It's generally always a bad idea to rely on any single authentication mechanism. Refer to the defence in depth for that. A biometric + smartcard, or smartcard + password or similar 2FA would be appropriate in an environment that demands higher than average security.
As for RFID Cards, do correct me if I'm mistaken but MiFare is a manufactureer of more than one RFID based "smart card" solutions. And although it is true that some of their cards such as the MiFare Classic are easily vulnerable to cloning, PoCs for some of their other products are more difficult to implement.
Secondly, cloning relies on being able to get one's hands on the original card. Physical security should be inplace to make this difficult (RFID proof wallets, etc.).
The RFID based cards are currently being used in the payment card industry, public rail networks, corporate offices with low publicly reported crime rates which leads to me to believe that for most current applications the profit outweighs the security risks.
Card tracking is an interesting policy wherein by monitoring the last used location of a card, anomalies can be detected in a central system. For example in places where people use their card twice to swipe another individual in, a card tracking policy can alert security to investigate. Depending on criticality of secured assets, an appropriate intrusion detection or prevention policy can be adopted.
- Choose a rfid solution that is harder to clone.
- Employee training.
- Usage of RFID blocking sleeves.
- Card Tracking
- Use 2FA, instead of only relying on the smartcard.