Your access cards can probably be copied

Most cards were never designed to be secret

Many buildings in the region still use 125 kHz proximity cards. These cards broadcast a fixed number when they are near a reader. There is no encryption and no challenge. Readily available handheld devices can read a card from a short distance and write the number onto a blank card in seconds.

MIFARE Classic cards, common in the 2000s and 2010s, added encryption, but its weaknesses have been public for many years and tools to recover keys are widely available.

What to move to

Current practice is a card with modern, open cryptography and site-specific keys. MIFARE DESFire EV2 and EV3 use AES-128 and support key diversification, so each card holds keys derived from its own unique ID. Mobile credentials on phones are also a sound choice where staff accept them, provided the platform's key management is understood.

The card is only part of the answer. If the reader sends the card number to the controller over an unencrypted Wiegand wire, an attacker can tap the wire. OSDP with Secure Channel encrypts that link and supervises the reader.

Who owns the keys

Ask your integrator one question: who holds the encryption keys for our cards? If the answer is "the manufacturer's default" or "we're not sure", the card technology matters less than you think. Keys should be site-specific, documented, held by the owner under control, and handed over at the end of the project.

Migrating without a disruptive switchover

1. Audit the current card population and the readers in use.
2. Install readers that accept both the old and the new credential.
3. Issue new cards by department or building, and deactivate old cards as each group is done.
4. When the last group is migrated, disable the legacy technology on the readers.

Use the migration to clean the user list. Former employees and contractors with active cards are among the most common findings in access control audits.