Biometrics For Dummies®

Table of Contents

Introduction

About This Book

Foolish Assumptions

Conventions Used in This Book

What You Don’t Have to Read

How This Book Is Organized

Part I: Getting Started with Biometrics

Part II: Types of Biometrics

Part III: Implementing and Using Biometrics

Part IV: The Part of Tens

Part V: Appendixes

Icons Used in This Book

Where to Go from Here

Write to Us!

Part I: Getting Started with Biometrics

Chapter 1: Understanding Biometrics

What Biometrics Are and Who’s Using Them

Types of Biometrics

Physiological

Behavioral

How Biometric Systems Work

Characteristics of Biometric Systems

Benefits of Biometric Systems

Selecting a Biometric System

Implementing Biometrics

Understanding Biometrics Issues

Privacy

Privacy laws

Protecting Biometric Data and Infrastructure

Chapter 2: Protecting Assets with Biometrics

Speaking the Language: Biometric Concepts and Terms

Starting at Square One

Recognizing organizational benefit

Understanding your customer

Understanding the objective

Applying Triple A: Authentication, Authorization, and Accounting

Refining ideas about authentication

Authorizing actions

Auditing

Choosing the Best Fit

Security as a goal

Environment as a factor

Cost as a limitation

Regulatory considerations

Chapter 3: Biometrics in Our Lives

Privacy Issues

Constitutional privacy protections

Statutory privacy protections

Executive Order 12333

Too much information

Protecting biometric data

Keeping a check on Big Brother

Maintaining the balance

Biometrics and U.S. Law

Passport and entry

Special jobs

Everyone else

Protections against misuse

Biometrics and European Law

Biometrics and Laws in Other Countries

Ethics Issues with Biometrics

Tracking you down

Controlling how your biometrics are used

Ignoring irrelevant data

Understanding failure

Managing concerns

Part II: Types of Biometrics

Chapter 4: Fingerprint and Hand Biometrics

Fingerprints

Understanding the biometric basis for fingerprints

Contemplating practical considerations

Where you will see fingerprint biometrics

Palm Scan

Understanding the biometric basis for palm scanning

Contemplating practical considerations

Where you will see palm scan biometrics

Hand Veins

Understanding the biometric basis for hand veins

Contemplating practical considerations

Where you will see hand vein biometrics

Sonar/Ultrasonic

Understanding the biometric basis for sonar and ultrasonic biometrics

Contemplating practical considerations

Where you will see sonar and ultrasonic biometrics

Comparing Hand-Based Biometric Types

Chapter 5: Signature Biometrics

Recognizing a Signature

Understanding the biometric basis for signature recognition

Contemplating practical considerations

Where you will see image-only signature biometrics

Stylus Movement Dynamics (X and Y Directions)

