Risk
11/17/2011
05:00 PM
Connect Directly
RSS
E-Mail
50%
50%

Biometrics Demystified: What You Need To Know

From fingerprints and retina scans to DNA and gesture recognition, the technology is advancing while costs are declining. Here's what you need to know.

InformationWeek Green - Nov. 21, 2011 InformationWeek Green
Download the entire Nov. 21, 2011 issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Biometrics For The Rest Of Us Rising threat levels, increasing interconnectivity of systems, and the growing volume and value of data held by computers connected to the Internet have data owners re-evaluating access control methods. They need to do more than just check that authorized users have the correct login information; they also want to ensure that those people are actually the rightful owners of the login information they're using. Biometrics is the only way to do this.

With biometric authentication, every individual is unique. Most people are familiar with techniques such as fingerprint and facial recognition, which grant access based on physiological characteristics, but certain behavioral characteristics, such as typing rhythm, gait, and voice, also can be used.

User names and password combinations can be guessed or easily obtained by imposters. Tokens can be lost, forgotten, and stolen. But criminals can't guess fingerprints, and users can't forget or misplace their fingerprints. Physical attributes can't be faked the way ID cards can. And once a person has authenticated himself using biometrics, he can be tied directly to any actions he performs. This isn't the case with other form of authentication.

Biometric systems also have low administrative overhead. No more password resets. No more redistributing and renewing tokens, and no more revoking and replacing lost or stolen tokens. Most network operating systems allow for the easy integration of biometric authentication to replace and supplement passwords.

How Biometrics Works

Many people are under the misconception that biometric authentication involves direct comparison of the biometric trait--comparing an actual image of a fingerprint with stored fingerprints. What actually happens is that the device capturing the image creates a numerical value to represent the fingerprint--a digital hash of distinct characteristics. This value is sent to the authentication server for comparison with stored values.

With facial recognition, the camera captures an image of the face and extracts relevant characteristics, such as the distance between the eyes, width of the nose, shape of the cheekbones, and length of the jawline. These values are used to create a template.

To read the rest of the article,
Download the Nov. 21, 2011 issue of InformationWeek

Get the Best of Biometric Authentication

Our full report on biometrics is free with registration.

This 16 page report includes:
  • More detail on the types of biometrics technologies available
  • Insight into the workings of the authentication process
  • Performance metrics you should consider
Get This And All Our Reports


Michael Cobb is founder and managing director of CobWeb Applications, a consulting firm that helps companies secure their IT infrastructures. Write to us at iwletters@techweb.com.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
swilson204
50%
50%
swilson204,
User Rank: Apprentice
11/24/2011 | 9:41:35 PM
re: Biometrics Demystified: What You Need To Know
The credibility of this piece is undermined from the outset by the repetition of biometrics industry mythology. It is just not true that "criminals can't guess fingerprints, and users can't forget or misplace their fingerprints"!

Here is a detailed account of how an attacker can synthesise a fingerprint to match a target, without needing to know the original data http://www.commoncriteriaporta.... The academic press has many other examples of these sorts of methods, for other modalities including facial recognition.

And here is a well known, alomost legendary paper from a decade ago on the replication of latent prints using gelatin candy: http://cryptome.org/gummy.htm. Biometric identity theft has even been demonstrated by television's Myth Busters.

If security commentators don't appreciate the basic vulnerabilities that are present in all biometrics, and instead launch into all the gee-whiz stuff about DNA and gait (techniques that are barely out of the R&D lab) then readers are lulled into a false sense of security. They remain stuck with a science fiction level of understanding of the technologies, innocent of the real practical issues, like the absence of standardised testing, the "Zero Effort Imposter" assumption, and the lack of correspondence between lab testing and real world performance. No less an authority than the FBI says "For all biometric technologies, error rates are highly dependent upon the population and application environment. The technologies do not have known error rates outside of a controlled test environment".

Given their actual imperfection, then above all, people must understand that no commercial biometric can be cancelled and re-issued in the event of compromise. They have to be perfectly immune to identity theft, because there is no disaster recovery plan! This assumption of perfection sets biometrics apart from all other security technologies, and it sets biometrics journalism apart from all other security analysis.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio