There is no question that better methods of authentication are needed

Achieve Assured Authentication

There is no question that better methods of authentication are needed

Biometrics has a central role to play in today’s authentication solutions, so it is important to revisit and review the many myths and misperceptions associated with this technology. Biometrics has a central role to play in today’s authentication solutions, so it is important to revisit and review the many myths and misperceptions associated with this technology. Much vulnerability has been addressed, and technologies will continue to improve as biometrics move from only being a forensic tool to becoming a compelling, mainstream solution, while service providers begin to appreciate and fully understand that both user convenience and security really matter.

Questioning assured authentication and biometrics

  • Is assured authentication even possible?
  • Is security the main driver for authentication?
  • Must security be at the expense of user convenience?
  • Are we finally at a tipping point for biometrics adoption?
  • Is biometrics the most effective means of assured authentication?

There is no question that better methods of authentication are needed today; however, it is not necessary to trade off security for convenience. There is definitely a role for biometrics, the one authentication factor that can reliably answer the question, “who?”

Why biometrics?

The general concept of biometric technology is not new, but the automated matching of identities as modern biometrics technology has progressed from a forensics focus to one of validating user identities in the digital world is a recent notion. Over the past few decades, many attempts have been made to make biometric authentication mainstream, but, until recently, these have been met with numerous complications, such as less-than-perfect performance and poor reliability.

Over time, many issues have been worked through with better system design and modern sensor technology. Multispectral fingerprint sensors, for example, have raised the bar for biometric performance, demonstrating reliability in everyday conditions that previously challenged conventional technologies.

Mainstream markets remain skittish about legacy issues, preferring instead to extend familiar, yet outdated, authentication methods, such as user IDs and passwords, to the breaking point. They do so at their own peril, because with the rapid increase in cybercrimes and identity theft, there is a pressing need for a better form of authentication than a password/user ID pair.

Even those who are skeptical about a wholesale switch to biometrics, however, acknowledge that adding an automated biometric identity check to another factor being used will greatly enhance security. Their skepticism isn’t entirely misplaced; no single factor will ever provide perfect authentication. But, biometrics is the one factor that can transform a multi-factor solution into assured authentication.

Biometrics is the only form of personal identification that, by definition, focuses on the individual and answers the question of “who” with a high degree of certainty. As such, it is an essential factor in modernday authentication solutions.

Assured authentication

So, how does one assure authentication in this digital age? It begins by accepting the reality that no single form of authentication alone provides 100 percent accuracy. Even a biometric like DNA matching is not perfect, but statistical error rates are substantially reduced when multiple forms of authentication are employed.

The use of biometrics as an additional tool, or second factor, greatly enhances the ability to get closer to 100 percent in the continuum to assured authentication. The reason for selecting biometrics as one of the two factors is clear. Knowing “who” is the goal of assured authentication, and biometrics is the only form of authentication that is solely focused on the identification of the individual.

Multi-factor authentication with a biometric enables new applications, or self-service offerings, that otherwise would not be practical, as the provider could be exposed to unacceptable risks. For example, combining a biometric match with a barcode on an ID card or on a smart device enables self-service authentication at an ATM by bringing transactions to an acceptable risk level. Combining the ability to read two authentication factors on the same device, such as with multispectral imaging technology, enables a whole new set of applications by simplifying multifactor transactions even further.

Another aspect of assured authentication can be seen in applications that do, in fact, require a true 100 percent level of service, sometimes for reasons that are less about security risk and more about customer expectations. Take for example, automotive applications, where anything less than 100 percent authentication is literally a non-starter. Sole reliance on the use of an automotive biometric is unacceptable, even as the industry explores biometrics for personalization and telematics applications in vehicles. To make these applications viable, there must be an alternative means of authentication available as a backup to guarantee user acceptance. This is how assured authentication is brought to a true 100 percent.

It is important not to lose sight of the fact that digital biometrics represents an exciting new tool for a new age. Much like the abandoned typewriter and White-Out for document production and editing, there is no longer a need to continue to rely on passwords for online accounts. Digital biometrics are no longer in the realm of science fiction; they are now poised for more widespread adoption. Today’s biometrics greatly enhance security and convenience as part of authentication solutions that address complex, modern risks and requirements.

What about user privacy?

