Risk

11/17/2011
05:00 PM
50%
50%

Biometrics Demystified: What You Need To Know

From fingerprints and retina scans to DNA and gesture recognition, the technology is advancing while costs are declining. Here's what you need to know.

InformationWeek Green - Nov. 21, 2011 InformationWeek Green
Download the entire Nov. 21, 2011 issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree for each of the first 5,000 downloads.

Biometrics For The Rest Of Us Rising threat levels, increasing interconnectivity of systems, and the growing volume and value of data held by computers connected to the Internet have data owners re-evaluating access control methods. They need to do more than just check that authorized users have the correct login information; they also want to ensure that those people are actually the rightful owners of the login information they're using. Biometrics is the only way to do this.

With biometric authentication, every individual is unique. Most people are familiar with techniques such as fingerprint and facial recognition, which grant access based on physiological characteristics, but certain behavioral characteristics, such as typing rhythm, gait, and voice, also can be used.

User names and password combinations can be guessed or easily obtained by imposters. Tokens can be lost, forgotten, and stolen. But criminals can't guess fingerprints, and users can't forget or misplace their fingerprints. Physical attributes can't be faked the way ID cards can. And once a person has authenticated himself using biometrics, he can be tied directly to any actions he performs. This isn't the case with other form of authentication.

Biometric systems also have low administrative overhead. No more password resets. No more redistributing and renewing tokens, and no more revoking and replacing lost or stolen tokens. Most network operating systems allow for the easy integration of biometric authentication to replace and supplement passwords.

How Biometrics Works

Many people are under the misconception that biometric authentication involves direct comparison of the biometric trait--comparing an actual image of a fingerprint with stored fingerprints. What actually happens is that the device capturing the image creates a numerical value to represent the fingerprint--a digital hash of distinct characteristics. This value is sent to the authentication server for comparison with stored values.

With facial recognition, the camera captures an image of the face and extracts relevant characteristics, such as the distance between the eyes, width of the nose, shape of the cheekbones, and length of the jawline. These values are used to create a template.

To read the rest of the article,
Download the Nov. 21, 2011 issue of InformationWeek

Get the Best of Biometric Authentication

Our full report on biometrics is free with registration.

This 16 page report includes:
  • More detail on the types of biometrics technologies available
  • Insight into the workings of the authentication process
  • Performance metrics you should consider
Get This And All Our Reports


Michael Cobb is founder and managing director of CobWeb Applications, a consulting firm that helps companies secure their IT infrastructures. Write to us at [email protected].

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
swilson204
50%
50%
swilson204,
User Rank: Apprentice
11/24/2011 | 9:41:35 PM
re: Biometrics Demystified: What You Need To Know
The credibility of this piece is undermined from the outset by the repetition of biometrics industry mythology. It is just not true that "criminals can't guess fingerprints, and users can't forget or misplace their fingerprints"!

Here is a detailed account of how an attacker can synthesise a fingerprint to match a target, without needing to know the original data http://www.commoncriteriaporta.... The academic press has many other examples of these sorts of methods, for other modalities including facial recognition.

And here is a well known, alomost legendary paper from a decade ago on the replication of latent prints using gelatin candy: http://cryptome.org/gummy.htm. Biometric identity theft has even been demonstrated by television's Myth Busters.

If security commentators don't appreciate the basic vulnerabilities that are present in all biometrics, and instead launch into all the gee-whiz stuff about DNA and gait (techniques that are barely out of the R&D lab) then readers are lulled into a false sense of security. They remain stuck with a science fiction level of understanding of the technologies, innocent of the real practical issues, like the absence of standardised testing, the "Zero Effort Imposter" assumption, and the lack of correspondence between lab testing and real world performance. No less an authority than the FBI says "For all biometric technologies, error rates are highly dependent upon the population and application environment. The technologies do not have known error rates outside of a controlled test environment".

Given their actual imperfection, then above all, people must understand that no commercial biometric can be cancelled and re-issued in the event of compromise. They have to be perfectly immune to identity theft, because there is no disaster recovery plan! This assumption of perfection sets biometrics apart from all other security technologies, and it sets biometrics journalism apart from all other security analysis.
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
Hyatt Hit With Another Credit Card Breach
Dark Reading Staff 10/13/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.