A survey from 2022 reported that 46% of US consumers are now comfortable with the implementation of biometrics—and compared to a similar report from 2020, acceptance pf face recognition increased by 40% within the following two years.
While some are still hesitant to adopt biometrics due to data privacy and breaches, factors like the COVID-19 pandemic eased people into the idea of quicker, passwordless options. As technology and regulations advance, biometrics becomes one of the safest and most convenient ways to protect personal assets.
Now, institutions like the US Department of Commerce’s National Institute of Standards and Technology (NIST) are closely watching the accuracy and reliability of high-quality biometrics. This means gathering more accurate samples and implementing safer methods to store and use them.
Although privacy breaches are still present and pose a significant threat in the field, the true quality of biometric systems lies in how difficult it is for hackers to use stolen data. The industry’s technological advances are building fool-proof security checks, making hacked data useless.
From protecting finger scan data to real-time facial recognition best practices, let’s explore how the biometrics industry is enhancing its security measures.
En route to make fingerprints safer
If you have owned any iPhone model from six to nine, you’ll be familiar with fingerprint authentication. It’s one of the most widely adopted biometric methods in both private and public sectors, and thus it’s paramount to keep the practice as safe as possible.
Systems usually store fingerprint data in mathematical representation: the moment a fingerprint reader scans a fingerprint for enrollment, the image is captured in zeroes and ones instead of image format. Biometrics providers store this data in two distinct ways: Firstly, Proprietary Fingerprint Template (PFT), where only the system that creates the template can process and match the scan for authentication, and secondly, standardized templates, which many systems and hardware can process.
The purpose of the fingerprint scan will determine the format used. Providers use PFT in one-to-one (1:1) verification, like using a fingerprint to open a door. Conversely, standardized formats are used in one-to-many (1:N) identification, for example, in police departments that match fingerprints in an extensive database.
To ensure the safety of both formats, NIST evaluates them under different procedures. For PFT, the PFT III test assesses the performance and accuracy of the templates whenever companies develop their own. On the other hand, Minutiae Interoperability Exchange (MINEX III) assesses standard formats and their compliance with the U.S. Government’s Personal Identity Verification (PIV) program. Since it’s mostly used for U.S. federal purposes like access to facilities and inputting in large databases, the format must be interoperable throughout different hardware and systems and follow strict compliance policies.
Rigorous facial recognition detection
Worth $3.8 billion in 2020, the facial recognition market is set to be valued at $8.5 billion by 2025—a stark growth that can be credited to its increased acceptance by the public.
As the market grows, so does its safety. It’s no longer viable to wear a facemask or hold up a picture of someone to trick a facial recognition check. Liveness detection implements Presentation Attack Detection (PAD), ensuring that deep fakes and other video attempts don’t pass security checks. And to make security measures even more layered, this type of detection can be passive, active, or a combination of both:
- Active liveness: Prompts users to perform specific actions to prove the video recording is happening live. Some also require holding up an ID to compare the photo in it and the person on camera.
- Passive liveness: Deemed more secure than active liveness, this security check doesn’t challenge the user to perform actions. Instead, the detection process is happening silently in the background. Here, algorithms are at play to check skin texture and the video’s lighting.
- Semi-passive liveness: This combination of the above practices puts the user at ease by prompting users to do more natural actions, such as smiling at the camera.
Passive liveness detection has a much higher completion rate than active liveness. A recent report suggested that a biometrics company’s client, who previously used active liveness and switched to passive, experienced an application completion rate from 60% to 95%. Some legislations even demand a live video call to prove the liveness of a person, but this approach has a huge abandonment rate, estimated at 70%, while not providing higher security than algorithm-based proofs.
Credible biometrics providers take it into their hands to prove their facial recognition’s safety with the ISO and IEC: these organizations provide PAD testing and reporting certifications ISO/IEC 30107-1. This way, companies leveraging this fast and convenient security measure know that their provider counts with high standards of biometrics technology.
Real-time access to avoid misuse
Oftentimes, companies that only use passwords believe it’s enough to enforce an automatic logoff whenever a period of inactivity is detected, thus requiring a new verified login to get back to work. In reality, this is tedious and poses a security risk because the frequent login demands can lead to using weak (but fast-to-type) passwords.
Facial recognition is developing a significant advantage in this area. With an evolving real-time capability, enterprises can strictly grant sensitive access to users when they’re at their stations either at the office or remotely.
To avoid all risks of impersonation and misuse of facial recognition authentication, providers offer conditional access—meaning access is automatically revoked when the person leaves their post unattended. This entails constant monitoring for the presence of authorized faces, and as soon as they’re missing, the system can lock or blur the screen on a device.
This new conditional access also allows for security features unavailable otherwise. For example, it alert users when someone else is watching their screen over their shoulder after detecting another face in its field of view. As this capability is further developed, banking apps can implement it when clients read or enter sensitive information.
It’s undeniable that biometrics technology is advancing in leaps and bounds to become the safest method of authentication and identification. In a world where hackers work harder every day, it’s up to providers to develop more secure systems to avoid data breaches and even more robust systems that make stolen data useless to thieves. Institutions are already taking the lead in certifying providers and creating compliance measures that companies must follow.
Source: CPO Magazine
