Today, our physical characteristics are becoming the key to digital authentication, gradually replacing PINs and passwords. With many services becoming digital and automated, our unique biometric data is becoming a vital element in unlocking them. Biometric authentication is used to access mobile phones, personal and corporate laptops, industrial systems, commercial and government offices – but the number and the variety of applications for these technologies is growing. Whether customers are unlocking a shared vehicle using a fingerprint scanner or accessing their Spotify or Netflix account via facial recognition, biometrics enable developers to create detailed, digital customer profiles and a truly seamless user experience. The popularity of solutions such as Apple’s TouchID can certainly be considered proof that biometrics are well trusted by consumers – but should they be?
While the use of fingerprint or facial recognition for device authentication is now commonplace on smartphones and tablets, it’s not just the biometrics that you see on your device. Biometrics can be embedded within a multitude of devices, including GPS, touch screens and cameras. However, despite biometrics becoming increasingly popular among everyday consumers, there are still risks to individuals around fraud and identity theft. Based on its growing popularity, it’s safe to assume that biometric authentication is here to stay. But its rising prevalence also comes with rising concerns about the technology’s level of security, and the possible implications that can stem from it if compromised. It is therefore extremely important to elevate the conversation now within the relevant industries to educate consumers and develop a collaborative approach to ensure this data is protected.
Securing biometric authentication for the future
Biometric identification is playing a growing role in our everyday security. Physical characteristics are relatively fixed and individualised — even in the case of twins. Each person’s unique biometric identity can be used to replace or at least augment password systems for computers, phones, and restricted access rooms and buildings. Given the importance of authentication in online transactions, and the key role played by passwords in authentication, this is data that cybercriminals have been consistently interested in since the advent of online transactions.
New technologies are always vulnerable — because they are new. Biometric data stored by a service provider is just as valuable a target for cybercriminals as a database containing usernames and passwords. Any security breach resulting in leakage of this information is likely to have much more serious consequences than the theft of a password: after all, we can change a weak password or PIN, but we cannot change a compromised fingerprint, or other biometric. There are also privacy implications of replacing an ID to verify someone’s age with biometrics.
Biometric data, unlike a username or password, is persistent: we carry it with us for life. Therefore, it’s important that people are informed about the way biometric data is used and held, and under what circumstances it might be passed on to other agencies. Biometrics of all kinds are an effective way of identifying a customer, but this technology should be used as a secondary protection method that complements other security measures rather than replaces them completely. People should have the ability to use technologies free from worries, unnecessary limitations and other obstacles brought by cybersecurity risks.
Biometrics will become an increasing part of authentication options, with more sophisticated technologies and approaches to secure its development in the future. The use of behavioural biometrics for authentication can make a real difference – making the task of authenticating almost frictionless. Behavioural biometrics also enable the financial industry to view the user activity, analysing typical navigation and time patterns, how the user acts and their interaction with the device, including mouse movements, clicks, touches, swipe speeds and more, to detect whether a device is being used by a legitimate user or not. The technology is also often used to detect either a bot or script. For example, the financial industry uses behavioural biometrics to help distinguish between legitimate users and cybercriminals, identifying people by how they behave and interact online rather than by static information or physical characteristics.
Are we entering the age of biometrics?
Biometric technology has the potential to be used in a variety of sectors and provides endless opportunities for innovation. Use of biometrics on mobile devices is becoming increasingly common, as most recent smartphone models have at least one built-in mechanism for biometric authentication. Biometrics has become so embedded in our devices and the way we live that it is almost invisible to the end consumer. However, it’s important that these security vulnerabilities are made visible – and then eliminated, before we entrust sensitive data unsafely.
As these concerns are addressed, we can expect to see adoption of biometric technology increase significantly, like the adoption patterns of other technology such as smartphones and online banking. For example, people were initially wary of online banking, but now it’s hard to find anyone who doesn’t bank online. There will always be early adopters of new technologies, but in time biometric technology will become mainstream across all industries. After all, the possibilities are endless.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.