While many biometric modalities have been tried at the ATM, fingerprint biometrics has become one of the most widely used, partly because of its long history, but more importantly for its ease of use, performance, interoperability, ability to thwart imposters and low cost. And contrary to many claims or what has been depicted in movies, fingerprint characteristics cannot easily be transferred, socially engineered or guessed. Biometrics is quite simply the simplest and most universal form of personal identity. There are also no literacy, language, race, gender or other barriers to biometrics’ widespread adoption or deployment. User authentication is completed with the simple touch of a finger.
That said, best practices should be observed for the most successful implementation of a secure, convenient and trusted authentication solution. Key focus areas should include the following:
Biometric Sensor Reliability – Sensor reliability is essential. It is critical that sensor technology be capable of working reliably under the broadest range of real world conditions. This is possible using sensors featuring multispectral imaging technology to ensure unique fingerprint characteristics can be extracted from both the surface and subsurface of the skin. Also important is liveness detection capabilities to prevent spoof attacks – the use of fake fingerprints or “spoofs” to impersonate a legitimate user and gain unauthorized access.
Optimized Data Security– Biometrics data must be handled like all sensitive and identifying information. Properly architected system designs will always consider and protect against both internal and external threats and attacks. Beyond the encryption of the data itself, there are now many good alternatives available for building highly secure and well protected systems, including the use of multi-factor and even multi-modal authentication to maintain security even if some identifying data is compromised.
Tamper Protection and Trusted Connections – The biometric used to authenticate the user for each transaction must interoperate with trusted devices at each point of verification. The solution must create a device-independent, trusted physical identity verification process. Additionally, the physical devices themselves must be tamper resistant to ensure that all transaction integrity is preserved.
Scenario Testing – Scenario testing is always recommended in order to evaluate biometric technologies in specific environments and applications.
Linking Mobile Credentials to a Biometric Identity – Because digital credentials are simply aliases for one’s true identity, it is critical to authenticate credentials stored on a user’s personal device and link those credentials back to a true identity with biometrics.
More Robust Biometric Templates – It may be desirable in some application-dependent situations to construct and enforce the use of enhanced biometric templates. The use of a "super template" that uniquely combines biometric data with other information – perhaps even an OTP or other out-of-band data – enables the system to recognize and reject a biometric template that was created from a stolen fingerprint image.
Implementation Policies– Effective authentication solution deployments are supported by appropriate business policies. Well-designed systems can significantly reduce risks and vulnerabilities. However the best system deployments are those that employ effective business policies to control or otherwise ensure the proper use of these systems. Enrollment policy, number of allowed attempts before lockout and basic exception handling are good examples of workflow considerations that will significantly impact security, convenience, and the anticipated return on investment.
Privacy Protection – System design must provide for end-user privacy. The ability to store biometric data on a personal device eliminates the need for a local database or network connection and is one way to ensure privacy. Encryption and tamper resistant devices prevent the interception of private biometric, biographic, and transactional data. Finally, while biometric characteristics are not themselves inherently private, well-designed biometric solutions prevent fraudulent access and allow individuals to control their true identity.
The goal of any transaction at the ATM is to conveniently provide a service while ensuring the identity of the individual to whom the service is being provided. Managing risk is a matter of balancing and, ideally, combining security and convenience. Biometric authentication provides this capability with the highest level of certainty, which is why it is increasingly popular for securing ATM transactions.
However, with new technology adoption comes new risks: as biometric applications become increasingly widespread, and are relied upon for securing personal transactions, deployed solutions are likely to be targeted for attack. Consequently, it will be increasingly important for those deploying biometric authentication to understand that not all biometric devices and solutions are created equal.
We all have only one true identity, and this identity must be protected in a sensible, balanced and efficient way. Nothing in life is without risk but there are no longer valid technical or business reasons to rely on outdated security systems and practices. Biometrics offers us the ability to make productive use of the myriad of digital credentials that we use and manage today – and to do so in a manner that is more secure and convenient, and actually protects our true identity. We no longer should have to choose between greater security or convenience, when with biometrics we can get both.
