- In 19.4, we're gonna be talking about biometrics.
Now biometrics are physical,
or behavioral human characteristics that can be used
to digitally identify a person.
We talked about this in the last lesson.
Now biometric options are physiological markers,
which are what you are,
or behavioral traits which is what you do.
So, let's look at some of those physiological markers,
and behavioral traits.
Fingerprint, retinal that's your eye, iris also your eye,
your vein in your hand or your palm, facial, voice print,
handwriting and and gait,
which is really just a fancy way of saying walking.
The fingerprint is the unique patterns of finger ridges
and valleys.
Retinal is the unique structure of capillaries that supply
the retina with blood.
The iris is your unique color and iris patterns.
And vein is unique vein patterns in your palm
and in your fingers.
I think this is just so amazing with the billions of people
in the world, right, that we have unique fingerprints,
unique retinal, iris, and vein patterns.
Then we have facial,
which is identification based on facial features,
such as an arrangement of your eyes, your nose, your mouth.
And there's definitely still some issues
with facial recognition in terms of how it recognizes people
of color, women, and children.
Voice print is the unique vocal attributes
including anatomical, pitch, and speaking patterns.
Your handwriting is an analysis of the shape, the speed,
the stroke, the pen pressure, and the timing.
And gait is your walking characteristics,
such as step length,
step width, walking speed, even joint rotation, and angle.
So, fingerprint, retinal, iris, vein,
and facial are all physiological, they're what you are.
Voice print, handwriting,
and gait are all behavioral, right,
behavioral being what you do.
Now, biometric authentication offers several advantages
over traditional authentication methods like passwords
and pins.
Well, first off, biometric markers and traits are unique
to each individual, and they're really difficult to forge.
So, it provides a higher level of security,
and it helps prevent identity theft or unauthorized access.
And biometric authentication is really convenient for users,
as they don't need to remember anything,
and they don't need to carry any additional credentials
like a token, or a smart card.
The biometric adoption's been interesting.
You know, it's traditionally been influenced by cost,
enrollment time, and user acceptance.
And for a long time, people were very, very hesitant
of enrolling in a biometric system.
There was just a, I don't want you to have my information,
it just felt a little creepy,
and people just didn't seem to want to do it.
And then when Apple introduced biometric recognition
on their devices, first your finger and then now your face,
all of a sudden, adoption just took right off.
People all of a sudden became much more comfortable
with it.
The first thing that needs to happen when someone
is going to be using a biometric system
is that we have to enroll them.
Now during the enrollment process,
the biometric registration system
will take multiple measurements
and goes through a series of validation processes.
Now those measurements are either hashed,
or encrypted and they need to be obviously stored securely.
But of note is that biometric systems
may inadvertently detect drug usage, illness, and pregnancy.
And that facial recognition is error prone
within certain racial and age groups.
So, in a biometric system, we get to fine tune it.
And we have some options here.
We can fine tune it for errors versus sensitivity.
What we really want to do is find the sweet spot in terms
of our user community.
Now, we may have other situations
where we look to have less secure, well,
probably never less security, but more security.
So, what does that really mean?
Well, there are two things we need to consider
in our biometric accuracy and when we're fine tuning.
One is security, right?
How much security do we need?
Which is really how sensitive
do we want that biometric system to be?
The second is user frustration.
If our users are having trouble logging in,
how quickly are they going to get frustrated
and how much is that going to be a problem?
So, security and frustration,
those are two things we're going to focus in on.
And we have two types of errors.
We have what's known as false reject rates or FRRs,
also called type one errors.
And in a type one error,
what's happening is a user is legitimate,
but when they go to authenticate,
their credentials aren't being accepted.
Whether it's a finger or eye or facial, they're saying, no,
that's not you.
And that's because we have fine-tuned the system to be
so sensitive, right,
that any little change might make a difference.
The second is false accept rates or FAR,
which are type two errors.
And that's when we have detuned the system,
it is so desensitized that we accept someone
who's kind of close, right?
It doesn't have to be an exact match.
And so, we have these false exceptions.
Now, where they match, we can see here in the middle,
where they match is referred to as the crossover error rate.
And that's generally the sweet spot
that in most organizations we're going to tune to,
where our false reject rate or our type one errors
and our false accept rate or type two errors cross.
Again, that's known as a crossover error rate.
Now, that's not always going to be true.
There may be some times, perhaps,
in your data center that you're willing
to have a little bit more user frustration
to have a higher level of security.
Now, we really need to make sure
that we are securely storing biometric data.
Because biometric data, if compromised,
can't be changed like a password.
I can't give you a new finger, I can't give you a new eye.
I can't give you a new face.
So biometric data must be securely stored.
Now since biometric data is used
for uniquely identifying an individual,
it should be considered PII,
personally identifiable information,
and it does require privacy protection in accordance
with applicable laws and regulations.
Additionally, any information revealed during enrollment,
or while in use such as pregnancy,
or illness must be kept confidential.
That my friends brings us to a three-second challenge.
Five challenge questions, three seconds each.
Let's do it.
The biometric what you are.
What is that?
One, two, three.
That's gonna be a physiological marker.
Number two, biometric what you do?
One, two, three.
That's a behavioral trait.
Number three, the intersection
of FRR, that's false reject rate,
and FAR, that's false accept rate,
what is that intersection or that sweet spot called?
One, two, three.
And that was your crossover error rate,
or your CER.
Number four, a behavioral trait that includes pitch
and speaking patterns.
One, two, three, that's going to be your voice print,
or your voice recognition.
And number five, last one, physiological marker that relies
on the unique structure of capillaries.
One, two, three, and that's going to be a retinal scan.
All right, that brings us to a security in action
about biometric tuning.
And I may have given you a hint to this one already.
Your organization is implementing biometric authentication.
End user systems will have facial recognition.
The data center entry will have palm scanning.
Now, the goal is to balance user acceptance and security.
So, what would you recommend using for tuning options?
We really have two different types
of markers we're going to be tuning for, right?
One is for facial recognition
and the other is for palm scanning, end-users facial,
data center, palm.
So, the question to you is,
what would you recommend for tuning options?
Go ahead and put me on pause.
Come back with your tuning recommendations.
Well, the first step is to define the security requirements
and the tolerance for error.
For end-user systems, in order to balance security
and user acceptance, you would probably recommend tuning
to the CER, the crossover error rate.
That's where the FRR and the FAR kind of cross.
That's that middle sweet spot.
Now, you're going to do the same thing
for the data center though?
Well for the data center,
one can assume that there is a need
to enhance security and a higher tolerance
for type one errors,
false reject rate errors,
in which case you would probably recommend tuning
to a greater sensitivity level.
So really looking at your environment and saying, okay,
this is what my end users need to get
into their end user system.
But boy, we probably need a different level of security
for getting into our data center.
And so, tuning each of those appropriately.
Doing that, definitely security in action.
There's your word cloud.
This is a really big one.
So, take your time, go through it,
make sure you recognize all the terms
and concepts before moving on.
And when you're ready, head to the next lesson.
I'll be waiting for you there.