Is there any security benefit to separating an RFID chip from an ID badge?

Question

This seems to be a question that blurs the line between physical and IT security, but I'm hoping it's relevant enough!

In order to meet with PCI standards, our company recently switched from an open door with after-hours hand scanner, to an RFID+Security badge system.

I was just informed today (it wasn't part of our training procedures, hooray!) that keeping the RFID key fob on the same lanyard/chain/etc as ones ID badge is verboten. Now to me this seems absolutely pointless and probably more dangerous, because now if either my fob or badge is stolen it seems that the reasonable assumption would be "Oh, I just misplaced it/forgot it/it fell off in my car/etc."

Is there any valid reason to prohibit physically connecting (e.g. sticking them on the same keyring) the identification mechanism (my badge) from the authentication mechanism (my fob)?

Answer 1

Yes, because if you have them together and lose them anyone could walk in with your credentials. Security guards rarely match faces to cards, chances are anyone looking remotely like you would have free access.

Here's a scenario: Employee A is going on vacation for 2 weeks. During his celebratory drinks he drops his ID+tag dongle, which he also has his unencrypted company issued USB memory stick also conveniently connected to. Unsavory character 1 picks up this handy combo, and seeing that his friend, unsavory character 2, looks a lot like this drunken idiot, and overhearing that he's going away for 2 weeks, decides to give it to UC2, who uses it to steal all sorts of company property. That's why having both together is a very bad idea.

Answer 2

It sounds kind of like they themselves may be doing it wrong. For PCI compliance they are probably had to put in a two factor authentication system. The idea with two factor authentication is that you must use 2 out of the 3 basic factors. (Who you are, what you know, what you have.) The idea is that while it may be easy to get any one of these things, it is harder to get two of three and too intensive to go for three of three.

In the ID badge + RFID, it is really just two of what you have, particularly if there are no guards. Without some mechanism to actually check the a)validity of the badge and b)the biometrics match (typically both done by a well trained guard or some automatic biometric equipment checking a database) then it really just becomes two items of what you have. Having two of the same type of factor does very little to provide additional security as both could be compromised in the same manor. You still need them with you and it would be a simple matter of a mugging to get both.

In fact, the very idea that they do not want the ID badge and RFID together indicates that they are aware that it is really two things you have since if it was either who you are or what you know, then there would be no risk to a lost token and an id badge.