Understanding the biometric basis for stylus-movement dynamics

Contemplating practical considerations

Where you will see two-dimensional signature dynamics biometrics

Stylus-Pressure Dynamics

Understanding stylus-pressure and other biometric signature dynamics

Contemplating practical considerations

Where you will see 3D signature dynamics

Heisenberg Applied to Biometrics

Comparing Signature-Based Biometric Types

Chapter 6: Retina and Facial Biometrics

Identifying a Retinal Scan

Understanding the biometric basis for retina recognition

Contemplating practical considerations

Where you will see retinal biometrics

Iris Scanning

Understanding the biometric basis for iris recognition

Contemplating practical considerations

Where you will see iris biometrics

Facial Imaging

Understanding the biometric basis for facial imaging biometrics

Contemplating practical considerations

Where you will see facial recognition biometrics

Upcoming Head-based Biometrics

Recognizing ears

Recognizing facial thermographs

Comparing Eye- and Face-Based Biometric Types

Chapter 7: Other Types of Biometric Identification Schemes

Recognizing Speech

Understanding the biometric basis for speaker recognition

Contemplating practical considerations

Where you will see speaker recognition biometrics

DNA as a Biometric Recognition Technique

Understanding the biometric basis for DNA

Contemplating practical considerations

Where you’ll see DNA as a biometric recognition technique

Gait-Recognition Biometrics

Understanding the biometric basis for gait recognition

Contemplating practical considerations

Where you will see gait biometrics

Typing Dynamics

Understanding the biometric basis for typing dynamics

Contemplating practical considerations

Where you will see typing dynamics

Interesting Biometrics Not Ready for Prime Time

Sentence-structure and linguistic-analysis biometrics

Brainwave biometrics

Odor biometrics

Comparing Biometric Identification Schemes

Part III: Implementing and Using Biometrics

Chapter 8: Selecting a Biometrics Solution

Identifying Selection Criteria

The users

The environment

Identifying the Field of Possible Solutions

Speaking to stakeholders

Analyzing requirements

Reviewing your requirements

Incorporating review feedback

Identifying and speaking with reference customers

Testing Potential Solutions

Vendor/manufacturer on-site testing

Making the Selection

Chapter 9: Implementing, Supporting, and Maintaining a Biometrics Solution

Implementing the Biometrics System

Building a plan

Executing the plan

Running pilots and tests

Throwing the switch

Informing users

Training users

Dealing with user issues

Supporting Users

Fault management

Publishing information for users

Health issues

Maintaining a Biometric System

Software updates

Hardware updates

Firmware updates

Change management

Configuration management

Upgrades

Chapter 10: Securing Biometrics Systems

Biometric System Threats and Vulnerabilities

Natural threats

Man-made threats

Biometric system vulnerabilities

Attacks on Biometric Systems

Replay attacks

Faked credentials

Stolen credentials

Bypass attacks

Re-enrollment attacks

System attacks

Network attacks

Application attacks

Social engineering

Protecting Biometric Infrastructure

Security-protection concepts

Protecting biometric devices

Protecting communications

Protecting servers

Protecting biometric applications

Protecting biometric data

Finding Sources of Security Information

Chapter 11: The Future of Biometrics

Improvements in Technologies

Fingerprint and palm scan

Hand veins and ultrasonic holography

Signature

Retina scan

Iris scan

Facial image

Facial thermograph

Ear recognition

Speech

DNA

Gait

Typing characteristics

Sentence structure and linguistic analysis

Brainwave

Identifying by odor

New Objects to Measure

Behavior-based

Basing biometrics on physical properties

Part IV: The Part of Tens

Chapter 12: Ten Tools Used in Biometrics

Credit-Card Fingerprint Scanner

Contactless Palm-Vein Imager

Mouse-Embedded Palm-Vein Scanner

Cardio-Signature Reader

Laptop Facial Recognition

Biometric Timecard Systems

Biometric Flash Drives, Portable Hard Drives, and Stuff

Survey Skills

Diplomacy . . .

Business Knowledge

Chapter 13: Ten Biometrics Web Sites

National Geographic and Sharbat Gula

Electronic Frontier Foundation

National Biometric Security Project

United States Department of Justice

National Institute of Standards and Technology

International Center for Disability Resources on the Internet

findBIOMETRICS.com

Third Factor Biometric Authentication News

Biometrics Catalog

John Daugman

Chapter 14: Ten Essentials for Biometrics Success

Align with the Goals of the Organization

Consider and Address Privacy Concerns

Survey the Users

Stick to the Plan

Be Flexible

Research the Problem

Research the Solution

Don’t Get Fancy

Talk to People with Working Installations

Do Not “Fire and Forget”

Chapter 15: Ten Biometrics Scenarios to Plan For

Alternate Entryway Access

High-Security Hosting

Port-of-Entry Identification

Law Enforcement

That Biometric Doesn’t Work for Me

I Object to the Invasion of My Privacy

We Found Malware on the Biometric Database Server

Biometric Readers in Objects

Behavioral Biometric Driving Sensors

Biometric Neighborhood Watch

Chapter 16: Ten Benefits of Biometrics

Cooperation Not Required

Guarantees Physical Location

High-Throughput

Unforgettable

Unlosable

Unsharable

Cost Reduction

Compliance

Emergency Identification

No Identity Theft

Coolness

Part V: Appendixes

Appendix A: Comparing Biometrics Solutions

Column definitions

Notes

Appendix B: Controlling Physical Access

Time is not your friend

Never count on strength alone

It’s alarming

Preventive measures

Reacting to attacks

Excessive response

Appendix C: Glossary

Biometrics For Dummies®

by Peter Gregory, CISA, CISSP and Michael A. Simon

Biometrics For Dummies®

Published by
Wiley Publishing, Inc.
111 River St.
Hoboken, NJ 07030-5774
www.wiley.com

