Vulnerabilities / Threats

5/12/2016
10:50 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Enterprises Must Consider Privacy Concern For Biometrics

On-server storage and processing of biometric authentication presents a host of regulatory and corporate responsibility issues.

It's bad enough when an organization exposes huge repositories of customer records and login information through large-scale data breaches. But the ante for pain is going up if organizations start collecting and storing biometric information indiscriminately.

When mega breaches regularly start including biometrics, individuals will be in a bind.

Unlike passwords, this information is unchangeable and the impact for consumers, citizens, and business users will be tremendous if enterprises don't start thinking seriously about the privacy of biometric information before it becomes a major attack target, experts say.

The regulators are still playing catch-up in the US when it comes to biometrics privacy controls, but already in the EU, Canada, and some parts of Asia, governments are clamping down. And as biometrics collection becomes more prevalent and more breaches involving biometrics information come to light, that compliance and risk environment is going to grow increasingly fraught for businesses hoping to leverage this information for authentication, according to a report out today by PwC Legal and Nok Nok Labs.

We've already gotten a glimpse into the future of biometrics hacks, as the OPM breach of last year exposed the fingerprints of 5.6 million US citizens. As things stand, the opportunity to misuse fingerprints is still pretty small, but even the OPM admitted that this could change over time as technology evolves. What will also change rapidly is the technical chops of non-governmental agencies to collect the same volume of biometrics information that only governments used to be capable of gathering in the past. In addition, the time is coming where it will be much easier to collect that data without the individual even knowing it is being collected.

"The collection of biometric data has historically been difficult to do from a technical perspective without the user being aware it is happening. The gathering of fingerprints, iris scans and retina images requires the user to be extremely close to the reading device," warns the report. "However, advances in technology have changed this and as voice, facial and gait analyses becomes more prevalent, the risk of covert or incidental collection of biometric data significantly increases."

As such, organizations are going to not only have to think about privacy, but also collection transparency issues in the near future. Some of the biggest concerns that need to be addressed beyond transparency include how that information is stored if aggregated on enterprise servers, how to ensure that data is adequately destroyed if permission is removed by the individual to collect the data, and how organizations will organize cross-border transfers of the data.  

PwC Legal notes that many of the complexities of biometrics data storage could be avoided by developing infrastructure that stores and matches biometrics on the device rather than the enterprise server. This kind of set-up gives the user greater individual choice around how their biometrics are handled and avoids the complications of cross-border legal issues. It also reduces the risk of a biometrics mega breach.

 "Each device retains its user’s biometric data and, therefore, the volume of data at risk is lower (when compared to storage of data many or all users’ biometric information on a server)," PwC Legal said in its study. "It must be noted however, with biometric data stored on the device, that in the event of a successful attack on a specific device, the data accessed is likely to provide a more detailed profile of an individual if matched with other data on the device."

Related Content:

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/31/2016 | 8:40:21 AM
Data Compromise
Maybe genetic engineering will evolve to the point where if our fingerprints or our iris scans get compromised, we can simply change them.

And then, because of the human incapacity for true entropy, we'll be making the same criticisms about biometrics that we've been making about passwords for years.  ;)
coolspot
100%
0%
coolspot,
User Rank: Apprentice
5/13/2016 | 3:27:29 AM
Re: I've been saying the same thing for a year now
Your assessment of server-side biometrics is incorrect. The systems I deal with do indeed use a secret salt to randomize the voiceprint and then further encrypt the print based on a system specific encryption key. Even if a print were stolen from one system, it would be unusable on another.

On device biometrics is subject to the quality and hardware provided by the device and potentially can allow for the hardware to be bypassed or modified. Also upgrades of the biometric algorithms on the client side is more difficult than a centralized system. Not to mention, device specific biometrics means that cross channel authentication is all but impossible. 

Obviously there are some benefits to on device versus on server as well - ultimately it will be up to each organization to decide which method they want to proceed with, but I don't think PwC findings were entirely accurate or representative of the state of biometrics technology/security.
AdamE896
0%
100%
AdamE896,
User Rank: Apprentice
5/12/2016 | 3:18:44 PM
I've been saying the same thing for a year now

I totally agree with the report findings. There are some researchers out there looking at how to properly protect user biometrics as an authentication factor in a central database utilizing a secret salt with a hash but no one is using that at all that I can find. Decentralized is the only truly secure way to deal with biometrics. At LaunchKey, we identified the inherent advantage of storing authentication factors on the device on day 1. As we added biometric factors, the decentralized strategy really proved to be fortuitous move. Even though it seems like a no brainer, I have been really surprised how push back we have received from the infosec community at large. The community as a whole seems skeptical and many are dismissive of decentralized authentication, biometric or not. I fear that the industry will decentralize at a much slower pace than it rolls out biometrics.

Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
6 CISO Resolutions for 2019
Ericka Chickowski, Contributing Writer, Dark Reading,  12/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: When Harry Met Sally
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-7690
PUBLISHED: 2018-12-13
A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access
CVE-2018-7691
PUBLISHED: 2018-12-13
A potential Remote Unauthorized Access in Micro Focus Fortify Software Security Center (SSC), versions 17.10, 17.20, 18.10 this exploitation could allow Remote Unauthorized Access
CVE-2018-8033
PUBLISHED: 2018-12-13
The OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitati...
CVE-2018-20127
PUBLISHED: 2018-12-13
An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.
CVE-2018-20128
PUBLISHED: 2018-12-13
An issue was discovered in UsualToolCMS v8.0. cmsadmin\a_sqlback.php allows remote attackers to delete arbitrary files via a backname[] directory-traversal pathname followed by a crafted substring.