Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/12/2016
10:50 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Enterprises Must Consider Privacy Concern For Biometrics

On-server storage and processing of biometric authentication presents a host of regulatory and corporate responsibility issues.

It's bad enough when an organization exposes huge repositories of customer records and login information through large-scale data breaches. But the ante for pain is going up if organizations start collecting and storing biometric information indiscriminately.

When mega breaches regularly start including biometrics, individuals will be in a bind.

Unlike passwords, this information is unchangeable and the impact for consumers, citizens, and business users will be tremendous if enterprises don't start thinking seriously about the privacy of biometric information before it becomes a major attack target, experts say.

The regulators are still playing catch-up in the US when it comes to biometrics privacy controls, but already in the EU, Canada, and some parts of Asia, governments are clamping down. And as biometrics collection becomes more prevalent and more breaches involving biometrics information come to light, that compliance and risk environment is going to grow increasingly fraught for businesses hoping to leverage this information for authentication, according to a report out today by PwC Legal and Nok Nok Labs.

We've already gotten a glimpse into the future of biometrics hacks, as the OPM breach of last year exposed the fingerprints of 5.6 million US citizens. As things stand, the opportunity to misuse fingerprints is still pretty small, but even the OPM admitted that this could change over time as technology evolves. What will also change rapidly is the technical chops of non-governmental agencies to collect the same volume of biometrics information that only governments used to be capable of gathering in the past. In addition, the time is coming where it will be much easier to collect that data without the individual even knowing it is being collected.

"The collection of biometric data has historically been difficult to do from a technical perspective without the user being aware it is happening. The gathering of fingerprints, iris scans and retina images requires the user to be extremely close to the reading device," warns the report. "However, advances in technology have changed this and as voice, facial and gait analyses becomes more prevalent, the risk of covert or incidental collection of biometric data significantly increases."

As such, organizations are going to not only have to think about privacy, but also collection transparency issues in the near future. Some of the biggest concerns that need to be addressed beyond transparency include how that information is stored if aggregated on enterprise servers, how to ensure that data is adequately destroyed if permission is removed by the individual to collect the data, and how organizations will organize cross-border transfers of the data.  

PwC Legal notes that many of the complexities of biometrics data storage could be avoided by developing infrastructure that stores and matches biometrics on the device rather than the enterprise server. This kind of set-up gives the user greater individual choice around how their biometrics are handled and avoids the complications of cross-border legal issues. It also reduces the risk of a biometrics mega breach.

 "Each device retains its user’s biometric data and, therefore, the volume of data at risk is lower (when compared to storage of data many or all users’ biometric information on a server)," PwC Legal said in its study. "It must be noted however, with biometric data stored on the device, that in the event of a successful attack on a specific device, the data accessed is likely to provide a more detailed profile of an individual if matched with other data on the device."

Related Content:

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/31/2016 | 8:40:21 AM
Data Compromise
Maybe genetic engineering will evolve to the point where if our fingerprints or our iris scans get compromised, we can simply change them.

And then, because of the human incapacity for true entropy, we'll be making the same criticisms about biometrics that we've been making about passwords for years.  ;)
coolspot
100%
0%
coolspot,
User Rank: Apprentice
5/13/2016 | 3:27:29 AM
Re: I've been saying the same thing for a year now
Your assessment of server-side biometrics is incorrect. The systems I deal with do indeed use a secret salt to randomize the voiceprint and then further encrypt the print based on a system specific encryption key. Even if a print were stolen from one system, it would be unusable on another.

On device biometrics is subject to the quality and hardware provided by the device and potentially can allow for the hardware to be bypassed or modified. Also upgrades of the biometric algorithms on the client side is more difficult than a centralized system. Not to mention, device specific biometrics means that cross channel authentication is all but impossible. 

Obviously there are some benefits to on device versus on server as well - ultimately it will be up to each organization to decide which method they want to proceed with, but I don't think PwC findings were entirely accurate or representative of the state of biometrics technology/security.
AdamE896
0%
100%
AdamE896,
User Rank: Apprentice
5/12/2016 | 3:18:44 PM
I've been saying the same thing for a year now

I totally agree with the report findings. There are some researchers out there looking at how to properly protect user biometrics as an authentication factor in a central database utilizing a secret salt with a hash but no one is using that at all that I can find. Decentralized is the only truly secure way to deal with biometrics. At LaunchKey, we identified the inherent advantage of storing authentication factors on the device on day 1. As we added biometric factors, the decentralized strategy really proved to be fortuitous move. Even though it seems like a no brainer, I have been really surprised how push back we have received from the infosec community at large. The community as a whole seems skeptical and many are dismissive of decentralized authentication, biometric or not. I fear that the industry will decentralize at a much slower pace than it rolls out biometrics.

News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27569
PUBLISHED: 2021-05-07
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can maximize or minimize the window of a running process by sending the process name in a crafted packet. This information is sent in cleartext and is not protected by any authentication logic.
CVE-2021-27570
PUBLISHED: 2021-05-07
An issue was discovered in Emote Remote Mouse through 3.015. Attackers can close any running process by sending the process name in a specially crafted packet. This information is sent in cleartext and is not protected by any authentication logic.
CVE-2021-27571
PUBLISHED: 2021-05-07
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Attackers can retrieve recently used and running applications, their icons, and their file paths. This information is sent in cleartext and is not protected by any authentication logic.
CVE-2021-27572
PUBLISHED: 2021-05-07
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Authentication Bypass can occur via Packet Replay. Remote unauthenticated users can execute arbitrary code via crafted UDP packets even when passwords are set.
CVE-2021-27573
PUBLISHED: 2021-05-07
An issue was discovered in Emote Remote Mouse through 4.0.0.0. Remote unauthenticated users can execute arbitrary code via crafted UDP packets with no prior authorization or authentication.