RE: Company ID's -- MIDRANGE-L

Chuck,

I would suggest the barest minimum of information.  Last name & badge
number, for instance.  Or first & last name + badge number. Or just
badge number w/out a name.  Ensure the badge number is not the same as
the employee number.  It's even optional to put the company name on the
badge; having it present lets a thief know where they can attempt to use
it.

Also, I would not put work location on the badges as, again, it reveals
information about the company.  If the badges will be necessary to gain
access to the work location, and they will be scanned or even just
checked against a list of approved people, work location is not
necessary (the scan/check-list will cover who is authorized).

If the badges are laminated vs. printed directly on the plastic (like
Sam's Club membership cards & drivers licenses in some states), be
warned that it's fairly trivial to "un-laminate" a badge, replace the
photo, and re-laminate.


With all of that said, if you insist on providing a lot of info on the
badge, I would suggest a scenario where the employee uses a PIN # (or
PIN # + other ID combo) to retrieve their badge upon coming to work and
that the badges are surrendered when the employee leaves for the day.
If you basically keep the badges internal, having more info on them is
less of a threat.  We have a service provider who does this.  We enter
their outer facility, surrender our drivers license in exchange for our
badge, and use a PIN along with the badge & a biometric scan to access
the 'inner sanctum'.


I wouldn't bother to make this a valid second photo ID for people.  If
they want another valid photo ID, the local BMV will make a state ID for
a few $.

John A. Jones, CISSP
Americas Information Security Officer
Jones Lang LaSalle, Inc.
V: +1-630-455-2787  F: +1-312-601-1782
john.jones@xxxxxxxxxx

-----Original Message-----
From: Chuck Lewis [mailto:clewis@xxxxxxxxxx] 
Sent: Monday, September 13, 2004 1:29 PM
To: 'Midrange Systems Technical Discussion'
Subject: Company ID's

Hi Folks,

 

We are in the process of creating company Photo ID cards. I was
wondering if anyone else is doing this ?  My plan is to automate this as
much as possible. We will be downloading the Employee Name, Employee
Number and Work Location from the iSeries into Adobe PageMaker and then
the rest would be done in there (grab a picture and pull the information
together).

 

 I was wondering what information folks were using on them, back and
front.
I know it can be a touchy issue with too much personal information, etc.
but we also want these to double as a "second form of picture ID" and I
wasn't sure what all made that valid.

 

Thanks !

 

Chuck



This email is for the use of the intended recipient(s) only.  If you have 
received this email in error, please notify the sender immediately and then 
delete it.  If you are not the intended recipient, you must not keep, use, 
disclose, copy or distribute this email without the author's prior permission.  
We have taken precautions to minimize the risk of transmitting software 
viruses, but we advise you to carry out your own virus checks on any attachment 
to this message.  We cannot accept liability for any loss or damage caused by 
software viruses.  The information contained in this communication may be 
confidential and may be subject to the attorney-client privilege. If you are 
the intended recipient and you do not wish to receive similar electronic 
messages from us in future then please respond to the sender to this effect.