This paper examines biometric authentication technology as a means of enhancing computer and physical security. It surveys common biometric modalities—fingerprints, iris patterns, blood vessel structure, and thermographic facial imaging—and weighs their advantages against documented vulnerabilities. The paper argues that while biometrics offer meaningful security improvements over traditional passwords and keys, they are not foolproof. Drawing on risk management principles, it emphasizes that the effectiveness of any biometric system depends on the sophistication of potential threats, the sensitivity of the assets being protected, and the cost constraints faced by organizations implementing such systems.
Biometric authentication has developed substantially as an emerging field of computer-based security since its introduction shortly before the end of the 20th century. Generally, biometrics provide a means of confirming the identity of individuals in a manner that relates to their physical attributes. This mechanism increases access security because, unlike passwords, the identifying criteria cannot be easily lost, forgotten, shared, stolen, or used to facilitate unauthorized system or physical access. Biometric identification systems may use fingerprints, iris patterns, blood vessel structure of the hands, and even thermographic facial imaging (Busch, 2006).
On one hand, biometrics offers security enhancement in many significant respects; on the other hand, biometrics are by no means foolproof, which has been demonstrated conclusively—for example, in connection with several incidents reported in 2006 (Bulkeley, 2006). National security experts suggest that biometrics are indeed a viable addition to computer and physical facility security measures, but they emphasize the need to combine them with other layers of security. Specifically, one of the most important considerations in that regard is simply understanding the nature of the specific risks of system compromise associated with each potential application (Larsen, 2007).
Much like the case with traditional locks and keys used to control physical access, the degree of security offered by different forms of biometrics depends largely on the sophistication of the entities seeking to circumvent them. Just as standard locks are sufficient to thwart simple attempts to defeat them but not well-conceived or sophisticated methods of infiltration, biometric security measures are likely to be highly successful against low-level attempts to defeat them, but less impervious with respect to more sophisticated attacks (Hamilton, 2007).
A fundamental risk management principle holds that the value of risk-mitigating countermeasures must be measured as a function of the degree of possible harm associated with the compromise of the particular assets being protected (Hamilton, 2007). Unsophisticated biometric systems are already available at relatively affordable prices, but they are unsuitable for many sensitive assets and applications. Sufficiently sophisticated biometric systems capable of safeguarding highly sensitive assets and information systems are comparatively cost-prohibitive for small and medium-sized business entities (Mills & Byun, 2006).
"When fingerprint systems work and when they fall short"
Ultimately, biometrics offers enhanced security, but sensitive national security assets require very careful consideration of the entire risk matrix in connection with the specific vulnerabilities of those assets and any biometric systems intended to secure them.
You’re 65% through this paper. Sign up to read the remaining 1 section.
Sign Up Now — Instant Access Already a member? Log inAlways verify citation format against your institution’s current style guide requirements.