Low-Voltage Access Control in Sugar Land: The Credential, the Reader Cable and the Network

The Sugar Land properties where the data side decides the outcome

• Corporate and professional offices along the I-69 and US-59 corridor and around Sugar Land Town Square, where a lobby, a suite entry and a server room each need different rules.
• Medical and dental practices near the hospital campuses and along Highway 6, with rooms that hold patient records, drugs or lab equipment and an owner who wants a record of every entry.
• Retail and service centers in First Colony and Telfair, and newer mixed-use space at Imperial Market on the old refinery grounds.
• Community associations in First Colony, Riverstone, Telfair, Greatwood, New Territory and other planned communities, some with gated sections, most with pools, fitness rooms and clubhouses.
• Homes, where wired access control usually covers a side gate, a detached office or a garage rather than the front door.

Sugar Land sits inside the core area we serve from our Katy base. Call to confirm scheduling for your address.

Card formats: why a 125 kHz proximity badge is a liability

A large share of badges still in use are 125 kHz proximity cards and fobs. They broadcast a fixed number with no encryption, and inexpensive handheld devices can read and copy one from a short distance. Kiosks at shopping centers will duplicate a prox fob in minutes. Some early 13.56 MHz smart cards fare little better: MIFARE Classic’s encryption was broken publicly years ago, and the keys behind legacy iCLASS cards have also been exposed.

Migration does not require a flag day. Multi-technology readers accept old prox cards and new secure cards at the same time, so new badges can go out over a few weeks. The step that matters is the last one: switching prox reading off in the readers. Until that happens, the weak card still opens the door.

The reader cable determines whether a secure card stays secure

Here is a detail many upgrades miss. A secure card protects the conversation between the card and the reader. The reader then passes the card number to the controller, and on most older systems that link uses Wiegand, a one-way signal on two data wires that carries the number unencrypted. Small devices spliced in behind a reader can log every badge and replay it later. So a secure card read by a Wiegand reader still travels the last few feet in the clear.

OSDP (Open Supervised Device Protocol) replaces it. It runs on RS-485, is two-way, and offers:

• Secure Channel encryption between reader and controller;
• supervision, so the controller raises an alarm if a reader is unplugged or goes silent;
• longer reach, up to about 4,000 feet on RS-485, compared with the roughly 500 feet usually quoted for Wiegand;
• fewer conductors: one twisted pair for data plus a pair for power, and several readers can share one run.

Older Wiegand runs are usually a six-conductor cable that is not twisted in pairs. It sometimes carries OSDP on short runs, but twisted-pair cable is the reliable choice, so we test the existing cable before promising to reuse it.

Location matters as much as protocol. The reader belongs on the unsecured side of the door, and the controller and lock wiring belong on the secured side. If the lock’s control wires are reachable from the hallway, shorting two of them can release the door.

Where the decisions happen: on-site server, cloud service or open platform

• On-site server software. Controllers report to a computer in your building. There are no per-door subscriptions, but your office owns patching, backups and the Windows machine it runs on.
• Cloud-managed systems. Controllers at the site connect outward to a hosted service, and managers administer it from a browser or phone. Updates are the vendor’s job, and pricing is usually a subscription per door or per user.
• Open-platform controllers. Some controller hardware is supported by several software vendors, so changing software later does not mean replacing every panel.

Two questions settle most choices. First, does a door still work when the internet is down? A well-designed controller keeps its credential list locally and decides on its own; confirm that before buying any cloud system. Second, who owns the keys to the kingdom? Insist on the master administrator account, a record of the card format and site code, and any encryption keys used for your badges. Without those, only the original vendor can change your system.

Connecting access control to an office network without opening a hole

1. Separate segment. Controllers, readers and door equipment sit on their own VLAN, allowed to reach only the server or cloud service they need.
2. No inbound port forwarding. Remote administration goes through the vendor’s cloud or a VPN, never an open port on the firewall.
3. Default passwords changed and firmware current on every controller.
4. Accurate time. Controllers sync to a time server so audit entries line up with camera footage, and so unlock schedules follow daylight saving changes correctly.
5. Power continuity. The switch and controller ride on a UPS, especially when readers draw power over Ethernet.
6. Integration where it helps. A door-forced alarm can bookmark the nearest camera, and some platforms link to your staff directory so removing an employee also disables the badge.

Your IT provider should be part of this conversation from the start. We are glad to work directly with them.

Pools, clubhouses and gated sections: many residents, one database

An association’s system is mostly a data-management problem. Each resident should have an individual credential tied to an address, with a household limit. Amenity doors follow posted hours. Lifeguard, cleaning and management staff get their own schedules. When a home sells, the old owner’s credentials come out the same week.

The copied-fob problem described above is common in associations: residents duplicate 125 kHz fobs cheaply and the database loses track of who holds what. Moving to secure fobs stops it. For vehicle gates, long-range UHF windshield tags let residents drive through without reaching for a keypad, while visitors use the call box or a resident’s app. Because boards and management companies change, the administrator login should belong to the association, not to one volunteer.

What EVOTECH checks on a Sugar Land access control call

1. Identify the badge technology you have today with a reader tool, rather than guessing from the card’s label.
2. Record the controller make, firmware and software, and find out who holds administrator access.
3. Trace each reader cable: conductor count, twisted pairs, length, and which side of the door it is on.
4. Map where controllers connect to the network, and meet with your IT provider.
5. Recommend a credential, protocol and software plan, including how old badges get retired.
6. Send an itemized quote.
7. Install, enroll users, turn off legacy card reading on schedule, and confirm controller time and logs.
8. Hand over the administrator account, card-format record and wiring notes, and train your administrators.

What moves the price of a Sugar Land system

• How many badges or phone credentials you need, and the technology chosen.
• Reader count, and whether multi-technology readers are needed during the transition.
• Whether existing cable can carry OSDP or new twisted-pair runs are needed.
• The software model: a one-time license, or a hosted service with recurring fees.
• Integrations with cameras, directories or alarm monitoring.
• Coordination with IT and building management, and after-hours work in occupied offices.
• Door hardware that must be replaced along the way.

Data-side decisions that send a system back for rework

• New secure badges issued, but readers still accepting old prox cards.
• New readers wired back to an old panel over Wiegand, leaving the cable as the weak link.
• Controllers on the flat office network with factory passwords.
• No time sync, so logs drift and door schedules end up an hour off after a daylight saving change.
• The only administrator login belonging to a former office manager or the previous installer.
• Lock control wiring reachable from the unsecured side of the door.
• A cloud system that was never tested with the internet unplugged.

Request a low-voltage access control quote in Sugar Land

Related services

Frequently asked questions