Access Control Credential Types: Something You Have, Know, and Are for Physical Security

Understanding Access Control Credentials and Multi-Factor Authorization

What Are Access Control Credentials?

Access control credentials are the keys to the castle in any security system – they are the pieces of information or objects that allow an authorized person to unlock a door, log in to a system, or otherwise gain access to a protected resource. These credentials are typically categorized into three main types, which are easy to remember as:

1. something you have,

2. something you know,

3. and something you are.

Understanding these credential types is crucial for designing a secure access control strategy that is both user-friendly and effective.

Types of Access Control Credentials

The three types of credentials cover what you carry, what you remember, and who you are. Each type has common examples that most people will recognize. Table 1 below summarizes these access control credential types and provides examples of each category:

Credential Type	Examples
Something You Have	• Photo ID/Credential: An identification badge or ID card with your photo. • Barcode/QR Code: A printed code scanned by a reader or smartphone. • Physical Key: A traditional metal key for a lock. • Magnetic Stripe Card: A swipe card (like older hotel key cards or ID cards). • Proximity Card (NFC/RFID): A contactless card or fob that unlocks doors when held near a reader. • Token: A key fob or electronic token device that generates or contains security data.
Something You Know	• Username/Passphrase: A login name and password combination for a system. • PIN (Personal Identification Number): A numerical code that you memorize and enter on a keypad.
Something You Are	• Fingerprint: Your unique fingerprint pattern used for a scan. • Palm Print: The unique print of your palm or hand. • Retina/Iris Scan: The unique patterns in your eye used for identification. • Facial Geometry: Your facial features mapped by a camera (facial recognition). • Voice: Your voice pattern identified by a voice recognition system.

As the table shows, “something you have” refers to physical items or devices that you possess (for example, an access card or a key). “Something you know” refers to information that lives in your head – like a password or PIN code – that you must recall and provide. “Something you are” refers to personal traits or characteristics – usually biometric identifiers such as fingerprints or facial features – that confirm your identity. Each type on its own can serve as a single-factor authentication method for access control. For instance, using a key card alone to open a door is an example of single-factor (one-factor) authentication based on something you have.

5 Key Components of Access Control Systems

Two-Factor and Multi-Factor Authentication Access Control

While one credential can verify identity, relying on a single factor has its weaknesses. If that one factor is stolen, guessed, or forged, an unauthorized person could gain access. This is where multi-factor authentication (MFA) comes into play. MFA means using two or more independent credentials together to verify identity. The most common implementation is two-factor authentication (2FA), which combines two different types of credentials for added security.

Using two factors from different categories dramatically improves security because an attacker would need to defeat multiple unrelated defenses. In practice, two-factor combinations in physical access control are often either something you have + something you know or something you have + something you are. Here are a few examples of 2FA combinations:

• Something you have + Something you know two-factor authorization examples include: 

  • Swiping a proximity keycard and entering a PIN on a keypad. The keycard proves you possess an authorized credential, and the PIN proves you know the secret code associated with that credential.

  • Swiping a magnetic stripe badge + entering a unique PIN at the entrance.

  • Tapping a mobile credential via an app on smartphone + entering a PIN code at the reader.

  • Scanning a proximity fob + inputting a unique PIN on a touch-enabled reader.

• Something you have + Something you are two-factor authorization examples include:  

  • Tapping a security token and scanning your fingerprint. The token (like an access card or fob) provides one layer, and your fingerprint (a personal identifier) provides the second layer of authentication.

  • Using a fob or smart card + authenticating with a fingerprint reader at the same time.

  • Unlocking a door using a mobile app credential + verifying facial scan via camera-equipped reader.

  • Tapping an RFID badge + voice recognition through an integrated access terminal.

• Something you know + Something you are two-factor authorization examples include: 

  • NOTE: This combination is less common in physical door systems but often seen in computer or smartphone access

  • Entering a password and providing a fingerprint or facial scan on your device. It still uses two distinct types (a remembered secret and a physical trait) to confirm identity.

