IT Security's Next FrontierIT Security's Next Frontier

CMS Energy Corp. for about a year has relied on proximity badges to provide and limit access to critical IT systems. Now, the $9.59 billion-a-year energy company plans to integrate physical building security and employee tracking on a single badge.

CMS is on the forefront of an emerging trend to meld security technologies used for building access and IT systems. About 40% of companies identified physical security as a priority before Sept. 11, according to a study by consulting firm Kroll Inc. Now, 89% say it's at the top of their priority list.

"Most every company has re-evaluated physical security," says Bud Chase, director of IS and technology for CMS, in Dearborn, Mich. CMS uses Ensure Technologies' XyLoc Enterprise proximity badges, which give selected employees access to PCs once they're within defined distance from the computers. If the employees leave the area, all access to their PCs is denied.

CMS plans to expand the badges to many of its employees, says Russ Gordon, CMS's operations manager. The move will reduce calls to the help desk, because more than 30% of such calls are to retrieve forgotten passwords.

Ensure said last week that a new version of its XyLoc KeyCard is now compatible with HID Corp.'s proximity cards, which are often used for building access. A deployment of the new KeyCards to 1,000 XyLoc users is priced at about $130,000. That figure would rise to about $136,000 to add the physical-access capability, Ensure president George Brostoff says.

Employees using the Ensure system will have to carry only a single badge for building and system access, making it easier to manage employee access, Gordon says. By integrating IT and building access, CMS plans to reduce the security threat posed by insiders and eliminate accidental information leaks by having screens go blank until an employee with authorization arrives. "People have a tendency to pull away from their system and leave data visible on the screen and accessible," Gordon says. Someone could get access to data and send it to an unauthorized person, he adds.

CMS won't limit its physical and IT security initiatives to building access, Gordon says. The company is looking at the possibility of deploying a product in development from Ensure that will let it determine the location of any employee to within a few feet. Employees will be able to push a "distress" button on their proximity cards, which will send an alert that may dispatch security guards to the employee's location, Gordon says. "When you start combining this stuff," he says, "there are lots of possibilities."