Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/12/2016
10:50 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Enterprises Must Consider Privacy Concern For Biometrics

On-server storage and processing of biometric authentication presents a host of regulatory and corporate responsibility issues.

It's bad enough when an organization exposes huge repositories of customer records and login information through large-scale data breaches. But the ante for pain is going up if organizations start collecting and storing biometric information indiscriminately.

When mega breaches regularly start including biometrics, individuals will be in a bind.

Unlike passwords, this information is unchangeable and the impact for consumers, citizens, and business users will be tremendous if enterprises don't start thinking seriously about the privacy of biometric information before it becomes a major attack target, experts say.

The regulators are still playing catch-up in the US when it comes to biometrics privacy controls, but already in the EU, Canada, and some parts of Asia, governments are clamping down. And as biometrics collection becomes more prevalent and more breaches involving biometrics information come to light, that compliance and risk environment is going to grow increasingly fraught for businesses hoping to leverage this information for authentication, according to a report out today by PwC Legal and Nok Nok Labs.

We've already gotten a glimpse into the future of biometrics hacks, as the OPM breach of last year exposed the fingerprints of 5.6 million US citizens. As things stand, the opportunity to misuse fingerprints is still pretty small, but even the OPM admitted that this could change over time as technology evolves. What will also change rapidly is the technical chops of non-governmental agencies to collect the same volume of biometrics information that only governments used to be capable of gathering in the past. In addition, the time is coming where it will be much easier to collect that data without the individual even knowing it is being collected.

"The collection of biometric data has historically been difficult to do from a technical perspective without the user being aware it is happening. The gathering of fingerprints, iris scans and retina images requires the user to be extremely close to the reading device," warns the report. "However, advances in technology have changed this and as voice, facial and gait analyses becomes more prevalent, the risk of covert or incidental collection of biometric data significantly increases."

As such, organizations are going to not only have to think about privacy, but also collection transparency issues in the near future. Some of the biggest concerns that need to be addressed beyond transparency include how that information is stored if aggregated on enterprise servers, how to ensure that data is adequately destroyed if permission is removed by the individual to collect the data, and how organizations will organize cross-border transfers of the data.  

PwC Legal notes that many of the complexities of biometrics data storage could be avoided by developing infrastructure that stores and matches biometrics on the device rather than the enterprise server. This kind of set-up gives the user greater individual choice around how their biometrics are handled and avoids the complications of cross-border legal issues. It also reduces the risk of a biometrics mega breach.

 "Each device retains its user’s biometric data and, therefore, the volume of data at risk is lower (when compared to storage of data many or all users’ biometric information on a server)," PwC Legal said in its study. "It must be noted however, with biometric data stored on the device, that in the event of a successful attack on a specific device, the data accessed is likely to provide a more detailed profile of an individual if matched with other data on the device."

Related Content:

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/31/2016 | 8:40:21 AM
Data Compromise
Maybe genetic engineering will evolve to the point where if our fingerprints or our iris scans get compromised, we can simply change them.

And then, because of the human incapacity for true entropy, we'll be making the same criticisms about biometrics that we've been making about passwords for years.  ;)
coolspot
100%
0%
coolspot,
User Rank: Apprentice
5/13/2016 | 3:27:29 AM
Re: I've been saying the same thing for a year now
Your assessment of server-side biometrics is incorrect. The systems I deal with do indeed use a secret salt to randomize the voiceprint and then further encrypt the print based on a system specific encryption key. Even if a print were stolen from one system, it would be unusable on another.

On device biometrics is subject to the quality and hardware provided by the device and potentially can allow for the hardware to be bypassed or modified. Also upgrades of the biometric algorithms on the client side is more difficult than a centralized system. Not to mention, device specific biometrics means that cross channel authentication is all but impossible. 

Obviously there are some benefits to on device versus on server as well - ultimately it will be up to each organization to decide which method they want to proceed with, but I don't think PwC findings were entirely accurate or representative of the state of biometrics technology/security.
AdamE896
0%
100%
AdamE896,
User Rank: Apprentice
5/12/2016 | 3:18:44 PM
I've been saying the same thing for a year now

I totally agree with the report findings. There are some researchers out there looking at how to properly protect user biometrics as an authentication factor in a central database utilizing a secret salt with a hash but no one is using that at all that I can find. Decentralized is the only truly secure way to deal with biometrics. At LaunchKey, we identified the inherent advantage of storing authentication factors on the device on day 1. As we added biometric factors, the decentralized strategy really proved to be fortuitous move. Even though it seems like a no brainer, I have been really surprised how push back we have received from the infosec community at large. The community as a whole seems skeptical and many are dismissive of decentralized authentication, biometric or not. I fear that the industry will decentralize at a much slower pace than it rolls out biometrics.

Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18216
PUBLISHED: 2019-10-20
** DISPUTED ** The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access ...
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.