IT Employment

Ask something
Discussion Locked

Biometrics--viable security option?

0 helpful
8 replies

by Michael Kassner

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Some organizations have already adopted fingerprinting and iris and voice recognition as a means for security. Do you see biometrics as a viable security tool?

8 replies

by timwalsh

It really depends on a couple of things:
What is the required security environment?
What is the risk tolerance factor?
What goal are you trying to accomplish?
How much money do you have to implement a workable solution for your work environment?

Some definitions and then some thoughts:
False reject - a person who is authorized access is falsely denied access
False accept - a person who is not authorized access is falsely given access

Of the three technologies you mention, iris scanning is probably the most secure (hardest to spoof), but it is also the most expensive to implement. Iris scanning makes perfect sense for granting access to a secure area. It doesn't make much sense to have an iris scanner on each desktop (unless you have LOTS of money and/or a VALID security requirement).

Voice or fingerprint recognition makes more sense at the desktop level, but they are also easier to spoof (depending on the exact implementation). If the intent of implementing biometrics is to REPLACE passwords (vs. supplement them), consider the following:
1. If a person forgets a password, it is usually a simple matter for an administrator to reset it.
2. If your cut the finger used for fingerprint identification, how tolerant of physical changes is the particular implementation you use. Also you obviously can't read a fingerprint through a bandage (or a cast if you break the finger).
3. What effect will a cold/laryngitis have on speech software?s ability to recognize a person?s voice?
(continued)

by timwalsh

Common wisdom in the security community says that to truly identify a person, you need something the person has (ID card, swipe card, magnetic card, security dongle, fingerprint, voice, eye, etc. ? something that can be tied to a specific individual), and something they know (code word, password, pin code, etc. ? some fact that ONLY the person in question knows). If you think about it, this is exactly the same procedure every bank uses to allow access to an ATM machine. They use something theperson has (ATM card ? tied to a specific individual and his account), and something they know (pin code ? something only that specific person should know).

Are these technologies mature enough to totally replace password access to computers on an inexpensive basis? In my opinion, not yet. Are they worth exploring for a given purpose? Probably. You need to have a specific goal in mind and then study each technology and then each solution with a specific technology to see if it meets yourspecific goals.

Hope this gives you some things to think about.

by awolff

Once information is recorded it can be copied . Retinal patterns, DNA, fingerprints can all be copied. Used individually, they are probably easy to defeat (by a determined person or agency). Go the extra step and use them all together, with additional metrics such as body temperature and blood chemistry and you are getting closer, but certaily not foolproof.
Aside from the problem of the checks taking some time to verify, once a person's biometrics have been compromised they can't be changed and we are back to passwords.

by vwickman

We have been using fingerprint biometrics for 1 year. We put fingerprint readers only on workstations running mission critical, secure applications. This was part of our movement toward full HIPAA compliance. After talking to other organizations using this technology we recognized that there are some potential for a incorrect login to occur but that was a minisule risk compared to users willingly giving away their passwords. A pleasant side benefit of this implementation was that it eliminated nearly all help desk calls related to login failures on the workstations equipped with biometric login. Most of the cost of hardware and software were probably offset by reductions in the cost of supporting those 15 workstations. We are satisfied with the results of this deployment.

by gsg

We are implementing a drug distribution product that will be located on each nursing unit and will log which nurse pulled which drug and what patient is to receive that drug from an aspirin to Narcotics. It has a fingerprint system for log ons, andwe've had some trouble with several nurses who are accusing us of working with the Government to secretly fingerprint everyone and are trying to refuse to use it. I guess they think we have a direct link up to the National Crime Lab. Hmmm...Makes me want to do a background check on these people!!

by oz_media

I dont't think I'd lock up Microsoft's server rooms with a Bio-Mouse (they probably do though:-))but one of our sales reps has recently started a Biometric Access company for residential access points. Eben the creators of the products agree that they have a long way to go before Bio is a viable securrity solution for businesses. To see a Biometric door-lock for residential applications or the bosses office, visit http://www.biokeyz.com NUFF SAID.

by ken

For most applications, adopt the ATM model. The cost is low and the security is "good enough."

I might use biometrics (and just about anything else that I could think of) as physical security options if I were protecting a nuke arsenal, but for business applications? Probably not.

The big worry for me would be the infringment of the user's privacy. Not only do I have to ask the user for his/her retnal scan, fingerprint, etc, I have to protect this data! The exposure to litigation in the event that a user's biometric data was comprimised is a potential cost that must be factored in.

by mc_user

As an additional option to an existing security configiration I would have to say it was viable. But I would also say that any addition to an existing security configuration is a good idea.

Most low cost security devices, of all types, fingerprint scanner, retinal scanner, voice recognition software, can be broken. Sometimes with physical tools sometimes with software cracking tools. This has been proven by independent studies and goverment studies.

But a high quality biometric device, inconjunction with other security measures, like passwords and ID Key codes, make for a much higher level of security thatn just a password alone.

This discussion is closed to new replies.