Privacy

1
Privacy Identity - Security and Usability The
viability of Passwords Biometrics
2
Introduction

• Name Orville Wilson
• Alumni at DePaul University
• Doctoral Student
• Currently work for an Information Security and
  Managed Services firm, Fortrex Technologies,
  located in DC/Baltimore area.

3
Agenda

• Statistical Research
• Background on Passwords
• Biometrics
• Overview of Biometrics
• How they work
• Strengths, Weakness and
• Usability of Biometrics
• Conclusion

4
Empirical Data

• Yearly cyber crime cost in the US is over 377
  million and rising CSI/FBI Study
• Federal Trade Commission found that identity
  theft accounted for 48 billion in losses to
  business over the past five years

5
Background on Passwords Biometrics

• Passwords
• Ubiquitous Technology
• Passwords are one of the oldest authentication
  methods.
• Many organizations and institutions have used
  passwords for computer access since 1963 when
  Fernando J. Corbato added private codes to the
  CTSS at MIT
• Biometrics
• First introduced in the 1970s and early 1980s
• This technology gathers unique physiological or
  behavioral attributes of a person for storing it
  in a database or comparing it with one already
  found in a database.
• Reason for biometrics include the positive
  authentication and verification of a person and
  ensuring confidentiality of information in
  storage or in transit

6
Biometrics

• 2 Categories of Biometrics
• Physiological also known as static biometrics
  Biometrics based on data derived from the
  measurement of a part of a persons anatomy. For
  example, fingerprints and iris patterns, as well
  as facial features, hand geometry and retinal
  blood vessels
• Behavioral biometrics based on data derived
  from measurement of an action performed by a
  person and, distinctively, incorporating time as
  a metric, that is, the measured action. For
  example, voice (speaker verification)

7
Biometrics How do they work?

• Although biometric technologies differ, they all
  work in a similar fashion
• The user submits a sample that is an
  identifiable, unprocessed image or recording of
  the physiological or behavioral biometric via an
  acquisition device (for example, a scanner or
  camera)
• This biometric is then processed to extract
  information about distinctive features to create
  a trial template or verification template
• Templates are large number sequences. The trial
  template is the users password.

8
Overview of Biometrics
9
Strengths, Weaknesses and Usability of Biometrics
10
Strengths, Weaknesses and Usability of Biometrics
11
Strengths, Weaknesses and Usability of Biometrics
12
Comparison of Different Biometrics Technology
13
Promise that Biometrics hold for Privacy

• Increased Security
• Biometric cannot be lost, stolen or forgotten it
  cannot be written down and stolen by social
  re-engineering
• By implementing biometrics organizations can
  positively verify users identities, improving
  personal accountability
• In conjunction with smart cards biometrics can
  provide strong security for Public Key
  Infrastructure (PKI)

14
Perils that Biometrics hold for Privacy

• Privacy is one of the leading inhibitor for
  biometrics technology. Main issues
• Misuse of Data
• Health/Lifestyle Specific biometric data has
  been linked with the information beyond which it
  is set out to be used for such as AIDS. Is a
  person able to control the information gathered
  on himself/herself?
• Function Creep
• Law Enforcement The template database may be
  available for law enforcement
• Credit Reporting The template database may be
  cross referenced against other databases
  including those held in hospitals and the police
  departments, by a credit reporting agency

15
Future Trends in Biometrics

• Body Odor Body odor can be digitally recorded
  for identification. A British company, Mastiff
  Electronic System Ltd. Is working on such a
  system
• DNA Matching The is the ultimate biometric
  technology that can produce proof positive
  identification of an individual
• Keystroke Dynamics Keystroke dynamics, also
  referred to as typing rhythms, is an innovative
  biometric technology

16
Conclusion

• All authentication methods are prone to errors.
  Nevertheless, reliable user authentication must
  ensure that an attacker cannot masquerade as a
  legitimate user
• Biometrics is uniquely bound to individuals and
  may offer organizations a stronger method of
  authentication
• Biometric systems are not foolproof they can be
  compromised by
• Submission of another persons biometric
• Submission of enrollees biometric with the user
  under duress or incapacitated
• A prudent balance between Security and Privacy
  needs to be achieved