Risk
11/17/2011
05:00 PM
Connect Directly
RSS
E-Mail
50%
50%

Biometrics Demystified: What You Need To Know

From fingerprints and retina scans to DNA and gesture recognition, the technology is advancing while costs are declining. Here's what you need to know.

InformationWeek Green - Nov. 21, 2011 InformationWeek Green
Download the entire Nov. 21, 2011 issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Biometrics For The Rest Of Us Rising threat levels, increasing interconnectivity of systems, and the growing volume and value of data held by computers connected to the Internet have data owners re-evaluating access control methods. They need to do more than just check that authorized users have the correct login information; they also want to ensure that those people are actually the rightful owners of the login information they're using. Biometrics is the only way to do this.

With biometric authentication, every individual is unique. Most people are familiar with techniques such as fingerprint and facial recognition, which grant access based on physiological characteristics, but certain behavioral characteristics, such as typing rhythm, gait, and voice, also can be used.

User names and password combinations can be guessed or easily obtained by imposters. Tokens can be lost, forgotten, and stolen. But criminals can't guess fingerprints, and users can't forget or misplace their fingerprints. Physical attributes can't be faked the way ID cards can. And once a person has authenticated himself using biometrics, he can be tied directly to any actions he performs. This isn't the case with other form of authentication.

Biometric systems also have low administrative overhead. No more password resets. No more redistributing and renewing tokens, and no more revoking and replacing lost or stolen tokens. Most network operating systems allow for the easy integration of biometric authentication to replace and supplement passwords.

How Biometrics Works

Many people are under the misconception that biometric authentication involves direct comparison of the biometric trait--comparing an actual image of a fingerprint with stored fingerprints. What actually happens is that the device capturing the image creates a numerical value to represent the fingerprint--a digital hash of distinct characteristics. This value is sent to the authentication server for comparison with stored values.

With facial recognition, the camera captures an image of the face and extracts relevant characteristics, such as the distance between the eyes, width of the nose, shape of the cheekbones, and length of the jawline. These values are used to create a template.

To read the rest of the article,
Download the Nov. 21, 2011 issue of InformationWeek

Get the Best of Biometric Authentication

Our full report on biometrics is free with registration.

This 16 page report includes:
  • More detail on the types of biometrics technologies available
  • Insight into the workings of the authentication process
  • Performance metrics you should consider
Get This And All Our Reports


Michael Cobb is founder and managing director of CobWeb Applications, a consulting firm that helps companies secure their IT infrastructures. Write to us at iwletters@techweb.com.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
swilson204
50%
50%
swilson204,
User Rank: Apprentice
11/24/2011 | 9:41:35 PM
re: Biometrics Demystified: What You Need To Know
The credibility of this piece is undermined from the outset by the repetition of biometrics industry mythology. It is just not true that "criminals can't guess fingerprints, and users can't forget or misplace their fingerprints"!

Here is a detailed account of how an attacker can synthesise a fingerprint to match a target, without needing to know the original data http://www.commoncriteriaporta.... The academic press has many other examples of these sorts of methods, for other modalities including facial recognition.

And here is a well known, alomost legendary paper from a decade ago on the replication of latent prints using gelatin candy: http://cryptome.org/gummy.htm. Biometric identity theft has even been demonstrated by television's Myth Busters.

If security commentators don't appreciate the basic vulnerabilities that are present in all biometrics, and instead launch into all the gee-whiz stuff about DNA and gait (techniques that are barely out of the R&D lab) then readers are lulled into a false sense of security. They remain stuck with a science fiction level of understanding of the technologies, innocent of the real practical issues, like the absence of standardised testing, the "Zero Effort Imposter" assumption, and the lack of correspondence between lab testing and real world performance. No less an authority than the FBI says "For all biometric technologies, error rates are highly dependent upon the population and application environment. The technologies do not have known error rates outside of a controlled test environment".

Given their actual imperfection, then above all, people must understand that no commercial biometric can be cancelled and re-issued in the event of compromise. They have to be perfectly immune to identity theft, because there is no disaster recovery plan! This assumption of perfection sets biometrics apart from all other security technologies, and it sets biometrics journalism apart from all other security analysis.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0761
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.

CVE-2014-0762
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows physically proximate attackers to cause a denial of service (infinite loop or process crash) via crafted input over a serial line.

CVE-2014-2380
Published: 2014-08-27
Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obtain sensitive information by reading a credential file.

CVE-2014-2381
Published: 2014-08-27
Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows local users to obtain sensitive information by reading a credential file.

CVE-2014-3344
Published: 2014-08-27
Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq31129, CSCuq3...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.