find more posts tagged with

SAVE $250 on Your Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Boot Camps

Comments

DevilWAH

I think its always good to have a badge system for visitors (and staff if you have more than 10-20). Not only is it good for insuring you keep track of visitors and if you insist every one wears there badge (staff or visitor) on display at all time its very easy to see if a non authorized person is on site. But also some people don't have the best memories for faces and names. So in a meeting it can be nice to look at a visitors name badge to remind your self who they are.

My company every door has swipe access, many with a secondary pin you have to enter to access, visitors need to have government issued photo ID just to be escorted on site and if they are a contractor doing work need to have a full security check. Now that might be over kill, but having some lanyards with clear plastic pouches at you reception that the receptionist can hand them that has there name and company, and who they are visiting I think is a nice touch, and once set up should only take a moment for the receptionist to do. Indeed if the ticket they have from the main door has there name on it, then just get lanyards that have a pocket that this would fit in for them to use. As long as that would look decent, if you are going to label them, make sure it looks professional. A well designed company badge with contact details on the back they can take away can actually make you look like a company that is organised and takes care of its customers.

So there is the security reasons to do it, but a number of other reasons as well.

paul78

Yup - agree with DevilWAH - we do same regardless of what the building does for visitor management. You can't outsource your risk - you own it and unless you audit your building's visitor management system and you have access to it.

the_Grinch

All our doors (minus one which is currently being setup) requires a badge to get in. That being said we're a bit more laxed then I'd care to be. At my place though, once you escort them to the elevators they are stuck there with no way back in and just a phone. Thus I think we are more then ok in situations about leaving them once they've completed their work. I have run into two issues though. Two weeks after I started I was heading to logistics very early in the morning. A guy was standing by the door talking on the phone and as I rounded the corner I heard him say he was waiting for someone to let him in. I walked passed him, he says nevermind, and then proceeds to tailgate me. I stopped inside the door and asked if he had ID? It sucks because he was talking on his phone, had files under his arms, and a bag on his other arm. But to me that could have been a classic move to get in. We all have state creds so unless he was very new or not from the State he'd have them. He put everything down and showed me his creds.

Another one was a vendor who was working in our lab. As I entered he stepped right in behind me. I stopped and turned asking if he was with someone from the lab (as at this point I knew everyone)? He said yeah and that he couldn't get ahold of them. I escorted him in and found the person he was with to confirm he was with him. All this said, we have State Police on two floors along with State Detectives so we're in decent shape.

tpatt100

@Grinch- you did the right thing and I try and emphasize we need to train our employees to become more confident to question people we do not know if they attempt to piggy back you. I did it to a maintenance worker who I didn't recognize who just tried to walk into my office area behind my badge swipe, I asked who he was and confirmed it with somebody in my area. People are generally good and want to assume others are good as well and that is how social engineering is the easiest exploit.

TechGromit

cyberguypr wrote: »

Based on the above, do you think implementing our own visitor tracking would be overkill? I have my opinion but want to see what the community thinks.

Were I work visitors are assigned escorts, the escort must maintain visibility of the visitor at all times. There escort duty is not completed until they escort the visitor to exit the gate in the security building. Of course I work in a special environment, not everyone works at a place that has double fences topped with razor wire, armed guards that patrol the grounds with automatic weapons, metal and bomb detectors, and use bio-metric scanners at the entrance gate

Gess

We use escorts as well and have proximity cards instead of all that.

cyberguypr

I never updated this. Old company never cared for security so all efforts were dismissed. I'm at a secure environment now with X-ray machines, big guys with AR15s at the door, etc. One less thing to worry about.