Biometrics and Privacy

Strayer University

SEC 305

Biometrics implements a process used to identify or authenticate an individual’s identity using a physical or behavioral characteristic. The goal is to provide access control at the logical and physical levels. An individual's voice, fingerprint, iris, and hand geometry are examples of physical characteristics. Behavioral characteristics could include signature or writing style. The implementation of a biometrics system requires coordination between the individual and the organization or business implementing the technology. During the enrollment process an individual provides a sample of a biometric: a fingerprint, an iris scan, voice recording, and so on. The sample, taken multiple times for the sake of accuracy, is averaged and stored within a database, token, or smartcard as a compressed digital representation of the sample. When a live sample of a biometric is presented to the system it is compared to the recorded information, or template, provided during the enrollment process and a match is determined to within an acceptable threshold value. This response determines an individual’s right to gain access to a privileged area, data, or just a PC. The advantage to a biometric is that it doesn’t change. It goes where you go, so it’s difficult to lose. It’s also very difficult to forge or fake. In some cases, it is next to impossible. It provides a very strong access control security solution satisfying authentication, confidentiality, integrity, and non-repudiation (SANS, 2002).

Data segregation of personal and biometric information should apply for biometric applications, especially those storing information in a centralized manner using an identification based system. These systems can store many records of many people. Concerns exist about how this data can be used without the consent of the individuals to whom this data is considered private and personal. Could law enforcement use it for forensics or tracking purposes, for example? Strict controls would be required for these systems to protect against unauthorized use or leakage of information to other organizations. Of more immediate significance to many users is the issue of informational privacy. Fears and concerns classified under informational privacy are not expressions of inherent discomfort with biometrics, but are centered on the potentially ominous impact of the collection, use, retention, and disclosure of biometric data. Although only certain technologies are even theoretically capable of collecting biometric information without the subject’s knowledge, the increased deployment of certain types of biometric technologies does bring with it the concept of biometric information being gathered, and biometric identification functions being performed, without consent. This would facilitate, if not be an instantiation of, unauthorized use of biometric technology. Biometric technology, in its various iterations, is normally deployed as a means of addressing a specific identity verification problem. Primary examples include controlling physical access to specific locations, controlling logical access to specific data, or ensuring that an individual does not enroll multiple times in a single-identity system. A potential fear, if and when biometric technologies become pervasive, is that they will be deployed in situations where there is little to no benefit to strong user authentication or identification. Unnecessary collection would also facilitate unauthorized use of biometric technology. Unauthorized uses of the biometric technology are seen to represent the greatest risk biometrics pose to privacy. It is not the intended uses of biometrics that are seen as problematic, but the ways in which it might be used for purposes than originally intended (Thieme, 2010).

I believe the best method of biometrics that would cause least concern by users is fingerprint biometrics. The main advantage that I believe would ease the mind of the users concern is the fact that in most cases, a full fingerprint does not have to be stored in a data base in order to match up later on during the authentication process. In many cases, simply a few minutiae points can be stored as opposed to the entire fingerprint which would surely ease the minds of those that believe that their fingerprint can be later used. If only a few of these points are stored in a system, it could make it next to impossible for anyone to replicate it should this information become compromised in anyway.

References

SANS (2002). Biometrics: A Double Edged Sword - Security and Privacy. Retrieved from:

http://www.sans.org/reading-room/whitepapers/authentication/biometrics-double-edged-sword-security-privacy-137

Thieme, M. (2010). Privacy Concerns and Biometric Technologies. Retrieved from:

http://www.bioprivacy.org/privacy_fears.htm