Key safe security, or the lack of it

A few years back we put a key safe into our office. Previously, we had used a very simple locked cabinet to ensure keys were returned, as before that, keys kept being accidentally taken home.

There’s no data of significance kept at the office. Everything is hosted elsewhere, but we could do without being broken in to. So unsurprisingly we lock the doors when we go home.

We also have monitored alarms and CCTV covering outside and inside (and the key safe), plus secondary electronic locks and mains power backup to ensure they stay locked in the event of a power cut.

Anyway, back to that key safe.

We chose a digital safe to make key management easier. Keyholders to the office have the code.

We looked for one that could be bolted through a retaining wall, also for strong hinges and bolts, as they are a common source of weakness.

Choices for key safes are pretty limited, and we bought one of these.

The battery changes are recorded and are replaced before the low battery warning lights up. This has worked well for a few years for us.

Imagine our surprise when we came in on a Monday morning to find the key safe dead and powerless.

We could access the front door to the office as keyholders have that key, but all other doors couldn’t be unlocked. Timing was everything – we had a TV crew from the Wall Street Journal coming in to film. Nothing like a bit of pressure at 8am on a Monday morning!

Fortunately, our landlord keeps spare keys in a safe at home. Even more fortunately, he responded straight away and was with us in 10 minutes. Now that’s what you call service!

Immediate panic was over, we had the required access. So back to that safe again:

It was locked and unusable. There was a backup key, which was of course in a safe in another unit which at the time we couldn’t unlock to access.

So we looked at the backup lock:

A Tubular Lock.

We asked one our physical social engineering team if we could borrow some of their tubular lockpicks. “Of course”, they said.

Less than 10 seconds later, we had the safe open. This shocked the both of us who were trying.

We were so incensed by the terrible quality of the backup lock that we started investigating key safe standards.

There really isn’t much. ‘Police Preferred’ ‘Secured by Design’ and ECB.S offer some hope, but the various digital safes with manual back up keys we could find all presented opportunities for picking, with varying degrees of complexity. One option that interested us was an electronic lock that could be powered externally in the event of battery failure.

Conclusion

Whilst we have multiple additional layers of security to mitigate the impact of the poor key safe, we should have spent more time testing the security of the lock.

Given the poor state of key safe security generally, standards are needed that specifically address the quality of backup locks. Where a backup lock is not provided, one is at the mercy of the batteries. If they run out for any reason, as happened to us, physical attacks against the key safe can be the only option.

…and Yes, we have a new key safe coming, a properly secure one.