There is a specific conversation that happens in a lot of Dubai offices. Someone points out that the access control system is old. Someone else points out that it works. The conversation ends there, and the system stays for another three years.
The problem is that “it works” and “it is secure” stopped being the same thing for older card technology some time ago. A system can open the right doors for the right people every day and still be trivially cloneable by anyone who stands near a cardholder in a lift with a device that costs less than a decent dinner.
This covers what actually needs replacing, what does not, and how to phase a migration without shutting the building.
Why old card technology is the problem
Early proximity card technology — the 125kHz systems that dominated for years — was designed when the threat model was someone finding a lost card, not someone cloning one. These cards broadcast a fixed identifier with no encryption and no authentication. A reader capable of copying one is inexpensive and widely available.
Early generations of 13.56MHz smartcards improved on this but had their own well-documented cryptographic weaknesses that were broken publicly years ago
The practical implication: if your system uses either, your access credentials can be duplicated by someone with brief physical proximity to a cardholder and equipment that requires no expertise to operate. Your audit log will faithfully record that the legitimate cardholder opened the door.
How to identify what you have: check the card frequency and technology, not the brand or age of the reader. Your maintenance provider can confirm it in minutes. If nobody can tell you what credential technology is in use, that is itself worth resolving.
Modern credential technology uses mutual authentication and encryption, where the card and reader verify each other cryptographically rather than the card simply announcing a number. This is the actual upgrade — not the reader housing, not the software interface.
What mobile credentials change
A mobile credential replaces the card with the phone, using Bluetooth or NFC to communicate with the reader.
What genuinely improves:
Issuance and revocation speed. This is the largest operational gain and the most underrated. Issuing a card means someone physically present with a card, an encoder, and a printer. Revoking one means either retrieving the physical card or disabling it and hoping. Mobile credentials are issued and revoked remotely, instantly.
For an organisation with contractors, temporary staff, multi-site movement, or any turnover, this changes the administrative load substantially. The security benefit is real too: the gap between someone leaving and their access being removed shrinks from days to minutes.
Fewer lost credentials. People lose access cards routinely and often do not notice for days. People notice a missing phone almost immediately. The behavioural difference matters more than it sounds.
Layered authentication. The phone can require biometric or PIN unlock before the credential is usable, which means a found phone is not automatically a working credential. A found card generally is.
No physical distribution. For multi-site operations or new starters who begin remotely, credentials can be issued before day one without couriering anything.
What does not automatically improve:
Mobile credentials do not fix a badly designed access policy. If everyone has access to everything, moving that to phones just means everyone has access to everything on their phones. The credential technology and the access policy are separate problems, and the migration is a good moment to address the second one.
- Personal device policy. Are you asking staff to install a company application on personal phones? Some will object, and in some jurisdictions and organisations that objection has weight. Have an answer, and have a fallback.
- Battery. A phone with a dead battery is not a credential. Some implementations handle this better than others; some do not handle it at all
- Platform differences. iOS and Android handle background Bluetooth and NFC differently, and the user experience is not always identical. Test both, with the actual phone models your staff carry.
- Licensing model. Mobile credentials are frequently licensed per user per year rather than purchased outright like cards. Over a multi-year horizon this can exceed the cost of cards. Model it across the expected life of the system, not the first year.
- Visitors and contractors. Requiring a visitor to install an application to enter your building for one meeting is not workable. You will still need physical credentials for these cases.
That last point is why the honest recommendation is almost always multi-credential: readers that accept both mobile and modern encrypted cards. Staff use phones; visitors, contractors, and anyone who prefers a card use cards. This is not a compromise — it is the correct design.
What actually needs replacing
Migration cost depends heavily on where the incompatibility sits, and this is often better than people expect.
Readers. Almost always need replacing. This is the main hardware cost.
Credentials. New cards for anyone remaining on cards, plus mobile credential licences.
Controllers. Sometimes reusable. Many controllers communicate with readers over a standard interface and are agnostic to credential technology. If yours are reasonably modern and us a supported reader interface, they may survive the migration. Worth checking before assuming a full replacement.
Cabling. Frequently reusable, which is the single biggest cost saver. If existing cabling supports the reader interface your new readers need, you avoid the most disruptive part of the work. Verify the cable type and condition before assuming either way.
Software and management platform. Depends on whether your existing platform supports modern credentials and mobile issuance. Older platforms sometimes do not, which turns a hardware refresh into a system replacement.
Locks and door hardware. Generally unaffected. Electric strikes, maglocks, and door furniture are independent of credential technology.
The assessment to do first: document what you have at each layer — reader model and technology, controller model and reader interface, cable type, software version and vendor support status. That inventory determines whether this is a reader swap or a system replacement, and the difference is substantial.
Phasing the migration
You do not do this in one weekend, and you should not try.
Phase 1 — Assessment and policy. Inventory the system as above. Simultaneously, review who actually needs access to what. Access policies accumulate cruft, and migrating a bad policy faithfully is a wasted opportunity.
