What are biometrics?

Biometrics are physical or behavioral characteristics unique to each person. They are used to verify an individual's identity, for instance to ensure only an authorized person can access corporate applications and other network resources. Biometric authentication relies on the distinctiveness of these biological or behavioral traits, which are difficult to replicate.

Types of biometrics

There are two major categories of biometrics: static and behavioral.

Static biometrics

Static biometrics use physical features, such as a fingerprint scan or facial recognition, to unlock mobile phones, log in to bank accounts, or make transactions. Static biometrics are considered a secure way to authenticate customers.

Here are the main types of static biometrics used to verify your identity:

• Facial recognition software
  • Analyzes the distance between your eyes, chin, and nose to create an encrypted digital model of your face. When authenticating you, the facial recognition software will scan your face in real time and compare it to the digital model securely stored within the system.
  • Facial recognition systems with “active liveness detection” require you to move your head, blink, or perform other movements. Liveness detection can also be passive, working behind the scenes using algorithms to analyze biometric samples for signs that they’re not from a live person, such as detecting paper, digital screens, or facial image cutouts in a 3D-printed mask.
  • Strong liveness detection ensures that it’s the actual customer presenting their biometric sample to the system and not an attacker trying to impersonate the individual in a presentation attack.
• Fingerprint recognition
  • One of the most popular forms of biometric authentication, if not the most popular, is fingerprint recognition used on mobile devices – originally popularized by Apple’s Touch ID on the iPhone.
  • A fingerprint reader analyzes the ridges and patterns of your fingerprint and compares it against the stored digital model of your finger during authentication.
  • Fingerprint recognition can change if your finger is wet or dirty. It’s challenging for an attacker to replicate an individual’s fingerprint when a fingerprint recognition system has strong liveness detection to help prevent presentation attacks, which could use a 3D model or fake image.
• Iris recognition
  • There are two methods of eye scanning to authenticate a person’s identity. In a retinal scan, a light briefly shines into the eye to show the unique pattern of blood vessels in the eye. By mapping this pattern, the eye recognition tool can compare a user’s eyes against an original.
  • In an iris scan, the colored rings found in the iris are scanned. In some uses, eye recognition can be as fast and accurate as face recognition, but getting a sample for comparison in sunlight can be difficult when pupils contract. Iris recognition can also be less reliable when a customer wears glasses.
• Voice recognition
  • Analyzes the unique sound of a person’s voice, determined by the length of their vocal tract and the shape of their nose, mouth, and larynx.
  • Analyzing a person’s voice is a strong method of authentication, but a cold, bronchitis, other illnesses, and background noise can distort the voice and disrupt authentication.
• Finger geometry recognition
  •  It uses the 3D geometry of the finger for identity verification. This method relies on the physical characteristics and measurements of the finger, such as the length and width of the finger, as well as the shape and curvature of the finger's surface.
  • The process involves:
    • Capturing an image or scan of the finger
    • Extracting geometric features from the image
    • Creating a template based on these features
  • Fingerprint recognition systems are more commonly used than finger or hand geometry recognition systems. Specialized applications such as physical access control (e.g., door locks or secure entry systems) primarily use the latter.
    • Keystroke rhythm: This analyzes the manner and speed of your typing to determine distinctive patterns. There is a pattern to the amount of pressure you put on the keys while typing, for example.
    • How you hold your phone: This analyzes the angle at which you hold your phone and the dominant hand you use when swiping or interacting with your phone.
    • Your gait: How you walk is also a behavioral trait that can be studied for a pattern.
    • You usual habits: In addition, your usual time and location for logins and transactions can also be put into a behavioral pattern.

Behavioral biometrics are a seamless experience for customers but challenging for fraudsters and hackers because each individual has a specific profile of their habits and movements.

How do biometrics work?

