The Swedish Chemicals Agency KemI increases security with one card

Security is a key issue for the Swedish Chemicals Agency KemI (Kemikalieinspektionen). Tighter EU security requirements and a desire to make it easier for end users motivated the need to make changes. The result was a solution provided by the security company Nexus, which combines physical and logical access on one smart card, a Common Access Card.

The Swedish Chemicals Agency KemI is an supervisory authority founded in 1986 with around 250 employees today. Security is, of course, an important issue for the Agency and in 2010 the European Chemicals Agency, ECHA, increased security requirements further. The new requirements included, among other things, complex passwords and the need to change them every three months, screen savers with passwords, FollowMe printing, a visible ID card, camera monitoring and armed guards, says Lars Davidsson, System Developer at Swedish Chemicals Agency KemI.

Routines for complex passwords containing letter and number combinations that had to be changed every three months and screen savers that locked the screen after five minutes of inactivity was the first step. Having complex passwords that had to be changed every three months made it complicated for end users. It was difficult for them to invent new passwords and they forgot them very easily.

This in turn led to an increased workload for IT support, says Lars Davidsson. Disgruntled users and an overburdened IT support emphasized the need to find a new security solution. The Chemicals Agency surveyed the market and started talking to suppliers during the fall of 2011.

A dialogue was initiated with Nexus and the choice boiled down to four possible suppliers. They finally chose Nexus because they were able to offer an all-in-one solution for both physical and digital access in combination with factors, such as price, simplicity, commitment, and competence. The solution is a new access control system for physical access, which is integrated with smart cards for logical access. The software, Nexus Certificate Manager, creates all the certificates which are saved on a chip on the smart card. The web-based administration interface, Nexus SmartACT, is easy to administer and the Agency issues their own cards on a Nexus printer.

The end users now only need one card to gain access to the garage and office, as well as FollowMe printing and the IT system. They automatically get access to the systems on the network that they are entitled to access when they log in. The printed cards, which have holograms, are also used as ID cards during inspection visits around the country. About 300 employees and consultants have permanent smart cards. The IT department issues them, sets entitlements, and revokes and discards of the cards when someone leaves the Agency. Reception prints and administers visitor cards, as well as temporary cards when an employee has forgotten theirs.

The solution has been in place since the spring of 2013 and the Chemicals Agency is very happy with the results so far. The help-desk has a lower workload and the system is easy to administer and the Agency issues their own cards on a Nexus printer. The end users now only need one card to gain access to the garage and office, as well as FollowMe printing and the IT system. They automatically get access to the systems on the network that they are entitled to access when they log in. The printed cards, which have holograms, are also used as ID cards during inspection visits around the country.

About 300 employees and consultants have permanent smart cards. The IT department issues them, sets entitlements, and revokes and discards of the cards when someone leaves the Agency. Reception prints and administers visitor cards, as well as temporary cards when an employee has forgotten theirs. The solution has been in place since the spring of 2013 and the Chemicals Agency is very happy with the results so far. The help-desk has a lower workload and the system is easy to administer centrally.

– The end users are happy and we save a lot of time by simplifying procedures. The next step will be to secure external access to internal systems and BYOD, says Lars Davidsson.