Critical Infrastructure Under Attack: The Real Limits of Physical Security and Access Control
Last year’s incident at Dubai International Airport sent a visible ripple through the global infrastructure security community. Security managers, facility directors, and procurement teams across the Middle East, Europe, and beyond started asking the same uncomfortable question: if something like that happened at our site, would our access control system help — or would it quietly fail us at the worst possible moment?
It’s a fair question. And the honest answer is: it depends — on what your system was built to do, and what nobody told you it was never designed to handle.
The scale of the problem is not small. Global infrastructure protection spending reached $28.36 billion in 2023 — and yet that figure sits alongside $188.1 billion spent on IT security in the same year. Do the math: physical infrastructure protection accounts for roughly 15% of total security investment, even though a physical breach can cascade into exactly the kind of digital and operational disaster that the other 85% is trying to prevent. That gap between where the money goes and where vulnerabilities actually live is worth thinking about seriously.
This article is about that gap. We’re going to walk through what physical access control actually does well inside critical infrastructure environments, where it falls short, what a genuinely tested system looks like under pressure, and where solutions like Vanma’s passive electronic lock platform fit into a serious protection strategy.
What the Dubai Airport Hit Revealed About Critical Infrastructure Readiness
Airports are the most visible category of critical infrastructure — high footfall, complex access zones, constant pressure between security and throughput. When something goes wrong at an airport facility, every other infrastructure operator watches closely, because airports are often the most mature and well-funded when it comes to airport facility security investments. If their systems showed gaps, what does that say about a power substation in a mid-sized city, or a water treatment plant on the edge of a port zone?
The Dubai incident raised three specific concerns that kept coming up in conversations with security managers:
- Speed of physical response — when an area needs to be locked down or opened for evacuation, how fast can that actually happen?
- Dependency on network availability — most modern access systems rely on connectivity. What happens when the network is the first thing to go?
- Audit and accountability — after the fact, can you actually reconstruct who accessed what, and when?
These aren’t new questions. But they became very urgent ones. And they exposed something that the physical security industry doesn’t always advertise clearly: access control systems have real limits, and most facilities don’t know exactly where those limits are until they’re tested for real.
The Real Role of Physical Security in Critical Infrastructure Protection
There’s a tendency to treat physical security as a checkbox. You install the locks, you run the cables, you put up the cameras, and you call it done. That thinking gets people into trouble.
Physical security in critical infrastructure is not a product — it’s a system of behaviors, hardware, and processes working together. The hardware is only as good as the policies around it, and the policies are only as good as the data they’re based on. A lock that logs nothing is barely better than no lock at all, from a management standpoint.
What Access Control Is Actually Designed to Do
Well-designed physical access control systems do a few things reliably when properly maintained:
- Restrict entry to authorized personnel only — this is the baseline, and most systems do it reasonably well under normal operating conditions.
- Record access attempts — every entry and exit, successful or not, can be timestamped and attributed to a specific person or credential.
- Enforce time-based rules — a maintenance worker might be authorized for daytime access only. A contractor’s permissions can auto-expire.
- Support layered zones — outer perimeter, inner facility, and restricted technical areas can each have different access thresholds.
These are the core value propositions, and they genuinely work — in a stable environment, with proper configuration, and with staff who follow the procedures.
The Limits Nobody Talks About
Here’s where the picture gets more complicated — and more honest.
Beyond that fundamental truth, there are operational limits that affect real facilities every day:
- Power dependency — most electronic access systems need power to function. An attack that cuts power can effectively disable every electronic lock in a building simultaneously.
- Network dependency — cloud-managed or centralized systems need a live connection to validate credentials in real time. Network disruption = access disruption.
- Human error — tailgating, propped doors, lost credentials, and shared PINs undermine even the most expensive systems. No hardware solves a culture problem.
- Emergency evacuation conflicts — this is the one that keeps facility managers up at night. Locking down a building during a security incident can directly conflict with emergency egress requirements. Opening doors for evacuation can allow an attacker to move freely. There is no universally correct answer, and most systems aren’t designed to handle this trade-off gracefully.
Airport Facility Security Under Pressure: What Stress-Testing Reveals
Airport facility security is a useful lens because airports operate under conditions that most other critical infrastructure sites don’t face routinely: massive crowds, 24/7 operations, constant shift changes, and a mix of public-facing and highly restricted zones within the same building.
