Biometric hardware gives agencies choice for authentication
When the Office of Management and Budget's directive for securing remote devices talks about two-factor security, what it means is 'another factor other than password protection.' At most agencies, the other factor will likely be biometrics.
Passwords have been a part of computer security since the earliest of days, and are now embedded on every system, whether portable or desktop.
But passwords can be broken, sometimes easily. Users who need a lot of passwords for different systems or applications often create easily remembered'and easily guessed'passwords. A second layer of protection, especially for remote systems, would protect access to government servers even if a password is guessed.
The easiest way for government agencies to comply with the memo would be to add biometric security to remote systems. Most biometric systems can be added to a notebook PC simply by plugging them into a USB port and enrolling valid users.
The new emphasis on security could not come at a better time for the biometric industry, which until very recently has struggled to gain acceptance in the government. Many early devices were cursed with poor accuracy rates, and hackers'using techniques as simple as shining a flashlight onto a sensor where an authorized user had just left a fingerprint'were able to defeat seemingly ironclad security measures. The middleware for biometrics also was vulnerable in many cases, leading hackers to simply ignore the front-end sensor and gain access to systems using the back-end database.
That all started to change in 2005, and biometrics really started hitting high marks in all areas of performance in 2006. New technology such as optical/silicon hybrid sensors for fingerprint readers pushed up accuracy. And entirely new sensor types, such as those that could see the blood vessels in your hand, burst onto the scene. There is even new software to help secure the back-end data and tie all the sensors together into a real network.
The GCN Lab reviewed 10 biometric devices last year and found that, while there still were good and not-so-good tools out there, that, industry has for the most part gotten its act together.
And just as biometrics has come a long way in a few short years, we're starting to see more encryption embedded into commercial products as well. In 2006, we reviewed software that encrypts data on the desktop, on CDs and for remote log-in. And new for this year, Microsoft Windows Vista will include BitLocker, a feature that can be used to encrypt all data on the hard drive.
Here is that review, along with some other biometrics reviews of 2006:
Here is some 2006 coverage on encryption devices: