Opinion: Stolen fingers: The case against biometric identity theft protection
Computerworld - According to Winston Churchill, there is no worse mistake in leadership than to hold out false hopes. One area where false hopes have long abounded is information security, and it's happening again.
This time the false hope we're extending is that we can deploy one simple piece of technology that will significantly reduce the problem of identity theft. Of course, identity theft is a huge and growing problem. Each year, the identifying information of millions of Americans is stolen from corporate databases. Companies face billions of dollars in theft, millions of dollars in fines and, perhaps most important, the loss of customer trust.
Worse, identity theft can harm victims through lost savings, rejected loans and denied jobs. CIOs are faced with a security challenge that threatens the viability not only of the IT organization but of the entire corporation as well. To date, the countermeasures that we've deployed -- passwords, PINs and authentication tokens -- have been ineffective. All can be stolen and used by the nefarious.
This has made inexpensive biometrics look attractive for authenticating employees, customers, citizens, students and any other people we want to recognize. But do the benefits of biometrics outweigh the risks?
Biometrics rely not on something you have (a credit card) or something you know (a PIN), but something you are(your fingerprints, palm prints or retinas). Those unique biological identifiers are electronically read and converted to a string of ones and zeros and sent to an authenticator. There the information is compared with the string of numbers on file in the authenticator database.
And there is the weakness, for the risk of transmission interception or database theft remains unchanged. If a credit card number can be stolen, then the sequence of numbers that make up a fingerprint can be stolen just as easily. It might take thieves a little time to gear up to this new challenge, but gear up they will. Undoubtedly, in the years to come, news reports about fingerprint, palm print and retinal eye scan thefts will be just as common as credit card number thefts are today.
So, does that mean biometrics will leave us right where we are? No, they will leave us in a worse place. Think about it: If you lose your credit or ATM card, the issuing company can replace it. If your PIN becomes compromised, the bank can give you a new one. Even a Social Security number can be replaced. But what do you do if someone steals your retina scans? Who is going to give you new eyeballs?
- Study: Total Economic Impact of Google Apps Employees can work faster and IT spending can decrease when companies switch to Google Apps, says a commissioned study by Forrester Consulting. Going...
- Protecting Digitalized Assets in Healthcare Healthcare providers face an urgent, internal battle every day: security and compliance versus productivity and service. For most healthcare organizations, the fight is...
- Is a SaaS Deployment Right for You? Find out the answer and as well as the other deployment options.
- Discover How Mail Express Solves 2 of Your Biggest IT Headaches Email. It can be the source of some of IT's biggest headaches. As it eats up storage and bandwidth, it also opens up...
- Increasing the Value of Your Reports and Dashboards Learn how incorporating other analytical capabilities such as predictive modeling and visualization can increase the value of your reports and dashboards by providing...
- Video surveillance for IT: maximum image quality, minimum bandwidth Join us on Thursday, May 8th at 1 p.m. EST when Willem Ryan, Senior Product Marketing Manager at Avigilon, will discuss how IT... All Management White Papers | Webcasts