Phase 2 — Pilot on a contained area. Pick a door group that matters but is not critical — a meeting room floor, a single department. Deploy readers, issue credentials to that group, run it for several weeks. Test the awkward cases: dead battery, forgotten phone, visitor arriving unannounced, someone whose phone is being repaired.
Phase 3 — Perimeter and high-security doors first. Once the pilot is proven, migrate the doors where the security gain is largest — main entrances, server rooms, cash handling areas, anywhere holding sensitive material.
Phase 4 — Progressive rollout by zone. Work through remaining doors in manageable groups. Multi-credential readers make this straightforward, because during transition both old and new credentials can work where needed.
Phase 5 — Decommission old credentials. Set a firm date, communicate it repeatedly, and enforce it. Migrations that never complete are common: the last twenty doors stay on legacy technology for years because nobody drove the final phase. Those doors are then your weakest point, and an attacker only needs one.
Coordinating with fit-out or building work
If you have refurbishment, expansion, or a fit-out planned, do the access control work then. Reader positions, cable routes, door hardware, and power provision are all far cheaper to address when ceilings are open and walls are accessible.
The same applies to integration. Access control that integrates with CCTV — so a door event pulls up the associated camera footage — is far easier to implement when both systems are being worked on than when retrofitting the link later. That integration is genuinely useful for incident investigation, turning “someone got in at 2am” into a door event with matching video
in one view.
If you are planning an office move or fit-out, the access control, CCTV, and network cabling are better scoped as one ELV package than as three separate procurements that discover each other’s requirements on site.
Compliance considerations
Two areas worth flagging:
Regulatory approval. Depending on your premises type and the scope of the system, access control work in Dubai may fall within SIRA’s remit alongside CCTV. Confirm whether your project requires approval and whether your contractor holds the appropriate licence before work starts, not after.
Data protection. Access control systems generate detailed records of individual movement — who went where, when, how often. That is personal data, and where it relates to employees it constitutes a form of workplace monitoring. The same considerations that apply to CCTV apply here: lawful basis, retention limits, access controls on the logs themselves, and transparency with staff about what is recorded and how it may be used.
Biometric access control raises this further. Biometric data is more sensitive than a card number, and deploying it warrants a properly considered assessment rather than being treated as simply a more convenient credential.
Fire and life safety
Non-negotiable and occasionally overlooked in credential migrations: access control must not compromise emergency egress. Fail-safe behaviour on fire alarm activation, mechanical override, and compliance with applicable fire and civil defence requirements are design constraints, not options.
Any change to door hardware or controller configuration should be verified against the fire strategy before commissioning. A migration that improves security while degrading egress is a bad trade in every direction.
The short version
If you are running 125kHz proximity cards or early-generation smartcards, your credentials are cloneable and the upgrade is a security necessity rather than a convenience. The upgrade that matters is to encrypted, mutually authenticated credential technology — mobile credentials are one form of that, and a good one, but the encryption is the point rather than the phone.
Specify multi-credential readers, keep cards available for visitors and exceptions, model the licensing over the system’s full life, check whether your controllers and cabling survive the change, and phase it properly with a firm end date for the legacy credentials.
Assessing your access control system?
KNH IT designs and installs access control across Dubai as part of our ELV and security systems work, and we handle the integration with CCTV and network infrastructure as one package rather than three.
If you are unsure what credential technology your current system uses or what a migration would involve, we can carry out an assessment and give you a phased plan with a clear cost breakdown.
Contact: Al Raffa Building, Office 07, Bur Dubai , info@knhit.com , contact us
FAQ’s
Check the credential technology rather than the age of the readers. Older 125kHz proximity cards transmit an unencrypted
fixed identifier and can be cloned with inexpensive readily available equipment. Early-generation 13.56MHz smartcards have known cryptographic weaknesses. Modern credentials use mutual authentication and encryption between card and reader.
Not necessarily. Readers almost always need replacing, but controllers are sometimes reusable if they support a standard
reader interface, and existing cabling is frequently suitable. An inventory of readers, controllers, cabling, and management software determines whether this is a reader swap or a full system replacement.
They offer faster issuance and revocation, no physical distribution, and can require biometric or PIN unlock on the phone. However they depend on personal device policy, battery, and usually per-user annual licensing. Most organisations deploy multi-credential readers supporting both mobile and encrypted cards, since visitors and contractors still need physical credentials.
Yes, using a phased approach: assess and inventory, pilot on a contained door group, migrate high-security doors first, then roll out progressively by zone. Multi-credential readers allow old and new credentials to coexist during transition. Set a firm end date for legacy credentials so the migration actually completes.
Yes. Access logs record individual movement and constitute personal data. Where employees are involved this is a form of workplace monitoring, requiring a lawful basis, defined retention, controlled access to the logs, and transparency with staff. Biometric credentials raise the sensitivity further.