Copyright © 2008 by Wiley Publishing, Inc., Indianapolis, Indiana

Published simultaneously in Canada

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Trademarks: Wiley, the Wiley Publishing logo, For Dummies, the Dummies Man logo, A Reference for the Rest of Us!, The Dummies Way, Dummies Daily, The Fun and Easy Way, Dummies.com, Making Everything Easier, and related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Website is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Website may provide or recommendations it may make. Further, readers should be aware that Internet Websites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services, please contact our Customer Care Department within the U.S. at 800-762-2974, outside the U.S. at 317-572-3993, or fax 317-572-4002.

For technical support, please visit www.wiley.com/techsupport.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

Library of Congress Control Number: 2008930830

ISBN: 9780470507643

Manufactured in the United States of America

10 9 8 7 6 5 4 3 2 1

About the Authors

Peter Gregory, CISA, CISSP, is the author of several books including IT Disaster Recovery Planning For Dummies, Blocking Spam & Spyware For Dummies (with Mike Simon) and CISSP For Dummies.

Peter is the security and risk manager at a financial management software company located in Redmond, Washington. Prior to this, he held tactical and strategic security positions in large wireless telecommunications organizations. He has also held development and operations positions in casino gaming-management systems, banking, government, nonprofit organizations, and academia since the late 1970s. He is a member of the Board of Advisors and an occasional lecturer for the NSA-certified University of Washington Certificate Program in Information Assurance & Cybersecurity.

Peter can be found at www.peterhgregory.com.

Michael A. Simon is the author of The Internet Starter Kit for Windows (with Adam Engst and Corwin S. Low) and Blocking Spam & Spyware For Dummies (with Peter Gregory).

Mike has been working in computer security and policy development since 1985, working at the time for the University of Idaho, a regional pioneer in computer security and one of the first NSA Centers of Excellence in Information Assurance Education.

Currently, Mike is an adjunct faculty member for the University of Washington, and occasionally lectures at Seattle University, University of Idaho, and several civic organizations on the subject of information assurance and computer security. He sits on the advisory board for the Information Assurance certificate program for the University of Washington, the technical advisory board for Goldfish Holdings, Inc., the Advisory Board for the Computer Science Department at the University of Idaho, and on the Founders Board for the Information School at the University of Washington.

Dedication

To Becky and Shannon. — Peter Gregory

To my teachers: past, present, and future. — Mike Simon

Author’s Acknowledgments

Peter Gregory would like to thank Carole McClendon, his literary agent, and Tiffany Ma and Amy Fandrei, Acquisition Editors at Wiley, for their support of this project. Thank you to Nicole Sholly, Project Editor at Wiley, for your help organizing our work, and to Barry Childs-Helton and John Chirillo for copy and technical editing, respectively. Thank you, Mike, I always enjoy working with you on collaborative projects.

Mike Simon would like to thank Paul Donion for dealing with a business partner with deadlines. Thanks to Erin Klunder and Ray Pompon for answering random biometrics questions about law enforcement and finance (respectively). Much thanks to Al Gidari and Joseph Cutler of Perkins Coie, LLP for the use of the table of State Data Breach laws in Chapter 3. Thanks, Peter, for making me look good (again).

Publisher’s Acknowledgments

We’re proud of this book; please send us your comments through our online registration form located at www.dummies.com/register/.

