Recognizing faces doesn't help much when somebody who got fired last week without security knowing comes back to sabotage the networking equipment.

Exactly.

I work at a place in the centre of a large city in the UK. Security is hot on badges. I especially know this as I smoke, so going downstairs every couple of hours needed a signing in/out session. To be fair it reduced my habit quite a bit.

Now i've got a proper badge - I can flash anything I like, including my drivers license, or my debit card. The mere act of coyly moving something on a lanyard to them is sufficient, especially now i've explained that i've got noise cancelling headphones so I sometimes cannot hear.

The best bit? There are government departments in the building on a floor below us.

Even better - I used to work at a company that used to be part of the security services in the UK but were spun-out. They still work with the doughnut down the road.

In heightened security times they do random checks of cars - mirrors underneath, etc. All I had to do was say "you checked me yesterday" and they'd not bother.

Social norms trump process every time.

The Doughnut = GCHQ (think UK NSA) headquarters in Cheltenham. The building is ring-shaped. (To save anyone else having to look it up.)

I agree but there is a social cost to challenging someone you recognize. Especially if they are in management and I am a contractor.

This is a case where the Nuremberg defence is very useful. If you have explicit policies that are consistently followed, you take away most of the social cost and can even make breaking policy the more difficult choice.

The problems occur in dysfunctional organisations where senior management expect to be exempt from their own rules. Expecting the rules to be bent for your own convenience gives your subordinates tacit permission to bend the rules. Someone who has bent the rules for their boss is far more likely to bend the rules for their buddy. If you're asking people to do inconvenient things, you have to lead by example.

Yes, just look at the example provided by OP. He noticed a security flaw and instead of trying to do something about it he and his companions made a game of exploiting this flaw as much as possible. The employees don't want the inconvenience of actual security.

Manipulating social cost is what you do with social engineering.

If the organization has people that actually care about security they would praise them for practicing good security.

> Manipulating social cost is what you do with social engineering.

definitely one of the more significant parts of the social engineering toolkit.

It should be the same as the General who commended a PFC for challenging him and a manger who acts up in this way should be displined.

If I saw that behavior in a manager who was not in my direct reporting chain I would probably let hr know. but having worked mostly govt contract, pharma, and finance I'm used to rfid badges-- not exactly top security tech-- but it, and photos of employees stored in the system, solve the enployee badge issue.

If you can't swipe to get in you sign in. period.

But the security guard is being paid to challenge you, the social cost is off-set by their wages and you'd have to be an ass to take umbrage at a security guard asking for your pass at the entrance to a secure facility.

My pass used to be checked every day for years, in an office of only 1k people, and a line-manager was the only person who could sign you in without it.

"you'd have to be an ass to take umbrage"

Have you seen our president's twitter account? Some bigwigs like to shit on the little people.

Living in a parliamentary democracy and not being an American citizen, “our President” is literally not my president. Are you referring to the American President, Mr. Donald Trump?

HN needs to become i18n compliant.

Someone saying "our" does not imply that you are part of "we." Our president is not your president.

So if I said "we're getting our carpet cleaned tomorrow," you'd demand to know what I was doing in your house?

A "dumb" plastic ID won't help either because they could still retain a badge they previously "lost".

>Recognizing faces doesn't help much when somebody who got fired last week without security knowing comes back to sabotage the networking equipment.

Any business kinda deserves it if they don't de-authorize their card as soon as they're terminated.

You replied to a comment that presented a situation where a valid card was not needed at all.