When you talk to airport security operations managers about what actually breaks down during an incident, three scenarios come up repeatedly:
Scenario 1: The Power Goes Out
Most electronic access systems fail in one of two ways when power is lost — they either lock everything (fail-secure) or unlock everything (fail-safe). Which mode is appropriate depends on the door and the context. A server room should probably lock. An emergency stairwell absolutely should not. But in a complex facility, getting that configuration right across hundreds or thousands of access points is genuinely hard, and it doesn’t always stay right as facilities evolve over time.
Scenario 2: The Network Goes Down
Cloud-connected systems that require a live authorization check before every unlock become a serious problem when the network is disrupted. This is not a theoretical scenario — it’s happened during natural disasters, cyberattacks on adjacent systems, and even routine maintenance windows that ran over schedule. Facilities that haven’t tested offline behavior often discover it the hard way.
Scenario 3: Emergency Evacuation and Fast Door Opening
This is the scenario that generates the most debate. When you need to evacuate hundreds of people quickly through a facility with dozens of access-controlled doors, how does that actually work? In many installations, the answer is: not well. Security staff have to manually override systems, master keys may be stored in locations that are suddenly inaccessible, and the evacuation coordinator may not have the technical access to push a facility-wide unlock command from a mobile device.
The best airport facility security implementations we’ve seen have all solved this the same way: they’ve separated the emergency response workflow from the day-to-day access management workflow, with pre-authorized emergency access profiles that can be activated with a single authenticated action, without requiring a live network connection.
Access Control Infrastructure Protection: What a Modern Lock System Changes
No Power at the Lock? No Problem
One of the most practical breakthroughs in modern physical security hardware is the passive electronic lock — a lock that requires no internal battery and no external power connection at the lock body itself. Power is transferred from the electronic key at the moment of contact, which means the lock never goes offline due to a power failure at the facility level.
How Vanma’s Passive Lock System Works
Vanma’s electronic locks carry no power source inside the lock body. The key delivers the small amount of energy needed to authenticate and actuate the lock at the moment of use. This means:
- No batteries to replace, no wiring to run — the lock works even if facility power is completely cut
- Each lock stores a log of the last 60,000 access attempts, independently of any network connection
- The system uses AES-256 encryption for key-to-lock authentication, the same standard used in financial systems
- Hardware is rated IP68 — fully sealed against water and dust — and operates from -40°C to +70°C, which matters in harsh environments like substations, outdoor equipment enclosures, and transportation hubs
Vanma is already deployed across critical infrastructure sites in the UAE, Kuwait, Pakistan, Nigeria, and across Europe — including with DEWA (Dubai Electricity and Water Authority) and Kuwait Petroleum Corporation, both of which operate facilities where access control infrastructure protection is a non-negotiable requirement.
Remote Authorization in Emergency Situations
One of the harder problems in emergency access management is the authorization bottleneck. During a fast-moving incident, the person who needs to open a door may not be the person who has the authority to authorize that door — and getting those two people connected quickly is often where things fall apart.
Vanma’s system addresses this through remote authorization via 4G, where a supervisor or control center can push new access permissions to a key in the field without requiring the key holder to return to a central office. If a maintenance crew needs emergency access to a power room during an incident, that authorization can happen in seconds, from anywhere, and the key will reflect the updated permission the next time it connects — or immediately if it’s a 4G-enabled key.
For situations where the network is down entirely, offline-loaded authorization profiles allow pre-staged emergency access rights to be embedded directly in the key, activated by an authenticated administrator action before deployment.
Audit Trails That Actually Hold Up
After any serious incident at a critical infrastructure site, there will be an investigation. Regulators, insurers, and management will all want to know: who was where, when, and what did they access? The quality of that answer depends entirely on the quality of your access log.
Many access systems log events centrally — which means if the server goes down, if the network is interrupted, or if the log is corrupted, you may have significant gaps in your post-incident data. Vanma’s approach stores a local access log in both the lock and the key. Even if the central system has been taken offline, every access event is preserved in the hardware itself and can be retrieved when the system is restored.
This is not a small thing for access control infrastructure protection. During regulatory reviews following major incidents, the inability to produce a complete access log has cost operators significantly — in fines, in litigation, and in operational disruption while investigations drag on.
