Access Control Controller Installation in Memorial, Houston: Secure, Networked, Integrated

Who needs a controller along the Memorial corridor, and how the jobs differ

Memorial stretches west from Memorial Park toward Highway 6, bounded roughly by the Katy Freeway on the north, with Memorial Drive and Buffalo Bayou winding through it. Across that span, the same request for a controller on a few doors arrives from five very different clients.

Access realities shift across the corridor as well. Addresses inside the Villages answer to that Village’s own city hall and permit office rather than Houston’s. Office towers want a certificate of insurance and an agreed after-hours window before a ladder comes through the lobby. Several Memorial subdivisions have private security patrols or gated entries, so we ask how contractors are cleared before the first visit.

Your controller is a computer on the network. Secure it like one.

A modern controller runs an operating system, holds a database of everyone allowed into your building, and talks to a server or a cloud service. Installed carelessly, it is an unmanaged computer with a door attached. These are the network rules we follow, and the ones your IT team is likely to ask about:

• Its own segment. Controllers sit on a dedicated VLAN, with firewall rules that let them reach their management server or cloud endpoint, a time server and nothing else.
• Outbound connections only. A cloud-managed controller should open an encrypted connection out to the vendor. We do not forward an inbound router port to a controller for remote access; a device exposed that way can be found by anyone scanning the internet.
• Named accounts, no defaults. Factory passwords are replaced, each administrator gets an individual login, and the cloud portal uses multi-factor sign-in wherever the platform offers it.
• A fixed address. Each controller gets a reserved IP address recorded on a network sheet, so a router replacement does not silently orphan it.
• Accurate time. Controllers sync to a network time source. Door events that line up to the second with camera footage are far more useful in an investigation, and an encrypted cloud connection can fail outright if the device clock drifts far enough.
• A firmware plan. Current firmware at install, and an agreed owner for applying updates afterward.
• Local decisions. The controller keeps its user list and schedules in its own memory and goes on admitting valid credentials if the internet or server connection is lost.

Where door systems really get beaten: the reader wire and the card

Attacks on access control rarely go after the controller itself. They target the two weaker links upstream of it.

The reader-to-controller wire

Wiegand, the older and still common interface, sends the card number one way and unencrypted. A small device spliced into the cable behind a reader can record every badge presented and replay one later. OSDP, the open standard that replaces it, runs over an RS-485 pair, lets the controller supervise each reader so a disconnected or tampered reader raises an alarm, and in Secure Channel mode encrypts the traffic with AES-128. On new Memorial installations we specify OSDP readers with Secure Channel actually enabled, not merely OSDP-capable readers left in their default mode.

The credential

Low-frequency 125 kHz proximity cards and fobs carry a fixed number with no cryptographic protection, and inexpensive tools can read and copy one from a short distance. Smart cards on the 13.56 MHz band that perform mutual authentication, DESFire EV2 and EV3 among them along with comparable vendor-secured formats, resist cloning far better. Mobile credentials in a phone’s wallet or an app add the phone’s own screen lock as a second factor. Multi-technology readers accept old and new credentials side by side, so a changeover can run over weeks instead of one weekend.

The physical layer

Readers mount with tamper-resistant fasteners and, where the model has one, a tamper switch. The enclosure’s own tamper switch lands on a monitored controller input, so opening the cabinet creates a timestamped event.

Tying the controller to cameras, alarms, elevators and home automation

Most Memorial projects involve at least one other system. One rule governs every link: the access controller stays the authority on who gets in, and anything tied to life safety is hardwired rather than trusted to software.

A Villages residence versus an Energy Corridor office: what changes

The hardware lists can look nearly identical. The priorities do not.

At home

• Readers are chosen to disappear: slim mullion models, finishes matched to the door hardware, or keypad trims that pass for ordinary locks.
• The controller lives in the AV rack or a conditioned equipment closet on the same UPS as the network, and the integrator receives a written list of the contacts and events we expose to the automation system.
• Groups follow household roles: family, household staff, regular vendors such as pool or landscape service, and temporary contractors whose access expires automatically.
• Some owners want entry logs kept on a local server instead of a vendor’s cloud. That is a platform choice made before purchase, not a setting flipped later.

At the office

• IT reviews the platform before purchase: where data lives, how it is encrypted, how accounts are managed and whether administrator sign-in ties into the company’s identity system.
• Human resources needs a dependable offboarding step, so a departing employee’s credential is disabled the same day, ideally by the same process that closes their email account.
• Floor access in multi-story buildings runs through the landlord and the elevator contractor, which adds weeks of coordination that belong in the schedule from day one.
• Building management sets the install windows, often evenings and weekends, and noisy work happens only then.

The software says a controller is offline: a diagnostic path

The most common service call on a networked controller is an offline warning in the management software. Working through these checks in order usually finds the cause fast:

1. Do badges still open the doors? If they do, the controller is alive and deciding locally. The fault is in the connection, not the doors.
2. Check the link lights. No light on the controller’s network port or on its switch port points to a damaged patch cable, a disabled port or a switch that lost power.
3. Ask what changed on the network. A replaced router or switch often drops the reserved address or the VLAN the controller lived on. After an IT refresh, this is the usual culprit.
4. Test the path out. Cloud controllers need DNS and the specific outbound ports the vendor documents, and a new firewall policy that blocks them cuts the controller off.
5. Check the clock. A controller that lost its time source can reject the cloud service’s certificate and refuse to connect.
6. Check its power. A controller running on battery because someone switched off its circuit keeps working for a while, then goes dark with the doors. The supply’s status indicator tells you which case you have.

If the doors themselves stop responding, that is a different and more urgent problem. Call (832) 359-2425.

How EVOTECH runs a Memorial controller project alongside your IT or integrator

1. A short kickoff with your IT lead or home integrator to agree on the network segment, addresses, ports and who owns the administrator accounts.
2. A site walk covering every opening, the equipment room and each system the controller must talk to.
3. A written door schedule and integration list attached to an itemized quote.
4. Installation scheduled inside the building’s or Village’s rules, with finish work that matches the house or suite.
5. Configuration with your IT contact present: VLAN, reserved addresses, time source, firmware and accounts.
6. Failure testing on purpose: internet unplugged, utility power off, and fire alarm release confirmed with your fire alarm company.
7. A handover packet with the network sheet, door schedule, firmware versions and administrator access in your name.

For the hardware side of a Memorial panel, including driveway gates and glass suite entries, see our Memorial panel installation page. Cable routes are covered on the Memorial access control cabling page, and ZIP-level detail for the western end of the corridor is on the Houston 77077 door controller page.

What sets the price of a Memorial controller installation

• How many systems the controller must integrate with, and whether each link is a simple contact or a software integration.
• Credential technology: reusing existing cards, moving to secure smart credentials, or adding mobile credentials.
• Whether existing reader cable can carry OSDP reliably or new twisted-pair cable is needed.
• Elevator floor control and the elevator contractor’s share of the work.
• Finish-grade work in custom homes: patching, paint-matched trim and concealed readers.
• After-hours scheduling in managed office buildings.
• Cloud subscription versus on-premises software, and the number of doors licensed.

Request an access controller quote in Memorial, Houston

Related services

Frequently asked questions