Some of the people who helped bring this book to market include the following:

Acquisitions, Editorial, and Media Development

Project Editor: Nicole Sholly

Acquisitions Editor: Amy Fandrei

Senior Copy Editor: Barry Childs-Helton

Technical Editor: John Chirillo

Editorial Manager: Kevin Kirschner

Editorial Assistant: Amanda Foxworth

Sr. Editorial Assistant: Cherie Case

Cartoons: Rich Tennant (www.the5thwave.com)

Composition Services

Senior Project Coordinator: Kristie Rees

Layout and Graphics: Reuben W. Davis, Joyce Haughey, Melissa K. Jester, Abby Westcott, Christine Williams

Proofreaders: Dwight Ramsey, Nancy L. Reinhardt

Indexer: Claudia Bourbeau

Publishing and Editorial for Technology Dummies

Richard Swadley, Vice President and Executive Group Publisher

Andy Cummings, Vice President and Publisher

Mary Bednarek, Executive Acquisitions Director

Mary C. Corder, Editorial Director

Publishing for Consumer Dummies

Diane Graves Steele, Vice President and Publisher

Composition Services

Gerry Fahey, Vice President of Production Services

Debbie Stailey, Director of Composition Services

Introduction

Biometric technology is a HOT topic. The most recent (ISC)² Global Workforce Survey of over 7,500 security professionals from around the world have cited biometrics as the number one security project for organizations in North America, and the number two security project in the world overall.

Most companies aren’t using any form of biometrics yet, but many are looking into biometrics now. Security regulation, negative publicity about security breaches, and the desire to avoid being the next security-breach scandal are prompting many organizations to take a first serious look at biometrics.

About This Book

Our objective for this book is simple: to help you become familiar with biometrics in a hurry by giving you all the information you need to be able to start looking at biometric solutions. Biometrics For Dummies will help you to be a smart shopper and know what you are looking for — and what to avoid.

This book isn’t the encyclopedia of biometrics. You don’t need that right now. Given the broad base of information you need, this book is the best way to jump-start your own knowledge, which will help you and your company become critical, informed customers. You’ll learn what biometrics are all about, all the general categories of biometrics (plus a few of the oddities), and everything you need to know to get started with an evaluation and eventual implementation of biometrics.

As a technology professional or a business manager, you’ll find that biometrics are a bit tricky, especially with respect to privacy and legal issues, but not really all that hard to learn. Learning about biometrics isn’t any more difficult than learning any new hobby or skill. And as you proceed down the road to evaluating, selecting, and using biometrics, you and your organization will be far better off for all the insight this book imparts. You’ll probably get some kudos for helping your organization successfully embrace and use biometrics. We have confidence in you!

Foolish Assumptions

We make two broad presumptions when we wrote this book:

You understand your business. You know what your business’s products and services are, and how it develops, sells, and supports them. You don’t need to understand every minute detail, but just have a good overall view of what your business is in the business of doing.

You understand technology. We aren’t saying you’re a rocket surgeonist (say what?), but we figure you know the basics of how computers, networks, and applications work — and what’s going on when you type in your user ID and password or swipe your card when you enter the building.

Conventions Used in This Book

This isn’t a book about computer programming or acupuncture, so we’ve spared you a lot of tricky diagrams and lines of computer code. We’ve written Biometrics For Dummies in plain English, and that’s about all you need to know! (Okay, we have used one convention: We’ve italicized jargon-y terms as a heads-up to you that the jargon-y term’s definition — as it pertains to biometrics — is nearby.)

What You Don’t Have to Read

If your organization already has a biometrics system and you need to know more about how it works, then you can probably skip the chapters on selection and implementation, unless you’d like some insight into how the decision-making process probably went in your company.

How This Book Is Organized

This book is organized in four parts. Although the chapters don’t necessarily have to be read in order, they’re organized according to the somewhat logical progression that an organization would follow as it explores its security issues and proceeds down the road to Biometric City.

Part I: Getting Started with Biometrics

In Part I, we first introduce biometrics and give you some sweeping overviews on how biometrics help to protect organization assets. We also discuss the impact that biometrics are having on data security and privacy laws, as well as professional ethics. The chapters in this part give you a solid business background on what biometric technology is all about — and the impact it’s having on business and society.

