Multi-Factor Biometric Access Control Eliminating Unauthorised Vault Entry at a Dhaka Commercial Bank

The bank's vault security relied on a system that had changed little since the building's construction: a heavy steel door with a combination lock, supplemented by a shared four-digit PIN pad installed during a 2015 renovation. The combination was known to 8 people, and the PIN was functionally known to anyone who had ever watched a colleague enter it — a group that had expanded well beyond the authorized list through years of casual observation. There was no record of who entered the vault or when, beyond a paper logbook that required staff to manually sign in and out, a process routinely skipped during busy periods.

Tailgating was the most immediate security failure. The vault entry corridor led directly from the general operations floor, and during peak afternoon periods when the corridor was busy with staff movement, it was straightforward for an unauthorized person to follow an authorized colleague through the PIN-secured door without the authorized user challenging them. The bank's internal safety committee had flagged this in two consecutive annual reviews. Following a regional banking industry incident involving internal vault access fraud at a competing institution — widely discussed within Bangladesh's banking security community — the committee escalated their recommendation to an urgent board-level directive.

The IT server rooms presented a related but separate problem. One server room housed the bank's core banking system infrastructure; the other housed the WAN equipment and cybersecurity appliances. Both were secured only with standard key-and-lock arrangements. Keys were kept in the facilities office and signed out on a paper log. During a Bangladesh Bank IT security examination, the examiner noted the absence of electronic access logging for the server rooms and flagged it as a finding requiring remediation within 90 days.

Beyond the compliance finding, the bank's IT operations team had experienced a near-incident: a vendor technician working on HVAC equipment in the ceiling space above the core banking server room had briefly entered the server room itself without being challenged by any technical control. The incident was caught by a colleague's observation and reported, but it crystallized for the IT Director the risk of relying entirely on physical keys and procedural controls for rooms housing systems that processed millions of taka in transactions daily.

The bank's safety committee specifically required dual-person authentication for vault access — no single individual, regardless of seniority, should be able to access the vault alone. This requirement exceeded what a conventional single-factor access control system could enforce.

SSAL designed a layered access control architecture addressing the vault, IT server rooms, and executive floor, with integration across all controlled doors through a unified management platform.

Vault Mantrap — Dual-Factor Biometric Authentication: The vault entry corridor was converted into a two-stage mantrap by installing an outer security door approximately 1.8 metres before the existing vault door. The outer door is controlled by a ZKTeco SpeedFace V5L facial recognition terminal, which authenticates the first factor: the user's enrolled face. Once the outer door closes and the person is confirmed inside the mantrap vestibule, a secondary ZKTeco SF400 MIFARE card reader on the inner door prompts for their access card — the second factor. Dual-person authorization is enforced at the software level: the vault inner door will not open unless two separately authenticated individuals have presented credentials within a 90-second window. This enforces the safety committee's dual-person requirement without relying on procedural compliance.

The mantrap doors are controlled by mag-lock mechanisms with emergency break-glass release units on both sides, compliant with fire egress requirements. Door position sensors confirm that each door has fully closed before the next door can be released, preventing both tailgating and door-propping scenarios.

IT Server Room Access — Gallagher T20 Readers: Both IT server rooms received Gallagher T20 multi-technology card readers, supporting MIFARE DESFire EV2 encrypted cards. The Gallagher T20 readers communicate via OSDP v2 to the central access controller, providing encrypted reader-to-controller communication and tamper detection. Any attempt to physically interfere with the reader triggers an immediate alert to the security monitoring station. Server room access is configured as single-factor (card only) for efficiency during IT operations, but all access events are timestamped and logged with staff identity, time, door, and duration.

Central Access Controller — Hikvision DS-K2M060 Controller Network: An 8-door Hikvision DS-K2M060 access controller manages all controlled doors — the vault mantrap outer and inner doors, both server rooms, the treasury department entry, and the executive floor. The controller connects via the bank's dedicated security VLAN to the central Hikvision access management server, running iVMS-4200 Access Control. Real-time alerts are sent to the security manager's workstation and mobile phone for any access event at vault or server room doors, any failed authentication attempt, any door held open beyond 30 seconds, and any tamper event on readers or controllers.

Audit Logging and Reporting: All access events are retained in the system database for a rolling 24-month period, searchable by person, door, date range, or event type. A daily automated report is emailed to the bank's Compliance Officer showing all vault access events — entry time, exit time, both authenticated personnel, and any exceptions. This report format was specifically designed to satisfy the Bangladesh Bank examiner's finding regarding server room access logging, and was pre-reviewed by the bank's compliance team before the system went live.

Integration with CCTV: Hikvision cameras were added at the vault corridor entry and inside the mantrap vestibule, linked to the access control events. Any access control event at the vault automatically tags the corresponding video segment in the NVR, enabling investigators to instantly pull the footage associated with any specific vault entry event without manual time-searching.