Biometrics Add Security in Insecure Times
Biometrics Solutions
Proponents argue that biometrics - technology that uses biological sources for identity verification - is one way to battle the onslaught of identity theft and online fraud attacks. "I think biometrics can play a really important role in providing non-repudiated authentication," says Maxine Most, a principal at Acuity Market Intelligence in Boulder, Colo., which tracks biometrics solutions. She adds that many financial firms are experimenting in some fashion with biometrics. According to Most, the technology can improve security and business processes, and provide a more convenient way for users to be authenticated.
Christine Barry, an analyst at Celent Communications who has tracked biometrics, says, "I don't think it's moving as quickly as a lot of people once expected, but it's definitely made progress."
Mart Raigla, vice president of technology risk and information security at TD Waterhouse, says, "We've been thrilled with our implementation [of biometrics solutions]." He says the various biometrics systems are all very secure, depending on how they are deployed.
There are more than a half-dozen biometrics-based approaches to security, each of which has its strengths and weaknesses.
Voice Authentication: Users provide snippets of their speech, which are compared to voiceprints on file. According to vendors, voice-authentication applications can easily be rolled out to a large consumer base.
Voice authentication is particularly good for shortening the identification process and limiting password re-sets, a significant problem for financial firms. One estimate indicates that each password re-set costs a firm $25 in staff time, so the ability to automate that process and free up staff can be a considerable advantage. Aim's Dean says, "We have seen a reduction in the number of PIN resets" since the firm made voice authentication available. He notes that voice recognition works well in self-service situations: "We wanted to make it easy for our clients."
But, there is a downside to voice authentication, cautions Randall Frank, vice president and chief architect at the Fidelity Center for Applied Technology. Fidelity is "still tire-kicking" a range of biometrics securities, including voice recognition and scanning technologies like biometrics-based doorknobs, according to Frank. "The promise of biometrics remains enormous," he says. "It really offers another layer of security." Frank adds, "The key issue for us is getting them robust enough so they operate flawlessly over millions of customer transactions."
In the case of voice recognition, he says, a mere five percent failure rate might not sound like much, but across 1.2 million accounts, it amounts to 60,000 frustrated customers a day, which really concerns Fidelity. In addition, Frank says, there's an issue in trying to get 20 million clients enrolled.
Voice recognition operates best when there's no background noise, so the notion of using it with a computer and microphone is still wishful thinking, experts say. Vendors include Nuance; Vocent Solutions of Mountain View, Calif.; and Voicevault of Dublin, Ireland.
FINGERPRINTS: Each individual has a unique fingerprint. He or she simply places his or her finger on a device that scans it and compares the image to records held in a database to authenticate the user. Fingerprinting is often used for access to computing networks or buildings. Celent's Barry notes that fingerprint scanning is one of the most widely used biometrics systems. There are more than 50 vendors providing solutions.
Kevin Whyte, vice president of wealth management at TD Bank Financial Group in Toronto, which encompasses TD Waterhouse, says his firm uses fingerprint scanning to authenticate some of its traders. "It's a way to avoid multiple passwords," he says. "We're not talking about thousands of traders."
Celent's Barry notes, however, that it's a challenge to get the right detail and resolution from fingerprints, especially among those who work with their hands, such as carpenters. And using fingerprints can be costly, because users need access to a finger scanner.
Scanners cost about $100 and can be somewhat technical to hook up and use, which makes them difficult to deploy to a client base. Vendors include Identix of Minnetonka, Minn.; SAFLINK of Bellevue, Wash; and BioScrypt of Mississauga, Ontario, among many others.
HAND SCANS: Here, the user places his or her hand on a scanner, which measures such things as finger length and the curvature of a hand. Barry notes that while fingerprints are unique, handprints are not. The technology has been used primarily for access to physical spaces. Again, the issue is the cost of the devices.
Vendors include Recognition Systems of Campbell, Calif.; Diebold of North Canton, Ohio; and ABT Advanced Biometric Technologies of Dollard Des Ormeaux, Quebec.
IRIS AND RETINA SCANS: TD Waterhouse's Whyte says his firm uses iris scanners to grant employees access to sensitive data centers. Although it has been "relatively problem free," he says he doesn't believe there is an appetite to expand its use beyond the data centers.
Iris and retina scans are considered more invasive than other biometrics systems, and there are concerns about the privacy of such data. Celent's Barry says that iris scanning is one of the most accurate of the biometrics technologies. The scanner examines the iris and records up to 266 unique spots or data points.
Retina scans, which employ a light that is flashed into a person's eyes, are even more accurate, but the devices are costly, and there are healthcare concerns, Fidelity's Frank notes. A retina scan, he says, actually involves a low power laser that is shone into the eye, which tends to make people nervous. Frank says the problem with an eye scan is deploying it effectively and getting it to work quickly. Most people won't tolerate standing around while a scan examines their eyes, he asserts.
In addition, the position of the eye has to be directly in front of the scanner or the device could provide a false reading. The applications are not considered conducive to consumer deployments, though some bank machines use iris scanners. Vendors in this space include Iridian Technologies of Moorestown, N.J., and eEye Digital Security of Aliso Viejo, Calif.
SIGNATURE VERIFICATION: This technology analyzes a person's penmanship. It looks at things like pen stroke and how the writer dots the letter "i" or crosses the letter "t," as well as speed-of-hand and the amount of pressure placed on the writing instrument.
Acuity's Most says that this technology is good for opening accounts and in cases where people are physically available to sign things. She says Charles Schwab is piloting the technology.
The drawback for handwriting biometrics is that it is limited in scope and must be used with the appropriate sensing device, which means that it's confined to counter-type activity. Vendors include Communication Intelligence Corp. of Redwood Shores, Calif., and Interlink Electronics of Camarillo, Calif.
FACIAL RECOGNITION: This technology examines a person's face, looking at things like the distance between a person's eyes and the structure of his or her nose and mouth. It requires a camera, and if a person is not looking directly at it, there can be errors. Glasses and even skin color can also cause problems.
Vendors include Advanced Biometrics Security of Littleton, Mass.; Minn.-based Identix; and AcSys Biometrics Corp. of Burlington, Ontario.
Despite the growing pains of biometrics, many remain optimistic about the long-term potential of the technologies. Celent's Barry says spending on biometrics is expected to hit $1 billion by the end of 2004, up from only a few hundred million in 2001. There are an estimated 200 vendors offering biometrics solutions, and it is expected that computers of the future will contain things like cameras and finger scanners embedded into the keyboards, which will likely spur adoption.
TD Bank Financial Group's Whyte says the key to implementing biometrics isn't so much about integrating the technology into systems as it is about education and familiarity. "People need to be educated and comfortable," he says.
Tweet This