By requiring two independent credentials, 2FA ensures that if one factor is compromised (say, someone learned your PIN), the intruder still cannot get in without the second factor (like your keycard or your fingerprint). It’s like having two locks on a door – both a key and a code are needed to unlock it, making unauthorized entry much more difficult.

Mobile Credential Card Readers from GenX Security Solutions

Avoiding Redundant Authentication Factors for Access Control

When setting up multi-factor authentication, it’s important to combine different types of credentials rather than doubling up on the same type. Using two of the same kind (for example, two things you have or two things you know) does not provide the same security boost because both could be compromised by the same method. In other words, if an attacker can steal one keycard, requiring a second keycard wouldn’t help much – both factors share the same vulnerability. The strength of 2FA or 3FA (three-factor authentication) comes from layering independent defenses. A good practice is to ensure each factor in use (have, know, are) is unique, so an intruder has to conquer completely different hurdles for each layer of security.

Going a Step Further with Three-Factor Authentication Access Control

For the highest security needs, all three categories can be used at once – this is three-factor authentication (3FA). An example might be a secure facility that requires an ID badge (have), a passcode (know), and a fingerprint scan (are) to enter. Three-factor authentication is relatively rare outside of very high-security environments because it can be less convenient and more expensive to implement. However, it underscores the principle that layering more independent factors increases security. Each additional factor makes it exponentially harder for an unauthorized person to impersonate an authorized user.

Scalable Access Control Solutions from GenX Security

GenX Security Has The Credentials You Need

Access control credential types (something you have, know, and are) provide a framework for understanding how identity is verified in security systems. By choosing the right credentials and combining them through multi-factor authentication, organizations can greatly boost their security without making access too cumbersome for users. A well-designed access control system by a licensed, professional access control installer and integrator, such as GenX Security Solutions, is all about balancing security with usability. Understanding these credential categories is the first step in striking that balance.

Contact us for a customized fast, fair, and always FREE quote for your location.

---

Experience the next generation of interactive security services and solutions with GenX Security.

With custom security integration solutions come custom quotes designed for your needs. Please contact us by clicking here or calling 866-598-4369.

---

At GenX Security Solutions, we proudly serve businesses in all locations across South Carolina, North Carolina, and Georgia with cutting-edge commercial security systems, access control solutions, structured cabling, fire alarms, and professional audio/visual integration. From bustling cities like Greenville and Raleigh to growing industrial hubs like Winston-Salem to hospitality hot spots like Myrtle Beach, our team delivers tailored solutions to meet your business’s unique needs.

Please visit our state-specific pages for more information on our services in various industries. We serve all cities in the Upstate and surrounding, including:

SOUTH CAROLINA	NORTH CAROLINA	GEORGIA
Aiken, SC	Asheville, NC	Alpharetta, GA
Anderson, SC	Burlington, NC	Athens, GA
Beaufort, SC	Cary, NC	Atlanta, GA
Charleston, SC	Chapel Hill, NC	Augusta, GA
Columbia, SC	Charlotte, NC	Carrollton, GA
Florence, SC	Concord, NC	Columbus, GA
Goose Creek, SC	Durham, NC	Dalton, GA
Greenville, SC	Fayetteville, NC	Douglasville, GA
Greenwood, SC	Gastonia, NC	Gainesville, GA
Greer, SC	Goldsboro, NC	Hinesville, GA
Hilton Head Island, SC	Greensboro, NC	Macon, GA
Lexington, SC	Hickory, NC	Marietta, GA
Mount Pleasant, SC	High Point, NC	Newnan, GA
Myrtle Beach, SC	Jacksonville, NC	Peachtree City, GA
North Charleston, SC	Kannapolis, NC	Rome, GA
Orangeburg, SC	Raleigh, NC	Roswell, GA
Piedmont, SC	Rocky Mount, NC	Sandy Springs, GA
Rock Hill, SC	Wilmington, NC	Savannah, GA
Spartanburg, SC	Wilson, NC	Valdosta, GA
Summerville, SC	Winston-Salem, NC	Warner Robins, GA