Risk
11/17/2011
05:00 PM
50%
50%

Biometrics Demystified: What You Need To Know

From fingerprints and retina scans to DNA and gesture recognition, the technology is advancing while costs are declining. Here's what you need to know.

InformationWeek Green - Nov. 21, 2011 InformationWeek Green
Download the entire Nov. 21, 2011 issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Biometrics For The Rest Of Us Rising threat levels, increasing interconnectivity of systems, and the growing volume and value of data held by computers connected to the Internet have data owners re-evaluating access control methods. They need to do more than just check that authorized users have the correct login information; they also want to ensure that those people are actually the rightful owners of the login information they're using. Biometrics is the only way to do this.

With biometric authentication, every individual is unique. Most people are familiar with techniques such as fingerprint and facial recognition, which grant access based on physiological characteristics, but certain behavioral characteristics, such as typing rhythm, gait, and voice, also can be used.

User names and password combinations can be guessed or easily obtained by imposters. Tokens can be lost, forgotten, and stolen. But criminals can't guess fingerprints, and users can't forget or misplace their fingerprints. Physical attributes can't be faked the way ID cards can. And once a person has authenticated himself using biometrics, he can be tied directly to any actions he performs. This isn't the case with other form of authentication.

Biometric systems also have low administrative overhead. No more password resets. No more redistributing and renewing tokens, and no more revoking and replacing lost or stolen tokens. Most network operating systems allow for the easy integration of biometric authentication to replace and supplement passwords.

How Biometrics Works

Many people are under the misconception that biometric authentication involves direct comparison of the biometric trait--comparing an actual image of a fingerprint with stored fingerprints. What actually happens is that the device capturing the image creates a numerical value to represent the fingerprint--a digital hash of distinct characteristics. This value is sent to the authentication server for comparison with stored values.

With facial recognition, the camera captures an image of the face and extracts relevant characteristics, such as the distance between the eyes, width of the nose, shape of the cheekbones, and length of the jawline. These values are used to create a template.

To read the rest of the article,
Download the Nov. 21, 2011 issue of InformationWeek

Get the Best of Biometric Authentication

Our full report on biometrics is free with registration.

This 16 page report includes:
  • More detail on the types of biometrics technologies available
  • Insight into the workings of the authentication process
  • Performance metrics you should consider
Get This And All Our Reports


Michael Cobb is founder and managing director of CobWeb Applications, a consulting firm that helps companies secure their IT infrastructures. Write to us at iwletters@techweb.com.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
swilson204
50%
50%
swilson204,
User Rank: Apprentice
11/24/2011 | 9:41:35 PM
re: Biometrics Demystified: What You Need To Know
The credibility of this piece is undermined from the outset by the repetition of biometrics industry mythology. It is just not true that "criminals can't guess fingerprints, and users can't forget or misplace their fingerprints"!

Here is a detailed account of how an attacker can synthesise a fingerprint to match a target, without needing to know the original data http://www.commoncriteriaporta.... The academic press has many other examples of these sorts of methods, for other modalities including facial recognition.

And here is a well known, alomost legendary paper from a decade ago on the replication of latent prints using gelatin candy: http://cryptome.org/gummy.htm. Biometric identity theft has even been demonstrated by television's Myth Busters.

If security commentators don't appreciate the basic vulnerabilities that are present in all biometrics, and instead launch into all the gee-whiz stuff about DNA and gait (techniques that are barely out of the R&D lab) then readers are lulled into a false sense of security. They remain stuck with a science fiction level of understanding of the technologies, innocent of the real practical issues, like the absence of standardised testing, the "Zero Effort Imposter" assumption, and the lack of correspondence between lab testing and real world performance. No less an authority than the FBI says "For all biometric technologies, error rates are highly dependent upon the population and application environment. The technologies do not have known error rates outside of a controlled test environment".

Given their actual imperfection, then above all, people must understand that no commercial biometric can be cancelled and re-issued in the event of compromise. They have to be perfectly immune to identity theft, because there is no disaster recovery plan! This assumption of perfection sets biometrics apart from all other security technologies, and it sets biometrics journalism apart from all other security analysis.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.