Boosting Identity

Knowing who’s who is imperative when so much relies on it

• By Phil Scarfo
• Aug 01, 2012

Today, decision makers can raise the bar on enterprise security without raising the complexity for their users. With the introduction of multispectral imaging, biometrics has become reliable enough to deal with the fundamental issue of knowing “who” with a much higher degree of confidence. Knowing “who” makes it possible to design systems that enable rather than block and creates a wide range of identity management solutions, such as convenient theme park entry and secure ATM transactions.

Knowing “who” also can streamline access to buildings and data, support enterprise single-sign-on solutions (ESSO) and ensure authorized use of assets, equipment and machinery. In short, by making biometrics authentication a practical reality, CIOs can lower risks, reduce costs and improve efficiencies. In fact, by linking physical identity to myriad digital identities, identity and access management (IAM) solutions become much more powerful.

There is no meaningful access management without first establishing the “who” in transactions. Who is accessing my facility? Who is punching the time clock? Who is withdrawing funds from that ATM? The question is always “Who?”

Cards, tokens, PINs and passwords are, at best, tools to provide an approximate identity. Thus, users can present a credential—something they know like a password or something they have like a swipe card—to “authenticate” their identity. But these credentials alone simply cannot substantiate identity.

Thus, while access and authorization have always been granted to individuals, knowing a password or having a key is only superficially related to the authorized person, and neither can establish “who”; only a biometric can do that. Add to that the domination of smart mobile devices, and people have more digital identities to remember. Smart devices are being used to authenticate online transactions and are the containers for our most secure credentials.

NFC-enabled smartphones are likely to make matters even worse. It is now possible to replace cards with virtual credentials on a smartphone. These credentials, when linked to one’s unique identity, provide an easier, simpler way to pay for merchandise. The customer just taps his or her smartphone to a cash register. NFC-enabled smartphones also could be provisioned to provide access to buildings, data or devices.

The simple problem here is that virtual credentials still verify only that somebody has the phone. Without a biometric, you can only hope that the person using the phone is the person who is authorized to use it. That again shows why user authentication, and specifically biometric identity management, is becoming more and more important. Let’s look at some industries and how they can take IAM to the next level.

A Cure for Healthcare IAM

Access to pharmaceuticals has become a real challenge in most hospital environments. It is extremely important that only specifically authorized people, such as pharmacists and certain nurses, have access to controlled substances in hospitals. Verifying “who” is imperative—and something that cannot be determined by a card or password alone. Today, if you extend biometric authentication of drug access to other systems in a hospital—shared workstations, patient medical records, time clocks—the hospital can improve workflow efficiency, save costs at help desks, advance patient safety and privacy and facilitate regulatory requirements. Time and attendance is automated, and the opportunities for buddy punching are erased; compliance mandates are met, both on the physical and logical access control sides; and nobody checks in with help desks because they have lost their fingers.

Thus, biometrics becomes extremely important in a hospital’s IAM scenario.

For example, administrators would know exactly who handled patient Jones’ Vicodin, when laundry room associate Carter checked in for work and when he left, if files coordinator Smith went into the computer center and when accounts payable clerk Hernandez checked on patient Jones’ billing status. Officials have the assurance of knowing who is who, not just what is being carried at the time. Thus, verifying “who” provides greater security while simultaneously providing an opportunity to streamline and improve workflow and facilitate any number of benefits throughout the hospital, ranging from auto-filing a form in a way that is most useful to that particular user to enabling better provisioning and rights management.

The electronic prescribing of medications is an application that is increasingly reliant on the “what you are” of biometrics to satisfy regulatory requirements. E-prescribing enables a physician to transmit prescriptions electronically to a pharmacy via a computer or mobile device. These systems are typically integrated with electronic medical records and help prevent harmful drug interactions and incorrect dosing. There are rules and protocols in place to ensure that only authorized medical professionals can order prescriptions electronically. One such rule, issued by the Drug Enforcement Administration (DEA), requires doctors and pharmacists to use two-factor authentication when electronically prescribing controlled substances.

According to DEA, the doctor or pharmacist creating the prescription must authenticate with two of the following: something you know (a knowledge factor), something you have (a hard token stored separately from the computer being accessed) and something you are (biometric information). The state of Ohio paved the way for this twofactor approach to e-prescribing; today, biometrics is a common component of effective and convenient two-factor eprescribing solutions in that state.

A hospital makes an easy case for the use of biometrics in IAM systems. Biometrics has long been used for access control; taking biometrics beyond this common application into the hospital with its complex systems dealing with scores of standards and regulations just makes sense. But, does biometrics in IAM play such an important role in other settings?

Identity Fraud – Who is Who?