Critical Infrastructure Protection Starts Before the Attack
There’s a mindset shift that separates facilities that handle incidents well from facilities that don’t: the former treat security as an ongoing management discipline, not a one-time installation. They test their systems. They run tabletop exercises. They know exactly what their access control does in each failure mode because they’ve deliberately put it through those failure modes in a controlled environment.
Layered Permission Management
One of the most consistently underused features in modern access control systems is granular, role-based permission management. Rather than giving everyone at a facility a broad credential that opens most doors, genuinely well-managed critical infrastructure access looks more like this:
- Operators have access to their specific work zone, during their assigned shifts only
- Contractors receive time-limited credentials that expire automatically at the end of the contract period
- Emergency response teams have pre-staged access profiles that can be activated as a package, not door by door
- No single person carries credentials that would give them access to every restricted area without dual authorization
Vanma’s permission system supports all of these configurations natively. It also supports blacklisting — if a key is lost or a worker’s employment ends, that specific key can be added to a blacklist that is pushed to every lock in the system. The lock will reject the key the next time access is attempted, without requiring any physical change to the lock hardware itself. No rekeying, no locksmith, no downtime.
One Key, Many Locks — and Why That Matters in a Real Incident
Traditional key management in large facilities is, frankly, a mess. Workers carry bundles of keys. Keys get lost. Locks get rekeyed. The wrong key gets handed to the wrong person during a handoff. In an incident, someone needs access to an area and can’t find the right key in a ring of thirty that all look similar.
Vanma’s “one key for all locks” model doesn’t mean every key opens every lock — it means each authorized user carries a single electronic key that opens exactly the locks they’re permitted to open, and no others. That simplification has a real impact on incident response speed. The right person can get through the right door without fumbling, without radio calls to find the key holder, without delay.
What Physical Security Cannot Do — And What You Still Need
We want to be direct about something, because we think the industry sometimes oversells this: physical security is not a solution to all security problems. It’s one layer in a stack. A good one, when done right — but not a complete answer on its own.
Here’s what physical access control cannot do, regardless of how good the hardware is:
- It cannot replace trained people. A facility with excellent locks and undertrained staff is still vulnerable. People are always the most important variable in security outcomes.
- It cannot detect insider threats in real time. If an authorized person does something harmful, the access system won’t stop them. It will log what they did, which helps enormously after the fact — but detection still requires human review or behavioral analytics layered on top.
- It cannot compensate for architectural failures. If a facility was designed without proper security zoning, no lock system will fully fix that. Physical layout matters.
- It cannot stop determined, sophisticated attackers alone. Physical security buys time and raises the cost of an attack. It doesn’t make a facility impenetrable.
Preparing Your Facility for the Unexpected
If you manage physical security at an energy plant, a water facility, a transportation hub, or any other piece of critical infrastructure, the Dubai airport situation is worth sitting with for a moment. Not because your facility faces the same threat profile — it probably doesn’t. But because the underlying questions it raises are universal.
A few practical things worth doing if you haven’t already:
- Map your access failure modes. What does your system do when power is cut? When the network goes down? Have you tested both, deliberately?
- Review your emergency access procedures. If you needed to unlock or lock every door in your facility in under two minutes, could you? Who has the authority, and do they have the tools?
- Audit your key and credential distribution. How many people have access to areas they shouldn’t? When did you last clean up expired contractor credentials?
- Verify your audit log integrity. If you needed to pull a complete access log for the last 30 days right now, is that data available, complete, and legally defensible?
- Stress-test your authorization speed. During an incident, how long does it take to grant emergency access to someone in the field? If the answer is “more than a few minutes,” that’s worth fixing.
These questions don’t require buying new hardware. They require honest answers — and for most facilities, honest answers reveal gaps that are worth closing before an incident forces the issue.
If you’re evaluating whether your current physical security setup is genuinely fit for purpose in a critical infrastructure context, Vanma’s team works with security and procurement managers across energy, utilities, transportation, and government sectors. The conversation usually starts with understanding what you actually need your system to do — not what it does on a normal Tuesday, but what it needs to do when things go badly wrong.
That’s a conversation worth having before the incident, not after.
Share:
Table of Contents
Try Vanma Electronic Lock
You can contact us to request samples, and to experience the convenience of Vanma electronic locks.
Contact Us NowChoose A Trusted Access Control Manufacturer for
Reliable Solutions
As a professional manufacturer of access control systems and electronic locks, Vanma offers high-quality solutions to protect your premises and assets. Contact us by filling out the form below to receive professional consultation and support.
