05:00 PM

Biometrics Demystified: What You Need To Know

From fingerprints and retina scans to DNA and gesture recognition, the technology is advancing while costs are declining. Here's what you need to know.

InformationWeek Green - Nov. 21, 2011 InformationWeek Green
Download the entire Nov. 21, 2011 issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Biometrics For The Rest Of Us Rising threat levels, increasing interconnectivity of systems, and the growing volume and value of data held by computers connected to the Internet have data owners re-evaluating access control methods. They need to do more than just check that authorized users have the correct login information; they also want to ensure that those people are actually the rightful owners of the login information they're using. Biometrics is the only way to do this.

With biometric authentication, every individual is unique. Most people are familiar with techniques such as fingerprint and facial recognition, which grant access based on physiological characteristics, but certain behavioral characteristics, such as typing rhythm, gait, and voice, also can be used.

User names and password combinations can be guessed or easily obtained by imposters. Tokens can be lost, forgotten, and stolen. But criminals can't guess fingerprints, and users can't forget or misplace their fingerprints. Physical attributes can't be faked the way ID cards can. And once a person has authenticated himself using biometrics, he can be tied directly to any actions he performs. This isn't the case with other form of authentication.

Biometric systems also have low administrative overhead. No more password resets. No more redistributing and renewing tokens, and no more revoking and replacing lost or stolen tokens. Most network operating systems allow for the easy integration of biometric authentication to replace and supplement passwords.

How Biometrics Works

Many people are under the misconception that biometric authentication involves direct comparison of the biometric trait--comparing an actual image of a fingerprint with stored fingerprints. What actually happens is that the device capturing the image creates a numerical value to represent the fingerprint--a digital hash of distinct characteristics. This value is sent to the authentication server for comparison with stored values.

With facial recognition, the camera captures an image of the face and extracts relevant characteristics, such as the distance between the eyes, width of the nose, shape of the cheekbones, and length of the jawline. These values are used to create a template.

To read the rest of the article,
Download the Nov. 21, 2011 issue of InformationWeek

Get the Best of Biometric Authentication

Our full report on biometrics is free with registration.

This 16 page report includes:
  • More detail on the types of biometrics technologies available
  • Insight into the workings of the authentication process
  • Performance metrics you should consider
Get This And All Our Reports

Michael Cobb is founder and managing director of CobWeb Applications, a consulting firm that helps companies secure their IT infrastructures. Write to us at iwletters@techweb.com.

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
User Rank: Apprentice
11/24/2011 | 9:41:35 PM
re: Biometrics Demystified: What You Need To Know
The credibility of this piece is undermined from the outset by the repetition of biometrics industry mythology. It is just not true that "criminals can't guess fingerprints, and users can't forget or misplace their fingerprints"!

Here is a detailed account of how an attacker can synthesise a fingerprint to match a target, without needing to know the original data http://www.commoncriteriaporta.... The academic press has many other examples of these sorts of methods, for other modalities including facial recognition.

And here is a well known, alomost legendary paper from a decade ago on the replication of latent prints using gelatin candy: http://cryptome.org/gummy.htm. Biometric identity theft has even been demonstrated by television's Myth Busters.

If security commentators don't appreciate the basic vulnerabilities that are present in all biometrics, and instead launch into all the gee-whiz stuff about DNA and gait (techniques that are barely out of the R&D lab) then readers are lulled into a false sense of security. They remain stuck with a science fiction level of understanding of the technologies, innocent of the real practical issues, like the absence of standardised testing, the "Zero Effort Imposter" assumption, and the lack of correspondence between lab testing and real world performance. No less an authority than the FBI says "For all biometric technologies, error rates are highly dependent upon the population and application environment. The technologies do not have known error rates outside of a controlled test environment".

Given their actual imperfection, then above all, people must understand that no commercial biometric can be cancelled and re-issued in the event of compromise. They have to be perfectly immune to identity theft, because there is no disaster recovery plan! This assumption of perfection sets biometrics apart from all other security technologies, and it sets biometrics journalism apart from all other security analysis.
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-06
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999.

Published: 2015-10-06
Bluetooth in Android before 5.1.1 LMY48T allows attackers to remove stored SMS messages via a crafted application, aka internal bug 22343270.

Published: 2015-10-06
mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22954006.

Published: 2015-10-06
The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.

Published: 2015-10-06
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23213430.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.