Biometrics Technology Charlie Ahrens Director, DigitalPersona December 12, 2002

Increasingly Networked World Intranets WAN Extranets Remote access and VPN Last mile broadband (DSL / cable modems) Wireless networking Mobile wireless (PDAs / cell phones) ASPs

Computer and Network Security SSL, VPNs, Digital Certificates, S/MIME, PGP, RAS, Databases, network logon Each has a foundation in the use of cryptographic keys bit private keys, 128 bit symmetric keys, and password hashes Theory shows that it would take longer than the age of the universe to crack any of these keys…so it must be secure?

Shifting Security Threat Previous decade focused on perimeter security Securing entry points into the network and applications that had weak access controls. Firewalls, VPN’s, Cryptography… Proliferation of Access Control (and points of access) Today’s threat model revolves around end users Perimeter security has increased, raising the difficulty of breaking through access controls Other areas of attack are now the highest risk Social engineering attacks are gaining recognition as a path of least resistance for hackers leading to corporate “identity theft”

The Art of Deception… "The biggest threat to the security of a company is not a computer virus, an unpatched hole in a key program or a badly installed firewall… The weakest link in the chain is the people“ - Kevin Mitnick; Oct 2002, BBC Interview

Passwords Security is actually left in the hands of the users. People cannot remember 1024 bit keys, so a password encryption or access mechanism is used. People forget passwords, write them down on post-it notes, tell them to colleagues, choose ones that are easy to remember. Open to social engineering attacks Expensive to administer, inconvenient for users, and a big security hole.

User Authentication The ‘Achilles Heel’ of Network Security Server Security Intrusion Detection Strict Access Controls Digital Certificates Server Security Intrusion Detection Strict Access Controls Digital Certificates Network Security Firewalls, DES, SSL encryption Network Security Firewalls, DES, SSL encryption PC Security Secure OS’s TCPA PC Security Secure OS’s TCPA User Authentication Passwords User Authentication Passwords

Corporate Identity Theft Passwords- the Achilles heal of security 71% of computer fraud is due to unauthorized insider activity; 2000 CSI/FBI Computer Crime Survey 4 out 5 workers will disclose their passwords to someone in the company, when asked. PentaSafe Security Technologies; Cnet News, 2002 Largest database of Corporate Passwords = Adult content sites Password issues cost between $ per user per year Morgan Keegan, 2001; Gartner Group/Forrester Research. Current employees pose 2x greater threat to company technology infrastructure than external, non-employees. CSO Magazine Survey, 2002; CXO Media Inc. Password polices are ineffective and expensive Password security policies rely on end-user cooperation Strict policies motivate users to compromise security Those who comply will generate higher support costs… Catch 22; stricter policies can actually lower security

Digital Certificates Require Secure User Authentication Digital Certificates are electronic tokens / keys used in many high security environments … Digital Certificate USER AUTHENTICATION They can be stored on a PC, a smart card, or a server. Use of the key requires secure user authentication!

Biometrics as the Primary Credential A fingerprint match becomes the key building block for user authentication More secure Easier to use Less costly to support Add additional credentials as necessary Multi-factor authentication for higher security Passwords, tokens, other biometrics…

Biometrics Security & Convenience Biometric technology options: Voice Face Iris Hand Fingerprint Telephone ID Surveillance High speed identification Difficult environments Low cost, embeddable

Fingerprint recognition Has been studied for 100+ years Tens of millions invested in R&D and processes. Constrained environment We have 10 fingers Easily cost and size reduced High user acceptance

Fingerprint Technology Rapidly Securing IT Environments $99-$149 (today) PRICE MARKET $12M / yr (‘98) $600M/yr (‘03) $6,000 (‘94) Market Forecast Source: International Biometric Group

Case Studies City of Glendale Glendale, California Centre Hospitalier Laurentien Montreal, Canada

Demonstration