The most secure building I've ever been was one of the Giro buildings in Budapest. All visitors must show id and it is checked by professional guards, doesn't matter who you are are. They will call whoever you claim to be visiting and verify. Next you get your visitors badge. You can't get anywhere with it but the given office. Where corridors cross, you have man traps and your badge will only open the one direction you are allowed to go. This was a converted building so they added sliding glass doors to the existing doors and guess what, you need a badge to open any of those. To enter from the elevator to a corridor again you have a man trap. Tailgate that. Visitor's bathroom is outside of the secure area.
This sounds quite a lot like the setup at Bank of Finland.
It's been nearly 20 years since I visited, but they had access pass only doors everywhere, and all visitors needed an escort at all time. (Helps that they can't get anywhere without badges.)
In addition to all of the above, they had one final gem. Everywhere throughout the offices, there is always one route that gets you through one-way doors. Open them from the inside, get through. Try going back, you need the badge. All of these one-way routes eventually led to a single room. No furniture. Always lit. And every square centimeter monitored with CCTV.
Essentially, if you ever found yourself inside the bank's office, all open paths led to what was essentially a holding cell.
Is a setup like that legal in Finland? Although highly effective from a security standpoint, I can't see a setup like that ever being allowed under US fire codes.
I found following note in document titled "Turvalliset oven avausratkaisut poistumisreiteillä" (roughly translates to "Safe door opening solutions in exit routes"):
> Tiloja, joiden toiminnan luonne edellyttää henkilöiden eristämistä, ei käsitellä tässä. Nämä kohteet käsitellään tapauskohtaisesti pelastusviranomaisten kanssa.
Roughly that means that the document doesn't cover areas which require isolating people and their safety should be discussed case-by-case with safety officials, so it's likely they would require some similar measurements as there are in places like prisons.
Typically activation of the fire alarm will release exit doors, unlock turnstiles, and etc. to facilitate a fast exit. Latches will be arranged so that the doors only open outwards in this case.
The fire alarm system can then be manually supervised to deter false activations. Ultimately, though, human safety always trumps asset protection or information security.
Fire codes can be assuaged in a variety of ways. For example, a Knox box is supposed to hold the master key to your building, but a front door key can sometimes get you to squeak by, depending upon the staffing level of your building (do you always have security up front, for example, 24/7?).
My first or second business trip was to a top secret facility. You had an escort at all times, and when you entered a room a revolving light lit up to let everyone know there was an unsecure person nearby.