Part II: Types of Biometrics

Part II explains all the types of biometrics that are in use today, as well as some that are still up and coming. The chapters in this part are organized by the type of biometrics: fingerprint and hand, signature, ocular and facial, and other types.

If you’ve already settled on a type of biometrics that will work in your organization, we still suggest you read all the chapters in this section. Even if your educated guess was right, learning more about the other types of biometrics will give you keen insight and will help open your mind to consider alternatives.

Part III: Implementing and Using Biometrics

Selecting biometrics is only half the fun; once you’ve made an educated and informed decision on a biometrics solution, you’ve got to make it work. We’ve poured our decades of technology-implementation and management expertise into the chapters in this part to help you avoid pitfalls we discovered long ago. Digging yourself into a hole is no fun, especially when others are looking. But rather than giving you a shovel to make the hole, or even the ladder to climb out of it, we provide a map to help you sidestep it altogether.

In this part, we also discuss how to protect your biometrics system from harm. Biometric technology itself needs to be protected, so it can perform properly and protect your company’s assets. Finally, we discuss where we think biometric technology is going in the future. This will help jump-start you on some of the conventional — and not-so-conventional — wisdom in the biometrics industry and practices.

Part IV: The Part of Tens

No For Dummies book is complete without a Part of Tens. And the Part of Tens chapters in Biometrics For Dummies are really special. You won’t find lists of Web sites here; instead, you’ll marvel, be entertained, and wind up informed. And you’ll probably go back and give the Part of Tens a second look in the other For Dummies books on your bookshelf. It’s really that good!

Part V: Appendixes

This part contains a great consumer guide comparing all the biometric technologies discussed in this book and an appendix that covers physical security for IT pros who have spent most of their careers paying attention to computers. Just before the index is a short listing of biometric and information security terms. We’ve included this glossary in the book so you can refer to it often and easily whenever some wily biometric term escapes you.

Icons Used in This Book

What’s a For Dummies book without icons pointing you in the direction of really great information that’s sure to help you along your way? Icons are great visual cues to handy information; here’s a brief description of each icon we use in this book:

The Tip icon points out helpful information that’s likely to make your job easier.

This icon marks a generally interesting and useful fact that you may want to remember for later use, because it’s likely to crop up again.

The Warning icon highlights lurking danger. With this icon, we’re telling you to pay attention and proceed with caution.

Where to Go from Here

If you need to learn about the various types of biometrics, turn to Part II. If your organization has already chosen a solution and you need to help implement it, go to Chapter 9. If you’re wondering about the impact of biometrics on law and society, read Chapter 3. If you want to look over our shoulder into the biometrics crystal ball, go to Chapter 11. You can dog-ear the glossary in case you want to learn the language of biometrics.

Write to Us!

We’re all too familiar with the fact that technology and business marches on, and we won’t be left in the dust. If you’re embarking on your own biometrics project and have questions, or have your own wisdom to share, look us up on the Internet or write to us here:

peterhgregory@yahoo.com

mikeasimon@gmail.com

Part I

Getting Started with Biometrics

In this part . . .

So you’re getting started with biometrics, eh? Maybe your organization is implementing a biometric security solution, and perhaps you’re even in charge of it! You’ve come to the right place: In this section, you get a quick overview of all things biometric, as well as in-depth discussions of how biometrics are used to protect assets — and a look at laws that are related to biometrics.

Chapter 1

Understanding Biometrics

In This Chapter

Getting a handle on biometrics

Sampling physiological and behavioral biometrics

Defining biometric systems

Protecting biometric systems

Here’s our “nickel tour” of biometrics — well, okay, that’d be a dollar or two in today’s money — back in the day, a nickel tour meant you got a pretty good overall look at something in a short time. This chapter is like that. If you’re going into a meeting about biometrics in thirty minutes, and you don’t want to appear clueless about it, this chapter will show you all the basics you need. But if you’re standing in the bookstore looking for more of a clue, you’re much better off buying the book and taking it home where you can drill deeper into the topics you’re really interested in.

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!

Lesen Sie weiter in der vollständigen Ausgabe!