Who's That Knocking on My Door

Pfizer was also wrestling with a second, security-related problem: Whenever Pfizer acquired a new company, it also acquired that company's building access control systems, which are expensive and difficult to change. "Your CIO isn't going to be excited about swapping out a control system," Holbrook says, because of the cost. But the mishmash of access systems made IT management chores complex, and it frustrated the many Pfizer employees who constantly move among sites.

Pfizer's IT group saw an opportunity to address both issues: digital signatures and ID management. Could they kill two birds with one smart card system?

Yes, they decided, and using a cost-reduction argument, they won support from the business side for a smart card-based ID management system that would enable digital signatures, standardize building access and handle PC network logons.

Lessons Learned While Making a Smarter Card

Theoretical work on the smart card project began in 2002, and Pfizer IT began getting the project resources together in 2003. "It was definitely an IT-driven project," says Scott Potter, Pfizer's senior director of worldwide business technology and Holbrook's boss. What's more, it was bleeding-edge technology. So the pressure was on.

The first lesson learned was that if you're doing an ID management overhaul, don't expect to find pretty, prewrapped packages. Pfizer's IT group could not find an off-the-shelf smart card product that offered enough power and flexibility.

"We wanted to be able to support other uses going forward," Potter says. For example, the Pfizer IT team wanted as much memory on the smart card as was practical. So the IT team decided it would need to create its own card. "We basically designed this platform ourselves," Potter says, noting Pfizer brought together two vendors, Gemalto and HID Global, to provide parts of the smart cards.