There is no question that better methods of authentication are needed

Achieve Assured Authentication

There is no question that better methods of authentication are needed

Biometrics has a central role to play in today’s authentication solutions, so it is important to revisit and review the many myths and misperceptions associated with this technology. Biometrics has a central role to play in today’s authentication solutions, so it is important to revisit and review the many myths and misperceptions associated with this technology. Much vulnerability has been addressed, and technologies will continue to improve as biometrics move from only being a forensic tool to becoming a compelling, mainstream solution, while service providers begin to appreciate and fully understand that both user convenience and security really matter.

Questioning assured authentication and biometrics

  • Is assured authentication even possible?
  • Is security the main driver for authentication?
  • Must security be at the expense of user convenience?
  • Are we finally at a tipping point for biometrics adoption?
  • Is biometrics the most effective means of assured authentication?

There is no question that better methods of authentication are needed today; however, it is not necessary to trade off security for convenience. There is definitely a role for biometrics, the one authentication factor that can reliably answer the question, “who?”

Why biometrics?

The general concept of biometric technology is not new, but the automated matching of identities as modern biometrics technology has progressed from a forensics focus to one of validating user identities in the digital world is a recent notion. Over the past few decades, many attempts have been made to make biometric authentication mainstream, but, until recently, these have been met with numerous complications, such as less-than-perfect performance and poor reliability.

Over time, many issues have been worked through with better system design and modern sensor technology. Multispectral fingerprint sensors, for example, have raised the bar for biometric performance, demonstrating reliability in everyday conditions that previously challenged conventional technologies.

Mainstream markets remain skittish about legacy issues, preferring instead to extend familiar, yet outdated, authentication methods, such as user IDs and passwords, to the breaking point. They do so at their own peril, because with the rapid increase in cybercrimes and identity theft, there is a pressing need for a better form of authentication than a password/user ID pair.

Even those who are skeptical about a wholesale switch to biometrics, however, acknowledge that adding an automated biometric identity check to another factor being used will greatly enhance security. Their skepticism isn’t entirely misplaced; no single factor will ever provide perfect authentication. But, biometrics is the one factor that can transform a multi-factor solution into assured authentication.

Biometrics is the only form of personal identification that, by definition, focuses on the individual and answers the question of “who” with a high degree of certainty. As such, it is an essential factor in modernday authentication solutions.

Assured authentication

So, how does one assure authentication in this digital age? It begins by accepting the reality that no single form of authentication alone provides 100 percent accuracy. Even a biometric like DNA matching is not perfect, but statistical error rates are substantially reduced when multiple forms of authentication are employed.

The use of biometrics as an additional tool, or second factor, greatly enhances the ability to get closer to 100 percent in the continuum to assured authentication. The reason for selecting biometrics as one of the two factors is clear. Knowing “who” is the goal of assured authentication, and biometrics is the only form of authentication that is solely focused on the identification of the individual.

Multi-factor authentication with a biometric enables new applications, or self-service offerings, that otherwise would not be practical, as the provider could be exposed to unacceptable risks. For example, combining a biometric match with a barcode on an ID card or on a smart device enables self-service authentication at an ATM by bringing transactions to an acceptable risk level. Combining the ability to read two authentication factors on the same device, such as with multispectral imaging technology, enables a whole new set of applications by simplifying multifactor transactions even further.

Another aspect of assured authentication can be seen in applications that do, in fact, require a true 100 percent level of service, sometimes for reasons that are less about security risk and more about customer expectations. Take for example, automotive applications, where anything less than 100 percent authentication is literally a non-starter. Sole reliance on the use of an automotive biometric is unacceptable, even as the industry explores biometrics for personalization and telematics applications in vehicles. To make these applications viable, there must be an alternative means of authentication available as a backup to guarantee user acceptance. This is how assured authentication is brought to a true 100 percent.

It is important not to lose sight of the fact that digital biometrics represents an exciting new tool for a new age. Much like the abandoned typewriter and White-Out for document production and editing, there is no longer a need to continue to rely on passwords for online accounts. Digital biometrics are no longer in the realm of science fiction; they are now poised for more widespread adoption. Today’s biometrics greatly enhance security and convenience as part of authentication solutions that address complex, modern risks and requirements.

What about user privacy?

One of the concerns often raised about biometrics is user privacy. People have the right to privacy, so it’s a bit ironic that the information so freely and routinely volunteered about our self through social media is a much greater threat to personal privacy than any biometric.

Because the right to privacy is very important, biometric best practices do allow for a number of protections that can, and should, safeguard our identities. These best practices are easily implemented and represent an important consideration when choosing a biometric technology and vendor who understand the risks and the means to protect people.

For those inclined to dismiss technologies on the basis of them being either intrusive or exclusive, biometrics are the most democratic and inclusive of all other means of identification. There is no language, literacy, gender, race, ethnicity or other human factor barriers. Little knowledge of how biometrics work is required for users to enjoy the full benefits. The technology is simple to use and, arguably, the most inclusive form of personal identification.

The security/convenience paradox

Security at the expense of convenience is a non-starter for markets where the user has a choice. Passwords, PINs, tokens and ID cards are not particularly secure nor are they convenient, but biometrics is uniquely positioned to provide both security and convenience. Most systems employing methods, such as PINs or ID cards, in response to growing threats, have become overly complex, are difficult to understand and generally block users from doing their jobs. Biometrics, though, supports workflow by providing security while non-intrusively enabling people to do their jobs.

Multispectral imaging is an example of a high-performing biometric that authenticates on the first try, shaving time and hassle off transactions, and allowing “security” to recede from the user’s perspective. In addition, knowing “who,” with some high degree of certainty, not only protects but enables services or information to be personalized, or customized, to users’ specific needs, role(s) or access privileges.

With the Internet, authentication needs are decidedly more complex, and yet technologies that are outof- date, inconvenient and ineffective are still relied upon. So, what would it take to change this?

Users have demonstrated that they will migrate to, and even pay a premium for, things they want versus things they need. Convenience is what people want, and security is arguably only what they need.

Knowing “who” matters

In a digital world, authentication and identification must be assured and reliable, so the role of biometrics is significant and should not be overlooked. It really does matter who we are, both to ourselves and to the people with whom we have personal and transactional relationships.

We have long since reached a point where conventional technologies like passwords, PINs, ID cards or tokens alone are not sufficient to protect us. Life is complicated enough already, and having to remember multiple passwords, complex passphrases and answers to questions easily found on our Facebook accounts are simply not convenient.

Biometrics is the only authentication factor that can answer “who,” and assured authentication, enabled by a combination of biometrics as a second factor, is the best way to design and develop solutions that meet today’s security needs. Education and good policy will ensure that security, privacy and convenience will always be preserved, even as technology advances. Consumer acceptance and appreciation of this technology, as users begin to realize the full benefits, will likely enable the widespread adoption of biometrics.

The threats to our identities are steadily rising. The cost and sophistication of a viable solution is now very close to the point where the question is not why use or deploy biometrics, but rather, why are we not deploying biometrics?

And, why on earth has it taken so long for us to get there?

This article originally appeared in the November 2013 issue of Security Today.


  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity


New Products

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3