A biometric system comprises three distinct components:

1. 1. A biometric sensor is required to record and read the biometric information, such as a fingerprint.
2. 2. For tasks like accessing a mobile phone using biometric data, there must be secure computer hardware storing the biometric information for comparison.
3. 3. Software is necessary to bridge the connection between the computer hardware and the sensor, facilitating seamless operation of the system.

This integration not only enhances security by making unauthorized access significantly more difficult but also improves the user experience by replacing traditional passwords with more intuitive and secure biometric verification methods.

Advantages of biometrics

Biometric security is gaining widespread acceptance across various sectors, thanks to its user-friendly nature and robust security features. It is a much faster and more convenient way to authenticate than typing in a password or PIN. You don’t need to create and remember a myriad of different complex passwords and you cannot forget your fingerprint, face, or palm print.

While the terms ‘biometric identification’ and ‘biometric authentication’ sound similar, they are actually used for different purposes.

• Biometric identification: Facial biometrics are part of digital identity verification, which is used to identify an unknown user or applicant applying remotely for a new account. With data breaches and identity theft on the rise, businesses need to verify that people are who they say they are online. Simple verification of an identity document is not sufficient when it comes to creating a trusted online identity profile. During remote account opening and enrollment, biometric verification provides an additional layer of trust via a live selfie that is then compared to the image in their government-issued identity document.
• Biometric authentication is used to verify a known user, for secure log-on to confidential networks and applications, for example, or to authorize financial transactions.

Biometric features are more difficult to steal or hack as opposed to traditional passwords, but they can still be compromised. That’s why we recommend using biometrics as part of a multi-factor authentication (MFA) process, where multiple technologies can be used to authenticate someone’s identity when they login to a banking session or make a financial transaction.

Are biometrics really secure?

Biometrics are more secure than traditional passwords as they use traits that are unique to each individual, making them harder to replicate or steal. But it is not a foolproof solution and still requires robust implementation alongside other security measures to address potential vulnerabilities.

A concern that regularly is expressed with biometrics is the risk of stolen or lost biometric data. Where you can change a stolen password, you cannot change your biometric traits. If biometric data is stolen or lost, the risk of mis-use of biometric data could mean your biometrics are permanently compromised.

Will biometrics stand the test of time?

Artificial intelligence (AI) and other advanced attacks will impact the difficulty of achieving secure authentication even when using biometric data. Fraudsters can use AI to develop sophisticated spoofing techniques or to exploit vulnerabilities in biometric systems.

In fact, Gartner predicts that by 2026, 30% of enterprises will consider identity verification and authentication solutions unreliable in isolation due to AI-generated deepfakes. While this prediction is alarming, it’s not the end of the road for biometric security.

Organizations should consider implementing additional security measures and not use biometrics as the single point of authentication. Deploying multi-factor authentication is key, so you don’t rely on biometrics alone to verify a user’s identity.

If one authentication method (such as the biometric data) is compromised, unauthorized access will still be blocked as another credential is required to verify your identity.

In addition to adding multiple factors to your authentication process, organizations should consider biometric security that offers robust liveness and spoof detection. These features prevent the attacker from accessing accounts by detecting the inability to mimic a legitimate customer's biometrics.

There are two types of liveness detection to identify whether a biometric trait is from a real person or is a manufactured representation:

• Active liveness detection requires a person to blink or turn their head, and passive liveness detection runs behind the scenes and uses algorithms to detect signs of potential spoofing.
• Facial comparison technologies use advanced algorithms to look at biometric data from a person’s features. For example, the position and size of a person’s eyes relative to each other can be used to determine whether the selfie and the government-issued ID are from the same person.

DIGIPASS FX1 BIO: Phishing-resistant, passwordless authentication for a secure workforce

Protect your workforce and safeguard data and applications from attacks with our latest FIDO authenticator with fingerprint scan.

Learn more

Tokenization is also a way to ensure more security as you hide biometric data in a token such as the DIGIPASS® FX1 BIO.

With DIGIPASS FX1 BIO, biometric data is stored within a secure element in the token and never leaves the device. A single dedicated security device will also be harder to hack as the attack surface is much smaller than with a mobile, which is susceptible to malware.

