The zero trust approach is driven by everyday problems: access control in many companies, institutions, office buildings and commercial properties is still based on classic locking concepts. Once assigned, access rights remain in place for a long time and are static. If changes are made, this usually involves a significant amount of manual programming work to update the offline door components. The result is an enormous administrative burden. At the same time, the need for greater security, traceability and flexibility is growing, for example, due to NIS 2 or ISO 27001.
Seamless connection to digital interfaces
This is precisely the area in which a modern understanding of zero trust is required. Instead of universal and permanent authorisations, access options are assigned specifically and accurately. Modern electronic access systems make it possible to authorise every identification medium precisely. In addition to identity and role, the time and location restrictions required for each access permission are also considered. This is based on a central identity and authorisation management system that automatically controls all access and unauthorised access attempts, ensuring compliance with GDPR.
In practice, this approach is gaining in importance, particularly due to its ease of integration with existing IT infrastructures. Integration with central master data systems, such as Microsoft Entra ID, allows synchronisation of personal master data almost in real time. This means that new service providers or departing staff can be quickly authorised or blocked in the access control system. Authorisations can be assigned automatically and adjusted on a daily basis. If an employee or service provider is deactivated in the system, the associated access rights are also invalidated. This reduces administrative work. At the same time, control and transparency is increased.
A typical example from everyday life is the work of building service providers. Cleaning staff often work at off-peak times and in many different areas of a building. In the past, keys had to be disabled manually. Modern electronic access control systems operate based on access authorisation periods. Used in conjunction with virtual networks and the necessary interfaces, these periods expire automatically. This is where the focus lies today: authorisation cannot be granted if a service provider’s permissions are blocked. This means that they only have access to the rooms that are specifically assigned to them. This reduces the administrative burden and eliminates the time-consuming documentation typically associated with mechanical locking systems.