Several massive biometric banking projects are being rolled out in markets such as Latin America, South Africa and India. As the world attempts to cut back on the problems of ID theft and reduce waste, fraud and abuse, the banking sector will be huge for IAM and biometric authorization. While the cost of identity theft and fraudulent online transactions continues to grow, the industry must, at some point, look for ways to ensure that these transactions and personal identities are secured.

As face-to-face transactions become rare and online commerce continues to grow, accurate authentication becomes more difficult to achieve. Current systems that deploy multiple passwords, pass phrases and other knowledge-based identification are better but not sufficient for ensuring that the right individual is at the end of that transaction. Data losses and the growing number of system attacks place any of these credentials at risk. Ultimately, biometrics raises the security level and provides a better guarantee of user authentication.

Worldwide, different laws and sensibilities allow a diverse implementation of biometrics in large-scale private and public projects. The coupling of governmentissued ID documents to private projects enables the intelligent use of biometrics for customer identity verification at an ATM or service counter. The South Africa Banking Risk Information Centre (SABRIC) asked banks to take active measures to become “safe, secure and risk free.” As a result, several large regional banks in the country began to plan and focus on measures to eliminate fraud and adopt identity systems that would utilize biometrics as a means to achieve their goals. In India, initiatives related to financial inclusion and public distribution systems also turned to biometrics as a means of securing field transactions and ensuring that the citizens were protected and that government services were being provided to those who were authorized to receive those benefits.

Biometric ATMs are becoming common in many countries such as Brazil. A simple two-factor approach has the banking customer using a card plus a biometric to ensure that the user is authorized and legitimate. Oftentimes, the card may include a biometrics template and the matching can be done either locally or online. Another banking application is a portable, handheld device that can authenticate both user and service provided to ensure proper delivery of the service and provide a complete non-repudiated audit trail of those transactions.

Tracking Cargo, Verifying Fleet Maintenance Personnel

In transportation applications, the control of assets via RFID tagging coupled with biometrics allows carriers not only to track merchandise and goods but also maintain a proper chain of custody—identifying who is loading and unloading containers and transporting the goods.

Even further, with the introduction of telematics, people are managing very expensive assets remotely, and they want to know everything and anything about these assets, including the last time the oil was changed and real-time information about the RPM and a particular engine in a particular vehicle. What they don’t know now is “who” is in control of the asset. They don’t know who is driving it or who is servicing that particular piece of machinery. So, you can imagine the value proposition of being able to add the “who” on top all of the other elements that are known about these assets.

Who Are You?

Lastly, there is a burgeoning desire by the hospitality and retail markets to expand the “personal experience” of their customers to a whole new level. They want to launch a whole new mode of customer service that combines the use of biometrics and RFID. For instance, when Joe arrives at a cruise ship (or men’s store, etc.), he checks in with his fingerprint. An RFID bracelet—or his credit card—tracks where he is. As he approaches a steward, the steward says, “Good afternoon, Mr. Jones. Will you want to eat out on the deck again or inside today?” At the men’s store, the sales clerk might ask, “Mr. Jones, would you be interested in our shirt sale? Many of them would go great with the blue pinstripe suit you recently purchased.” And, of course, payment is made with a finger tap. In this way, biometrics provides the “who” that allows organizations to customize the whole customer experience.

A Sullied Past

For many years, the promise of biometrics has not been fully realized because performance in the lab is not representative of performance in the field. The core problem is that conventional biometric technologies rely on unobstructed and complete contact between the fingerprint and the sensor, a condition that is elusive in the real world—a world that is wet, dry and dirty.

However, that was then; this is now. Multispectral imaging is a sophisticated technology designed to overcome the fingerprint-capture problems that conventional imaging systems have in less-than-ideal conditions. This more-effective technology is based on using multiple spectrums of light and advanced polarization techniques to extract unique fingerprint characteristics from both the surface and subsurface of the skin.

Interestingly, the fingerprint ridges seen on the surface of the finger have their foundation beneath the surface of the skin, in the capillary beds and other subdermal structures. The fingerprint ridges we see on our fingertips are merely an echo of the foundational “inner fingerprint.”

Unlike surface fingerprint characteristics, which can be obscured by moisture, dirt or wear, the “inner fingerprint” lies undisturbed and unaltered beneath the surface. When surface fingerprint information is combined with subsurface fingerprint information and reassembled in an intelligent and integrated manner, the results are more consistent, more inclusive and more tamper-resistant.

Today, biometrics can be used in more places and more applications for sophisticated, economical and convenient credential management. More than 40 million people are already enrolled in multispectral imaging-based systems at locales ranging from the classic door access control situation to the gates of the world’s largest theme parks.

Organizations in many industries are searching for IAM solutions. Today, biometrics that provide a clean read on the first try are finally available to offer the needed mix of user convenience, cost savings and unquestionable compliance.

This article originally appeared in the August 2012 issue of Security Today.