Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/12/2016
10:50 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Enterprises Must Consider Privacy Concern For Biometrics

On-server storage and processing of biometric authentication presents a host of regulatory and corporate responsibility issues.

It's bad enough when an organization exposes huge repositories of customer records and login information through large-scale data breaches. But the ante for pain is going up if organizations start collecting and storing biometric information indiscriminately.

When mega breaches regularly start including biometrics, individuals will be in a bind.

Unlike passwords, this information is unchangeable and the impact for consumers, citizens, and business users will be tremendous if enterprises don't start thinking seriously about the privacy of biometric information before it becomes a major attack target, experts say.

The regulators are still playing catch-up in the US when it comes to biometrics privacy controls, but already in the EU, Canada, and some parts of Asia, governments are clamping down. And as biometrics collection becomes more prevalent and more breaches involving biometrics information come to light, that compliance and risk environment is going to grow increasingly fraught for businesses hoping to leverage this information for authentication, according to a report out today by PwC Legal and Nok Nok Labs.

We've already gotten a glimpse into the future of biometrics hacks, as the OPM breach of last year exposed the fingerprints of 5.6 million US citizens. As things stand, the opportunity to misuse fingerprints is still pretty small, but even the OPM admitted that this could change over time as technology evolves. What will also change rapidly is the technical chops of non-governmental agencies to collect the same volume of biometrics information that only governments used to be capable of gathering in the past. In addition, the time is coming where it will be much easier to collect that data without the individual even knowing it is being collected.

"The collection of biometric data has historically been difficult to do from a technical perspective without the user being aware it is happening. The gathering of fingerprints, iris scans and retina images requires the user to be extremely close to the reading device," warns the report. "However, advances in technology have changed this and as voice, facial and gait analyses becomes more prevalent, the risk of covert or incidental collection of biometric data significantly increases."

As such, organizations are going to not only have to think about privacy, but also collection transparency issues in the near future. Some of the biggest concerns that need to be addressed beyond transparency include how that information is stored if aggregated on enterprise servers, how to ensure that data is adequately destroyed if permission is removed by the individual to collect the data, and how organizations will organize cross-border transfers of the data.  

PwC Legal notes that many of the complexities of biometrics data storage could be avoided by developing infrastructure that stores and matches biometrics on the device rather than the enterprise server. This kind of set-up gives the user greater individual choice around how their biometrics are handled and avoids the complications of cross-border legal issues. It also reduces the risk of a biometrics mega breach.

 "Each device retains its user’s biometric data and, therefore, the volume of data at risk is lower (when compared to storage of data many or all users’ biometric information on a server)," PwC Legal said in its study. "It must be noted however, with biometric data stored on the device, that in the event of a successful attack on a specific device, the data accessed is likely to provide a more detailed profile of an individual if matched with other data on the device."

Related Content:

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/31/2016 | 8:40:21 AM
Data Compromise
Maybe genetic engineering will evolve to the point where if our fingerprints or our iris scans get compromised, we can simply change them.

And then, because of the human incapacity for true entropy, we'll be making the same criticisms about biometrics that we've been making about passwords for years.  ;)
coolspot
100%
0%
coolspot,
User Rank: Apprentice
5/13/2016 | 3:27:29 AM
Re: I've been saying the same thing for a year now
Your assessment of server-side biometrics is incorrect. The systems I deal with do indeed use a secret salt to randomize the voiceprint and then further encrypt the print based on a system specific encryption key. Even if a print were stolen from one system, it would be unusable on another.

On device biometrics is subject to the quality and hardware provided by the device and potentially can allow for the hardware to be bypassed or modified. Also upgrades of the biometric algorithms on the client side is more difficult than a centralized system. Not to mention, device specific biometrics means that cross channel authentication is all but impossible. 

Obviously there are some benefits to on device versus on server as well - ultimately it will be up to each organization to decide which method they want to proceed with, but I don't think PwC findings were entirely accurate or representative of the state of biometrics technology/security.
AdamE896
0%
100%
AdamE896,
User Rank: Apprentice
5/12/2016 | 3:18:44 PM
I've been saying the same thing for a year now

I totally agree with the report findings. There are some researchers out there looking at how to properly protect user biometrics as an authentication factor in a central database utilizing a secret salt with a hash but no one is using that at all that I can find. Decentralized is the only truly secure way to deal with biometrics. At LaunchKey, we identified the inherent advantage of storing authentication factors on the device on day 1. As we added biometric factors, the decentralized strategy really proved to be fortuitous move. Even though it seems like a no brainer, I have been really surprised how push back we have received from the infosec community at large. The community as a whole seems skeptical and many are dismissive of decentralized authentication, biometric or not. I fear that the industry will decentralize at a much slower pace than it rolls out biometrics.

How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3331
PUBLISHED: 2021-01-27
WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session settings. (For example, this is exploitable in a default installation in which WinSCP is the handler for sftp:// URLs.)
CVE-2021-3326
PUBLISHED: 2021-01-27
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.
CVE-2021-22641
PUBLISHED: 2021-01-27
A heap-based buffer overflow issue has been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
CVE-2021-22653
PUBLISHED: 2021-01-27
Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).
CVE-2021-22655
PUBLISHED: 2021-01-27
Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a special project file that may allow arbitrary code execution on the Tellus Lite V-Simulator and V-Server Lite (versions prior to 4.0.10.0).