Finally, continuous and adaptive authentication methods are vital in countering increasingly sophisticated AI-based threats. These mechanisms evaluate various risk indicators such as user actions, contextual cues, device attributes, and more. Upon detecting a risk, they dynamically adapt authentication criteria. Through real-time monitoring of user sessions for unusual activity, these measures effectively thwart unauthorized access beyond the initial authentication stage.

Biometrics and regulatory compliance

By implementing biometric solutions, businesses can ensure adherence to stringent regulations concerning data security, identity verification, and privacy concerns. These technologies offer robust authentication measures that align with compliance requirements, providing a secure and reliable means of verifying user identities and protecting sensitive information.

The following regulations have an impact on the use of biometrics:

• PSD2 strong customer authentication requirements: Under the SCA requirements of the European Union’s Second Payment Services Directive (PSD2) regulations for electronic payment services, authentication must be based on two or more of the following factors: knowledge (such as passwords or PINs), possession (such as tokens or mobile devices), or inherence (biometrics).
• General Data Protection Regulation: Under the EU’s General Data Protection Regulation (GDPR), two-factor authentication (2FA) is required for compliance. That means a simple username and password combination no longer provides enough security for data protection since passwords can easily be stolen, shared, or exploited. Instead, two-factor authentication is used to identify a person when two of the three possible factors of authentication are combined to grant access to a website or application: something the person knows, something the person has, or something the person is (which involves the use of biometrics such as a fingerprint or facial scan).
• Health Insurance Portability and Accountability Act (HIPAA): HIPAA requires healthcare organizations to implement strong authentication measures to protect patients' electronic protected health information (ePHI). Biometric authentication, like fingerprint or iris scans, can be used as one of the authentication factors to comply with HIPAA requirements.
• National Institute of Standards and Technology (NIST) Guidelines: NIST recommends the use of multi-factor authentication (MFA), including biometrics, to enhance security in various sectors. Biometric authentication methods align with NIST guidelines and can be used as one of the factors to meet MFA requirements.
• Digital Operational Resilience Act (DORA): DORA aims to enhance the operational resilience of the EU's financial sector. DORA requires multi-factor authentication for employees. Biometric authentication can be utilized as one of the factors to comply with DORA requirements, ensuring secure access to financial systems and data.
• Network and Information Security Directive 2 (NIS2): NIS2 is an updated version of the EU's Network and Information Security Directive, which aims to enhance the cybersecurity posture of critical infrastructure operators and digital service providers. NIS2 requires strong authentication mechanisms, including multi-factor authentication. Biometric authentication methods, such as fingerprint or facial recognition, can serve as one of the authentication factors to comply with NIS2 and bolster security across critical sectors.

Blog

Europe’s DORA legislation requires financial institutions and their tech providers to authenticate employees with strong authentication by 2025.

Read more

Biometric security and OneSpan's role

Biometrics have become crucial in enhancing authentication security. The use of biometrics offers robust protection against fraud and unauthorized access, utilizing unique physical and behavioral characteristics such as fingerprints, facial recognition, and typing patterns.

Integrating OneSpan's Intelligent Adaptive Authentication effectively addresses security concerns within biometric systems. OneSpan enhances security by employing real-time risk analysis and various authentication methods, including biometrics. Its adaptive strategy adjusts security levels based on each transaction's risk, providing a strong defense against vulnerabilities.

Using OneSpan ensures compliance with regulatory standards and delivers a secure, user-friendly experience. Combining cutting-edge security with biometric authentication strengthens protection for digital identities and transactions.

To explore the possibilities and advancements in biometric technology, especially in enhancing digital security and user experience, talk to our experts. We specialize in enterprise-grade security solutions, including biometrics, and can offer insights and products to help navigate and implement these technologies effectively in your environment.

Discover how OneSpan is shaping the future of secure and seamless authentication – contact us today.