Security for companies with critical infrastructure
Professional control and protection of visitor processes

Companies with a critical infrastructure are organizations or institutions that are important to the state community. If they fail or are impaired, there will be lasting supply bottlenecks, significant disruptions to public safety or other dramatic consequences. For example, organizations and facilities from the energy, transport, finance, administration, information technology and telecommunications sectors are among the critical infrastructures.

Due to their systemic relevance, companies with critical infrastructure must be particularly security-conscious. In order to rule out any risk from external visitors in particular, critical infrastructures should establish secure processes for dealing with visitors. The workflow-based "Visitor Service" of Peak Security Suite offers the necessary tools for this.

The pre-registration of visitors is usually done by the contact person visited in the company. This is supported on the system side by the visitor management of the Peak Security Suite. In security-critical environments, however, visitors are required to provide extensive personal data in order to guarantee complete logging and tracking. In addition, it must be ensured that the visitor data is up-to-date.

In order to avoid errors in the administration of visitor data, it makes sense for visitors to independently maintain their personal data and visits via the Internet. The "Visitor Service" of the Peak Security Suite makes this possible: After the pre-registration has been made by the contact person in the company, the visitor receives an email with a link. After successful authentication, he can use this to confirm the visit and enter or add all necessary personal data. The visitor is authenticated using secure procedures such as OIDC or SAML. For example, Google, Microsoft, Amazon or Facebook can be used as identity providers. In addition, the visitor receives a calendar view of his visits. He can use it to announce, reschedule or cancel future visits and, if necessary, register objects he has brought with him (e.g. notebook, photo, etc.), reserve a parking lot, request special authorizations (e.g. WiFi access, canteen vouchers, etc.) and add other people to the visit. The workflow engineering of the Peak Security Suite ensures in the background that all required approval processes are controlled in accordance with the rules.

In some industries, visitors and external employees are required to complete a safety briefing before their stay. This serves on the one hand to instruct the visitor, but on the other hand it is also a legally required safeguard (compliance) for the host company. There are often different instructions for different areas: At airports, for example, a distinction is often made according to where a person is deployed (e.g. apron driver's license, aviation security training, catering). Each of these briefings has a period of validity and must therefore be repeated at a specified interval. An overview of all completed briefings is part of the visitor service. If an briefing is missing, it is offered to the visitor via a link. The Peak Security Suite ensures that a visit can only be approved and the check-in at reception can be carried out once the visitor or external employee has completed all of the briefings required for him.

According to the overall architecture of the Peak Security Suite, the visitor service is implemented as a service. Communication with the basic system takes place via a loose coupling based on a HTTP / REST interface. In this way, the visitor service can easily be operated externally as a cloud service of the company.