If password expiration is applied, should door-lock expiration be applied too?

Question

After reading some topics on here about password expiration, and also after reading this comment, a question arose in my mind: if we apply password expiration for the safety of users, should our door locks' keys also expire?

By door lock, I mean any physical restriction access we might have, e.g., lock(s) on the server room door, on the company's building entries (including maybe the backdoor for firefighters or so), vaults, etc.

For physical key-based door locks, this would mean issuing a new metal key every X months/days/whatever, get the old key back, and provide the new key to users (assuming they still are allowed to open the door). Sounds pretty heavy and complex, but it might help against copied keys or so.

For electronic-based door locks, this would mean reissuing new passwords/key accesses so the RFID/whatever card would need an upgrade with the new access key. Sounds lighter to do, even though it still requires all employees that are allowed access to do the upgrade one way or another. Here, I assume the electronic card holds a "session token" somehow, not a never-changing user ID that the lock would compare to a database of allowed users (in such a case, the user ID itself on both card and DB would need to be rotated).

So, is such a policy applied in some companies, standards, etc., or is it just a dumb idea I had?

---

Edit:

IMO, it indeed seems like quite a heavy process (more something you do after you know a key has been compromised), but maybe you are aware of high-risk companies or specific companies that do such rotation? Then, for what reasons (if both are not confidential!)?

Answer 1

You asked, ‘if passwords should expire periodically, then should door locks expire periodically?’. Well, from a false premise you can derive any conclusion! The premise of periodic password expiration is foolish and counterproductive and damages security by imposing pointless administrivia on users for feeble defense against hypothetical attack vectors.

Of course, if you have evidence that a key has been compromised—e.g., in a photograph published by a major world newspaper—then it certainly may be prudent to change the locks, as it may be prudent to change your Facebook password after Facebook reported logging passwords in plaintext for years.

Answer 2

Password rotation policies are in place to reduce specific risks which allow an attacker to get (and use) the user’s password. These risks are password reuse, credential phishing or other forms of social attacks to get the password, compromise of a server and thus access to the hashed passwords or brute forcing.

None of these risks really apply for physical locks in the same severity as for passwords, i.e. there is no reuse of the same (strong) key for other places, no remote credential stealing using phishing, no common compromise of a central server to access all the keys and no practical brute force attacks.

Loss or stealing a key is still possible but much different from a phished key since the person is no longer in access of the key. Cloning of a key requires temporary physical access to the key and thus is much harder to go undetected. And in all cases the use of the key requires physical access to the specific lock and cannot be done from remote or from somewhere in the local network.

In other words: The risks with physical keys are different and the usefulness of key rotation is much less than with password. Additionally the costs of such risk mitigation is different: Not only is key rotation much less useful with physical locks but is far more expensive to implement, since locks would have to replaced and keys have to be physically distributed.

Therefore the risks with physical keys are best contained in different ways, like having hard to clone keys or having cameras on the most sensitive locks to monitor who is opening the lock. Moreover physical locks and keys might have additional risks which passwords don't have, like being vulnerable to (often easy) lock picking without the need of the original key. Rotation would not really protect against these new risks anyway.

Answer 3

In some places, apartment owners change locks after renting out the apartment if they don't have a particular trust with the tenants. (I seem to recall that with some kinds of mechanical locks it's possible to change the matching key without replacing the entire lock—not by yourself though, you call a specialist mechanic for that.)

And afaik hotels these days routinely change ‘keys’ that open electronic locks, every time a guest checks out. (Not sure about the mechanics: either info on the key card and lock is changed, or correspondence of RFID cards to the rooms.)

You could also consider storage lockers at train stations and such: they're sometimes set up with combination locks and you choose the combination when closing the compartment—even with mechanical combination locks.

The anticipated threat is the same in the three cases: people who had access to the lock but shouldn't anymore. This corresponds e.g. to changing passwords for shared accounts after an employee quits.

Answer 4

Do companies still use individually keyed locks??? I have a card that opens any doors I have access to--if I'm fired, someone will have to let me out the door because my key will already be dead, but everyone else's will still work. It also lets me log into any computer at work without a password (just a PIN) with public key based encryption where the private key never leaves my badge.

The combination of badge and pin is pretty hard to beat, works for both physical and computer security and requires two factors. You could accomplish the same with a phone/thumbprint/pin (2-3 factor) if you didn't want to pay for badge based security.

If you still have keyed locks then YES, Change them, OFTEN.

By changing the keys on doors all the time, you are taking the WORST part of passwords and applying it to another system.

What I'd really rather do is apply identity/encryption based technology to all computer logins AND physical locks by accessing everything through the same public encryption key where the private key safely resides in your physical possession and cannot be copied from that physical medium.

Answer 5

The risks: Someone lost the key. If there are more than one person holding some key, usually the rule 80/20 applies: 80% of the time the door is unlocked by 20% of the people. One can lose the key and not notice for long time. He can even forget that he holds a key to that particular door.

Someone obtained the key legitimatelly, didn't get accounted for and didn't returned the key when he had to.

etc, etc, ... actually, there is a lot of ways to mismanage a physical key.

So, depending on the stakes, changing the door lock may be a good security practice.

Answer 6

There is no direct relation between the 2;

If we follow a risk approach so we could find some relation based on the risk, we would have to do something like this:

What would be the probability of having someone testing multiple keys or any type of assessment in your door / lock every day? Does it has any known vulnerability? What is the impact if someone manages to open the door?

From my perspective is that the thief will always go in using the path of least resistance. So risking himself to be exposed by taking several hours testing your key / door is not viable.

But if you are prone to that risk and the impact is high then you should add extra security controls.

If the changing the lock is the most efficient I think not.

There are probably many other security controls that you can associate to you physical door that minimizes your risk with less cost.

For the password if you do the same work you will see that enforcing the password change from time to time (depending on your risk) is one of the cheapest security controls to enforce safety on your data.

Business always have to do a relation on the cost of security control that they wish to implement vs efficiency. It does not make sense to spend lots of money in door locks when you still have windows to enter. Or spend more in the door lock than what you have inside the house.

A balance between both must be meet, it will be different from business to business.

Answer 7

The kinds of attacks that makes regular password changing a good idea become a lot more unfeasable when applied to real locks. Infact the only comparable attack of this nature that is feasable is stealing said key and using it as soon as possible.

Now sure, you could make a copy of said key, but that takes time and money, and every moment you spend without the key and owner being reunited has the risk of the owner noticing the key is missing, making it much harder to diffuse the situation without getting caught. You also cannot brute force a lock by trying to use hundreds of thousands of keys as that would take forever, look very conspicuous and will eventually get you caught. Using lockpicks would be much more practical here but it would still look suspicious and changing the locks isn't going to help here unless the attacker has picked this lock before.

There's also the fact that changing passwords cost nothing, whereas replacing locks takes time and materials, which end up comparatively costly.

Answer 8

If your door lock is digital and opens by a number combination, then indeed you might want to think about it.

When you go past all the nonsense and blabla, the actual reason for periodic changes of passwords is very simple: We don't always notice that a password was compromised, and we're lazy to keep track of the various hints and anomaly detection is hard and has many false positives and... it's just easier to force people to change their passwords from time to time.

Physical entry with physical keys doesn't have these properties. A key can get lost or stolen, but is only rarely copied unnoticed. It is much, much more likely that an attacker has a password but nobody knows that he does than it is that he has a key nobody has noticed as missing (excluding the case the he stole it just before the break-in, which isn't covered by periodic changes).

For physical keys, it is much more feasable to change if there is evidence of compromise, instead of periodical.