One of the concerns often raised about biometrics is user privacy. People have the right to privacy, so it’s a bit ironic that the information so freely and routinely volunteered about our self through social media is a much greater threat to personal privacy than any biometric.

Because the right to privacy is very important, biometric best practices do allow for a number of protections that can, and should, safeguard our identities. These best practices are easily implemented and represent an important consideration when choosing a biometric technology and vendor who understand the risks and the means to protect people.

For those inclined to dismiss technologies on the basis of them being either intrusive or exclusive, biometrics are the most democratic and inclusive of all other means of identification. There is no language, literacy, gender, race, ethnicity or other human factor barriers. Little knowledge of how biometrics work is required for users to enjoy the full benefits. The technology is simple to use and, arguably, the most inclusive form of personal identification.

The security/convenience paradox

Security at the expense of convenience is a non-starter for markets where the user has a choice. Passwords, PINs, tokens and ID cards are not particularly secure nor are they convenient, but biometrics is uniquely positioned to provide both security and convenience. Most systems employing methods, such as PINs or ID cards, in response to growing threats, have become overly complex, are difficult to understand and generally block users from doing their jobs. Biometrics, though, supports workflow by providing security while non-intrusively enabling people to do their jobs.

Multispectral imaging is an example of a high-performing biometric that authenticates on the first try, shaving time and hassle off transactions, and allowing “security” to recede from the user’s perspective. In addition, knowing “who,” with some high degree of certainty, not only protects but enables services or information to be personalized, or customized, to users’ specific needs, role(s) or access privileges.

With the Internet, authentication needs are decidedly more complex, and yet technologies that are outof- date, inconvenient and ineffective are still relied upon. So, what would it take to change this?

Users have demonstrated that they will migrate to, and even pay a premium for, things they want versus things they need. Convenience is what people want, and security is arguably only what they need.

Knowing “who” matters

In a digital world, authentication and identification must be assured and reliable, so the role of biometrics is significant and should not be overlooked. It really does matter who we are, both to ourselves and to the people with whom we have personal and transactional relationships.

We have long since reached a point where conventional technologies like passwords, PINs, ID cards or tokens alone are not sufficient to protect us. Life is complicated enough already, and having to remember multiple passwords, complex passphrases and answers to questions easily found on our Facebook accounts are simply not convenient.

Biometrics is the only authentication factor that can answer “who,” and assured authentication, enabled by a combination of biometrics as a second factor, is the best way to design and develop solutions that meet today’s security needs. Education and good policy will ensure that security, privacy and convenience will always be preserved, even as technology advances. Consumer acceptance and appreciation of this technology, as users begin to realize the full benefits, will likely enable the widespread adoption of biometrics.

The threats to our identities are steadily rising. The cost and sophistication of a viable solution is now very close to the point where the question is not why use or deploy biometrics, but rather, why are we not deploying biometrics?

And, why on earth has it taken so long for us to get there?

This article originally appeared in the November 2013 issue of Security Today.


  • Cloud Adoption Gives Way to Hybrid Deployments

    Cloud adoption is growing at an astonishing rate, with Gartner forecasting that worldwide public cloud end-user spending will approach $600 billion by the end of this year—an increase of more than 21% over 2022. McKinsey believes that number could eclipse $1 trillion by the end of the decade, further underscoring the industry’s exponential growth. Read Now

  • AI on the Edge

    Discussions about the merits (or misgivings) around AI (artificial intelligence) are everywhere. In fact, you’d be hard-pressed to find an article or product literature without mention of it in our industry. If you’re not using AI by now in some capacity, congratulations may be in order since most people are using it in some form daily even without realizing it. Read Now

  • Securing the Future

    In an increasingly turbulent world, chief security officers (CSOs) are facing a multitude of challenges that threaten the stability of businesses worldwide. Read Now

    • Guard Services
  • Security Entrances Move to Center Stage

    Most organizations want to show a friendly face to the public. In today’s world, however, the need to keep people safe and secure has become a prime directive when designing and building facilities of all kinds. Fortunately, there is no need to construct a fortress-like entry that provides that high level of security. Today’s secured entry solutions make it possible to create a welcoming, attractive look and feel at the entry without compromising security. It is for this reason that security entrances have moved to the mainstream. Read Now

Featured Cybersecurity

New Products

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis. 3