What Is Biometric Authentication? 3 Trends for 2021

Biometric authentication is a cybersecurity process that verifies a user's identity using their unique biological characteristics as their ... DevelopersIdentity&SecurityBusinessLeadershipCultureEngineeringAnnouncementsTalkToSalesSignUpDiscoverandenabletheintegrationsyouneedtosolveidentityAuth0MarketplaceDevelopersIdentity&SecurityBusinessLeadershipCultureEngineeringAnnouncementsTryAuth0ForFreeTalkToSalesAuth0DocsImplementAuthenticationinMinutesOAuth2AndOpenIDConnect:TheProfessionalGuideGetthefreeebook!Biometricauthenticationisacybersecurityprocessthatverifiesauser’sidentityusingtheiruniquebiologicalcharacteristicsastheirpassword.Bycomparingauser’sbiometricsignatureagainstonesubmittedandstoredinadatabase,biometricauthenticationsystemsareabletodeterminewhetherthepersonisattemptingtologin/accessdata/etc.Isactuallywhotheysaytheyare.Biometricauthenticationisarapidlyevolvingtechnologythatcan—ifimplementedcorrectly—helpyourbusinessensurethatonlytherightpeoplehaveaccesstosensitiveinformation.Here’swhatyouneedtoknowaboutbiometricauthenticationasit’susedtoday,aswellaswhattobeawareoffor2021(andbeyond).ImportantInformationTheWebAuthenticationAPIletsyouaddbiometricauthenticationtotheweb,findoutmoreatwebauthn.me.TheBenefitsandRisksofBiometricAuthenticationBiometricauthenticationishighlyeffectiveforsecuringdataandothersensitiveinformationbecauseoftheuniquenessofbiometriccharacteristics.Notsurprisingly,Spiceworksfoundthat62%oftheenterprisestheysurveyedin2018werealreadyusingit(withanadditional24%planningtoimplementitinthenexttwoyears: ViaSpiceworksHowever,evenasmanybusinessesaremovedtoadoptbiometricauthentication,it’simportanttonotethatit’sfarfrombulletproof.Biometricauthenticationsensorscanbecostlytoimplementandaren’talways100%secure.Forexample,whenApplefirstreleasedTouchIDin2013,hackerscrackeditin48hours.Evenfacialrecognition,whichcanbecostlytoimplement,isn’tthataccurate.Furthermore,biometricdatacan’tbe“reset,”asapasswordcan.Oncebiometricdataisbreached,it’sbreachedforever,whichmeansthatcompaniesmustbeextradiligentinhowthatdataisstoredifthey’replanningtoutilizeittosecuresensitivesystems,locations,orinformation(moreonthisabitlater).6CommonTypesofBiometricAuthenticationTechnologiesThereareanumberofbiometricauthenticationsystemsinusetoday,withseveralthatarestillcurrentlybeingresearchedforwiderimplementation.Herearethecurrentandemergingtechnologiesthatyouneedtobeawareofandhowthey’recurrentlyusedtoday.ExistingBiometricTechnologiesSomeofthebiometricauthenticationtechnologiesbelowareonesthatyoumightusedaily.Othersmaybelesscommon(orlessobvious).Belowarethefourmostcommonusecasesforbiometricauthenticationtechnologyintoday’sworld:FingerprintRecognition:Fingerprintauthenticationusesaperson’suniquefingerprinttoverifytheiridentity.It’soneofthemostwidespreadbiometricauthenticationtechnologiesandisusedtosecureeverythingfrommobiledevicestoautomobilesandevenbuildings.Cheapfingerprintscannerscancostaslittleas$50.FaceRecognition:Facialrecognitionsystemsuseaperson’suniquefacialanatomytoidentifythem.It’susedinavarietyofplaces,suchassmartphones,identityverificationforcreditcardpayments,lawenforcement,andisevenusedtopurchasefriedchickeninChina.Retina/IrisRecognition:Retinaoririsrecognitionusestheuniquepatternofsomeone’sirisorretinatoidentifythem.Thistypeofbiometricauthenticationishardertoimplement(andthereforelesscommon)becauseanirisscanrequiresaninfraredlightsource,acamerathatcanseeIR,andminimallightpollutioninordertoensureaccuracy.However,itisoneofthemostaccuratebiometricauthenticationsystemsavailablewhenthoseconditionsaremet.Soit’stypicallyusedinsituationswheresecurityismostcritical(nuclearresearchfacilities,forinstance).VoiceBiometry:Voicebiometry(orvoicerecognitionimplementedforcybersecuritypurposes)usestheuniquetone,pitch,andfrequenciesofsomeone’svoicetoauthenticatethem.Today,thisismostcommonlyusedtoverifyuserswhentheycontactacallcenterforcustomerservicesupport(onlinebanking,forexample).EmergingBiometricTechnologiesThetwobiometricauthenticationmethodsbelowaren’taswidespreadyet,buttheyarewellontheirwaytobecomingmorecommon:GaitRecognition:Gaitrecognitionusesthewaysomeonewalkstoidentifythem.Sinceeachpersonwalksalittledifferently,thewaytheyputonefootinfrontofanotherisaneffectivewaytoverifytheiridentity.Weexpectgaitrecognition(andothertechnologieslikeit)tobecomemorecommoninthefutureasformsofcontinuousauthenticationbecomemorepopular(moreonthistrendbelow).VeinRecognition:Veinrecognitionusestheuniquepatternofbloodvesselsinaperson’shand(ortheirfinger)toidentifythem.Itusesinfraredlighttomaptheveinsundertheskininyourhandsorfingers.Veinrecognitionisextremelyaccurate(moresothanretina/iris)andoneofthemostcutting-edgebiometricidentificationsystemstoday.BiometricAuthenticationTrendsfor2021Whilemanycompanieshavestartedincorporatingbiometricsintotheirsecuritymeasures,thefullscopeofimplementationisconstantlygrowingandmorphing(asarethesecurityrisksinvolvedwithdoingso).Herearethetrendstobeawareoffor2021andbeyond.1.ContinuousbiometricsecurityimprovementisamustEventhoughbiometricauthenticationisconsideredmoresecurethantraditionalpasswords,hackersarealwayslookingfor(andfinding)newwaystocrackbiometricauthenticationsystems.Soifyouimplementthemtosecureyoursystemsordata,it’simportantthatyoualwaysimproveyourauthenticationsecuritytomatchnewthreats.Mastercard’sIdentityCheckMobile(frequentlyreferredtoas“SelfiePay”)isagreatexampleofwhycontinuousimprovementissocritical.UsersoriginallyconfirmedanonlinepaymentbysnappingaselfieintheMastercardapp,anditusedfacialrecognitionsoftwaretoverifytheiridentity: ImageviaMastercard However,Mastercardfiguredoutthatyoucouldeasilybypassthisprocesssimplybyholdingupastaticphotoofsomeone’sface.Sothecompanytookthingsastepfurtherandstartedrequiringuserstoblinktoconfirmitreallywastheirfaceintheframe.Thatsmallchangemadeitfarmoredifficulttofraudulentlycircumnavigatetheauthenticationprocess.Eventhemostsecurebiometricauthenticationmeasureshavegaps(forexample,researcherswereabletocreateawaxhandthateasilybypassedveinauthenticationscanners).Soifyou’regoingtoutilizebiometrics,it’simportanttofindthesegaps(andplugthem)beforecybercriminalsdo.2.ContinuousBiometricauthenticationwillcontinuetogaintractionContinuousauthenticationreferstoauthenticationthathappensonarollingbasis(andlocksyououtwhenthecriteriaforvalidationarenolongermet).Manysecurityexpertsexpectbiometricstobemorewidelyincorporatedintocontinuousauthenticationprocessesasthezero-trustmindsetbecomesthenormacrossthecybersecurityindustry.Predominantlybecausecontinuousauthenticationcreatesabetteruserexperienceandbecauseusersprefertousebiometricauthenticationsystemsratherthanpasswords.Continuousauthenticationistypicallyachievedbycalculatingan“authenticationscore”inrealtimethatreflectsthelikelihoodthatauseriswhotheysaytheyare.Forexample,somemoderncarsalreadyusecontinuousauthenticationwiththeirkeyfobs.Whenyouwalkawayfromcertaincarswiththekeyfobinyourpocket,thedoorslock,andthecarwillnolongerstart.Andwhenyoureturn,thecarwilloftenunlockitselfonyourarrival.Thisensuresthatonlythepersonwiththekeyfob(whichshouldbeanauthorizeduserunlessthekeyisstolen)hasaccess.However,incorporatingbiometricidentifiers(likeaperson’sgaitorface)orbehavioralcharacteristics(datafromanapp,forinstance)intothekeyfobwouldaddanotherlayerofassurancethatthepersonusingadeviceorpieceofsoftwareisstillwhotheysaytheyare."Biometricdatacan’tbe“reset,”asapasswordcan.Oncebiometricdataisbreached,it’sbreachedforever."TweetThisThatway,iftheperson’sgaitwereincorrectastheywalkeduptothecar,thecarcouldsecureitselfbecauseitwouldknowthatthewrongpersonhadthekeyfob.3.RegulationsaroundbiometricdataaretighteningBiometricauthenticationisstillarelativelynewtechnology,andcurrentregulationsaroundthemareverymuchaworkinprogress.However,giventhesensitive(andpermanent)natureofbiometricdata,manyregulatorsarequicklymovingtofirmuplegislationonhowthatdataiscollectedandstored.Forexample,IllinoishasbeenaleaderinbiometricdataprivacysincetheyfirstenactedtheIllinoisBiometricInformationPrivacyActin2008,whichgrantsusersa“propertyinterest”inthealgorithmsthatareusedtoestablishtheirdigitalidentities.ButtheIllinoisSupremeCourttookthisastepfurtherin2019andruledthatprivatecompaniescouldnolongercollectbiometricdata,includingfingerprints,irisscans,andfacialscans,fromindividualswithouttheirconsent(probablybecausetherehavealreadybeenover100suitsfiledaboutallegedviolationsofthislaw).Anumberofotherstates,includingTexasandWashington,followedinIllinois’footsteps,implementingmorecomprehensivelegislationaroundbiometricdatasecurityin2019aswell.It’slikelythattheremainingstatescouldquicklyfollowsuit.Soit’sincreasinglyimportantforcompanieswhousebiometricauthenticationsystemstostayuptospeedonnational,state,andindustryregulationstoensurethatthey’reincompliancemovingforward.BiometricAuthenticationIstheFutureAsurveyconductedbyVisafoundthat86%ofconsumersactuallywantedtousebiometricsratherthantraditionalpasswordstoverifytheiridentity.Andalthoughauthenticationusingbiometriccharacteristicsisfarmoresecurethanrelyingonpasswordsalone,it’salsofarfromimpenetrable.Socompanieshavetostayaheadofthecurvetoensuresecurity.Ifyou’reoverwhelmedbyintroducingbiometricsforyourownauthenticationprocesses,workingwithatrustedplatformcanhelp.Outsourcingaportion—orall—ofyouridentitymanagementcangiveyoupeaceofmind,knowingyouhaveanexpertteamdedicatedtoauthentication24/7.Auth0makesiteasytousebiometricsformultifactorauthentication(MFA).We’reheretohelpwithanyquestionsyoumayhaveaboutimplementingitforyourbusiness.Getintouch!AboutAuth0TheAuth0IdentityPlatform,aproductunitwithinOkta,takesamodernapproachtoidentityandenablesorganizationstoprovidesecureaccesstoanyapplication,foranyuser.Auth0isahighlycustomizableplatformthatisassimpleasdevelopmentteamswant,andasflexibleastheyneed.Safeguardingbillionsoflogintransactionseachmonth,Auth0deliversconvenience,privacy,andsecuritysocustomerscanfocusoninnovation.Formoreinformation,visithttps://auth0.com.DiegoPozaHeadofContentSystemEngineer,geek,foodie,technologylover,speaker.ViewProfileDiegoPozaHeadofContentSystemEngineer,geek,foodie,technologylover,speaker.ViewProfileMorelikethisBreaches11oftheWorstDataBreachesinMediaPaymentsTheFutureofPaymentsin2019PracticalPrivacyPracticalPrivacy:AGuideforEveryoneFollowtheconversationPoweredbytheAuth0Community.Signupnowtojointhediscussion.Communitylinkswillopeninanewwindow.