Skip to content
Most access control security conversations are about the credential. Can the card be cloned. Is the reader biometric. Should we move to mobile.
Fewer are about the cable behind the reader, which on a large proportion of UK estates is the easier attack.
What Wiegand does and does not do
The Wiegand protocol dates from the 1980s. It sends credential data from the reader to the controller as a simple one-way pulse train over two data wires.
It is unencrypted. Anything on that cable can read the credential in the clear as it passes.
It is unsupervised. The controller has no way of knowing whether the reader at the other end is the one that was commissioned, whether it has been removed, or whether something else has been connected in its place.
It is one-way. The controller cannot query the reader, verify it or challenge it.
In practical terms, that means a small device fitted inside or behind a reader, in a few minutes, with the reader unscrewed from the wall, can capture every credential presented at that door and can later replay any of them. The reader continues to work normally throughout. Nothing on the system indicates anything has happened. There is no alarm, no log entry, no anomaly.
The reader itself is usually on the unsecured side of the door.
What OSDP changes
Open Supervised Device Protocol replaces the Wiegand link with something a security professional would recognise as designed this century. It is published internationally as BS EN IEC 60839-11-5:2020, and the current SIA specification is OSDP v2.2.2, released in October 2024.
Three differences matter.
- Encryption: Secure Channel uses AES-128, so credential data on the cable is not readable by a device that taps it.
- Supervision: Communication is continuously monitored. A reader that is disconnected, substituted or tampered with is detected and reported, rather than silently continuing to appear normal.
- Bidirectional communication: The controller can query and manage the reader, which enables remote configuration, firmware management and diagnostics without a site visit.
There is an operational benefit too: OSDP runs over RS-485 and supports multi-drop, so multiple readers can share a cable run. On a retrofit through existing containment, that frequently decides whether a project is viable.
The mistake that undoes the whole thing
OSDP-capable is not OSDP-secure.
A reader and controller can speak OSDP perfectly well without Secure Channel enabled. In that state, the communication is still unencrypted. You have bought the protocol and left the protection switched off.
This happens more often than it should, for ordinary reasons rather than negligent ones. Secure Channel requires key management, keys have to be installed and tracked, and commissioning under time pressure encourages people to get doors working first and come back to hardening later. Later does not always arrive.
If you have had OSDP readers installed, the question worth asking your integrator is not whether OSDP is deployed. It is whether Secure Channel is enabled, with base keys replaced rather than left at default, and how that was verified at handover.
What a migration involves
Ripping out an estate in one programme is rarely necessary and rarely affordable.
The realistic approach is zone by zone, prioritised by risk rather than by convenience. Perimeter doors, server rooms, cash handling and anything giving onto a restricted area go first. Internal doors with low consequence go last, or wait for the next refresh cycle.
Where readers are being replaced anyway, the marginal cost of doing it properly is small. Where they are not, the honest calculation is whether the exposure at that specific door justifies the work, and a competent integrator should be willing to tell you that the answer at some doors is no.
Two things are worth combining with it. If your credentials are 125 kHz proximity or MIFARE Classic — the latter’s Crypto-1 cipher having been academically broken in 2008 — the credential migration and the reader upgrade should happen in the same programme rather than two years apart. And if you are buying readers now, Aliro capability belongs in the same specification, because these readers will outlast several credential generations.
The wider point
Access control estates are usually assessed on what they can do: how many doors, how many cardholders, which integrations. They are less often assessed on how they fail.
Wiegand fails silently. That is what makes it worth attention out of proportion to its apparent significance. A cloned card eventually shows up as an anomaly somebody notices. A tapped reader does not show up at all.
Evolution surveys access control estates and reports on what is actually installed rather than what the drawings say. That includes reader protocol, Secure Channel status and credential technology, on systems regardless of who installed them.