Tech · 9 July 2026 · 6 min
Assets and data: why a clonable tag is worse than no tag
Two types of security
Physical security and information security are two different things.
Exteryo Report Editorial Team
The former without the latter produces a false sense of security, which is worse than having no system at all.
The short answer
The word security covers two things.
- Physical securitymakes information accessible when needed
- Information securitymakes it reliable
The short answer
The latter is built on two levels: the tag, which must resist cloning as much as the object is worth, and the platform, with profiled access, immutable logs, and encrypted data.
Why it is not simple
It is treated as a compliance task.
It is not.
Why it is not simple
In traceability projects, security often comes last, as a constraint imposed by someone else: the legal department, an audit, a client requesting a supplier questionnaire. It is the level that determines whether the collected data can be trusted.
Chapter 1 of 4
Physical security and information security: what is the difference?
Two types of security
The former without the latter is just theatre.
Physical security
Physical security concerns objects and people.
1 of 2
That the PPE is compliant
2 of 2
If the device worn has expired
Physical security
Here, technology serves to make information accessible when needed.
Information security
Information security concerns data: that the identifier is not clonable, that the record cannot be altered retrospectively, that whoever reads it is authorised to do so. Here, technology serves to make information reliable.
Note
Accessible and reliable are not synonyms: information can arrive on time and be false.
Before moving on
A tag that anyone can duplicate: better or worse than no system?
Just theatre
A system that declares a PPE compliant based on a tag that anyone can duplicate with a simple app is producing a false sense of security. It is worse than having no system, because it leads people to lower their guard.
Chapter 2 of 4
What does the chip actually guarantee?
The tag level
Not all chips are equivalent.
The tag level
An NTAG213 has a unique and non-rewritable UID: it guarantees that that chip is that chip.
Tap the chip
What does the UID guarantee?
What does the UID guarantee?
Before moving on
If the application only reads the UID, what does the protection amount to?
The tag level
If the application only reads the UID, the level of protection is that of a printed serial number.
Note
Only reading the UID is equivalent to trusting a number written on a label: whoever copies it, has it.
Cryptographic authentication
Chips with cryptographic authentication solve the problem differently: the tag proves it knows a key without revealing it. Cloning would require extracting the key from the silicon, which shifts the attack from «an app» to «a laboratory».
How much it is worth forging
The practical question is not which chip is the most secure, but how much it is worth for an attacker to forge this object.
How much it is worth forging
A municipal streetlight and a luxury bag do not require the same level, and paying for the wrong level is a waste in either direction.
Chapter 3 of 4
What must the platform guarantee?
The platform level
Above the tag is the software, with the requirements of any system that processes corporate data and, often, the personal data of workers.
The requirements
- Accessaccess profiling
- Modificationsimmutable modification logs
- Dataencryption in transit and at rest
- Accountsaccount lifecycle management
The GDPR
When data concerns inspections, deadlines, and the assignment of PPE to identifiable people, it falls within the scope of the European General Data Protection Regulation (GDPR).
The GDPR
The operational consequence is concrete: you need to know who the data controller is, who the data processor is, and which sub-processors are involved in the chain. This is contractual work, not technical, and must be done before uploading the first piece of data.
Note
Data controller, data processor, sub-processors: these are names that the contract must already contain on the day the first piece of data is uploaded.
Chapter 4 of 4
What would you show a judge?
The verification
At the end of a control project, the verification is always the same.
The verification
«If tomorrow an authority, a client, or a judge asked me to prove that this object was inspected on that date by that person, what do I show them, and why should they believe me?»
If it holds up
If the answer holds up, the four levels—identification, serialisation, traceability, and security—are in place.
If it does not hold up
If it does not hold up, the weak point is almost always the last one.
Note
These are the four levels of corporate control: security is the last one, and it decides whether the others can be trusted.
In one sentence
Security is not a compliance task: it is the level that determines whether the collected data can be trusted.
Exteryo Report
Takeaways
Six checks before trusting the data of a control system. For those who must answer for that data.
0 of 6 checked
Write with us
Want to write for Exteryo Report?
If you would like to write or publish an article, or collaborate with us, email the editorial team or get in touch through the contact form.
Sources
- NXP, NTAG213/215/216 data sheet: the UIDnxp.com↗
- Regulation (EU) 2016/679 (GDPR) on EUR-Lexeur-lex.europa.eu↗
Editorial note: Exteryo Report is promoted by Exteryo, a B2B platform for control. The article is a general analysis; data on the chip and the GDPR refer to the indicated public sources.
Images and animations: illustrative objects generated with artificial intelligence. They do not depict real objects or documents mentioned in the article.
ExteryoExteryo Report · 9 July 2026