Asset and data security: the layer that is often missing

In tracking projects, security almost always comes last, and almost always as a constraint imposed by someone else: the legal department, an audit, a customer sending out its supplier questionnaire. The result is that it gets treated as a formality, when in fact it is the layer that determines whether the collected data can be trusted.

Two securities, often confused

The word covers two distinct things.

Physical safety concerns objects and people: that the PPE is compliant, that the machine has been checked, that the worker knows in real time whether the device they are wearing has expired. Here, technology serves to make information accessible at the moment of need.

Information security concerns the data: that the identifier cannot be cloned, that the record cannot be altered after the fact, that whoever reads is authorized to read. Here, technology serves to make information reliable.

The first without the second is theatre. A system that declares a piece of PPE compliant on the basis of a tag anyone can duplicate with a ten-euro app is producing false security — worse than no system at all, because it leads people to lower their guard.

The tag layer

Not all chips are equivalent. An NTAG213 has a unique, non-rewritable UID: it guarantees that that chip is that chip. It does not guarantee that someone cannot present a different chip with a UID copied into a readable data field. If the application merely reads the UID, the level of protection is that of a printed serial number.

Chips with cryptographic authentication solve the problem differently: the tag proves it knows a key without revealing it. Cloning would require extracting the key from the silicon, which moves the attack from "an app" to "a laboratory".

The practical question is not which chip is the most secure, but how much it is worth to an attacker to counterfeit this object. A municipal streetlight and a luxury handbag do not require the same level, and paying for the wrong level is a waste in both directions.

The platform layer

Above the tag sits the software, and here the requirements are those of any system handling company data and, often, workers' personal data: access profiling, immutable change logs, encryption in transit and at rest, account life-cycle management.

When the data concerns inspections, expiry dates and the assignment of PPE to identifiable people, you enter GDPR territory. The operational consequence is concrete: you need to know who the data controller is, who the processor is, and which sub-processors are involved in the chain. It is contractual work, not technical work, and it must be done before the first piece of data is loaded.

The question that closes the circle

At the end of a control project, the check is always the same: if tomorrow an authority, a customer or a judge asked me to prove that this object was inspected on that date by that person, what do I show them, and why should they believe me?

If the answer holds, the four layers — identification, serialization, tracking, security — are in place. If it does not, the weak point is almost always the last one.