To validate a user's key, reader devices are placed in front of doors. These door readers can be standalone units or networked together. Networked readers require new cabling, which can become quite expensive, but you won't have to go to every door to update enrollment. If you have high employee turnover or a large number of doors, the networked approach may be worth the money.

All token authentication has a common failure point--if it's stolen or borrowed, anybody can gain access. If the token is lost or left at home, the employee can't get in until it's replaced.

Combination locks overcome this problem. The longer the combination phrase, the harder it is to guess the combination. The best combination locks can detect repetitive failures and offer a cooling-off period or an alarm. Of course, it's still possible for someone to look over a user's shoulder and see the combination being punched in. The most effective locks are those that use both a token, such as a key, and a combination that only the user would know.

Biometrics let you authenticate identity based on physical traits like fingerprints, handprints, voiceprints and retinal scans. But this option poses problems, including difficulties with enrollment, lack of user acceptance and environmental interference (see our Buyer's Guide on biometrics). One way to ease into biometrics is to look for a setup that will integrate with existing authentication systems. For the smoothest transition possible, you must have user buy-in and follow the manufacturer's instructions.

Be sure the lock you choose fits the environment. If it's not waterproof, it shouldn't be installed outdoors. As for biometrics, some locations have a high concentration of airborne particles that may cause the sensitive equipment to fail and the locks to jam.

Finally, the strength of the lock should be equal to the value of the equipment you're protecting. At Network Computing's Real-World Labs® at Syracuse University, we've broken the magnetic hold on several cheaper locks.

Michael J. DeMaria is an associate technology editor based at Network Computing's Syracuse University's Real-World Labs®. Write to him at mdemaria@nwc.com.