This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthor

Only authorized users are allowed to rename pages.

Only authorized users are allowed to delete pages.

Page revision history

Version Date Modified Size Author Changes ... Change note

Page References

Incoming links Outgoing links
Biometric Data Challenges
Biometric Data Challenges

Version management

Difference between version and

At line 1 added 47 lines
!!! Overview [1]
[{$pagename}] are additional to the normal [Security Considerations] for [Security] and [Authentication]
[Credential Management] of [Biometric data] is in general not mature. There are few standards and none of them are as robust as [Password Management]
[Biometric data] is difficult to perform:
* [Credential Revocation] and [Credential Suspension] is perhaps impossible? Some vendors may be able to by adding a [Salt] to the data
* [Credential Reset] - An Administrator can not put in "temporary" [Biometric Template] that you can replace later.
!! [Our Position|ContactUs] on [{$pagename}]
For a variety of reasons, we can only see limited use of [biometrics] for [authentication].
These include the following:
* [Biometric] [False Match Rates] ([FMR]) and [False Non-Match Rates] ([FNMR]) do not provide [confidence|Level Of Assurance] in the [authentication] of the subscriber by themselves. In addition, [FMR] and [FNMR] do not account for [Spoofing Attacks]. (from [NIST.SP.800-63B])
* [Biometric Comparison] matching is probabilistic, whereas the other [Authentication Factors] are deterministic. (from [NIST.SP.800-63B]) [3]
* [Biometric Authentication] protection schemes provide a method for revoking [Biometric] [credentials] that are comparable to other [Authentication Factors] (e.g., [PKI] certificates and passwords). However, the availability of such solutions is limited, and standards for testing these methods are under development. (from [NIST.SP.800-63B])
* [Biometric] characteristics do not constitute __secrets__. They can be obtained online or by taking a picture of someone with a camera phone (e.g., facial images) with or without their knowledge, lifted from through objects someone touches (e.g., latent fingerprints), or captured with high resolution images (e.g., iris patterns). While [Presentation Attack Detection] ([PAD]) technologies such as liveness detection can mitigate the [risk] of these types of [attacks|Attacker], additional [trust] in the [Biometric Scanner|Biometric Sensor] is required to ensure that [PAD] is operating properly in accordance with the needs of the [Credential Service Provider] and the [Relying Party]. (from [NIST.SP.800-63B])
* Requires a Hardware device for [Biometric Enrollment] and for [Biometric Sensor] and these devices must be [Secure by design] and use a [Secure connection]
* If you are using vendor "A"'s product and you change to vendor "B's" product, you need to re-register all [Biometric Template]
* __Not__ usable for [Internet] facing [application] as the SAME vendor is required for [Biometric Enrollment] and [Biometric Scanner|Biometric Sensor].
* [Biometric data] lack__ [Credential Revocation] __properties. If a [token], [Certificate] or a [password] is lost or stolen, it can be __cancelled__ and replaced by a newer version. (Some vendor use [Cancelable Biometrics] [4][5]
* [Biometric data] is [bio-political tattooing]
* [Biometric data] and Aging - Some [Biometric data] may require re-[Biometric Enrollment] or cause a higher [False Non-Match Rates] due to aging.
* [Biometric data] and injury or disease - Some [Biometric data] may require re-[Biometric Enrollment] or cause a higher [False Non-Match Rates] due injury or disease (Cataracts affect [Retinal recognition])
* [Biometric data] equipment has an added cost for the [Biometric Enrollment] and [Biometric Scanner|Biometric Sensor] and the security and maintenance.
* The ''typical'' [{$pagename}] is [Biometric Enrollment] sample of the physical [Biometric data] and not the full physical [Biometric data].
* The ''typical'' [{$pagename}] is an [Biometric Enrollment] sample is different depending on the vendor implementation that captures the [Biometric data]. Changing products even products may require performing [Biometric Enrollment] for all [Biometric Tokens]
!! [Biometric data] [Storage|Data At Rest]
We have tremendous challenges with poor [Storage|Data At Rest] of [Passwords]. [Passwords] are stolen from [websites] every second. Now you want to ask people [Trust] [websites] to store their [Biometric data]?
The U.S. Office of Personnel Management data breach is a prime example. Last year’s breach resulted in nearly 6 million federal employees’ [fingerprint|Fingerprint recognition] data being compromised. Those affected by this breach could feel the effects for years to come.[6]
!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [Biometrics|Wikipedia:Biometrics|target='_blank'] - based on information obtained 2017-03-30
* [#2] - [Measuring Strength of Authentication|http://www.nist.gov/nstic/NSTIC-strength-authentication-discussion-draft.pdf|target='_blank'] - based on information obtained 2015-12-17
* [#3] - [A fuzzy vault scheme|http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=1023680|target='_blank'] - based on information obtained 2015-12-17
* [#4] - [ISO 24745 -Biometric Template Protection|http://biometrics.nist.gov/cs_links/ibpc2010/workII/4buschB_IBPC-ISO-24745-100305-2p.pdf|target='_blank'] - based on information obtained 2015-12-17
* [#5] - [Revocable Biometrics|https://pomcor.com/documents/RevocableBiometrics.pdf|target='_blank'] - based on information obtained 2016-05-04
* [#6] - [The Promise And Challenges Of Biometrics|https://www.forbes.com/sites/forbestechcouncil/2016/12/22/the-promise-and-challenges-of-biometrics/|target='_blank'] - based on information obtained 2016-05-04
This page (revision-1) was last changed on 29-Nov-2024 16:16 by UnknownAuthorTop