Add a biometric basket for your authentication eggs, says vendor

Identity management is failing because it focuses on effectively authenticating devices without biometrically authenticating the person operating an accepted device, according to a veteran industry executive.

Jay Meier, recently hired as one of FaceTec‘s regional senior vice presidents, is pushing for a system that “binds a privilege to an actual, legal identity rather than to a device that we presume to trust is being held by (the person with) that legal identity.”

FaceTec claims to collect from two-dimensional images the kind of data found in 3D facial recognition and liveness. Adding liveness-confirmed biometric ID proofing, enrolling and user authenticating processes, according to Meier, to current steps is required to avoid theft and fraud.

He was speaking about identity management as part of a video interview posted by Scytáles, which develops mobile driving licenses.

Identity managers and CEOs know that it is not enough to be certain about devices seeking access because there typically is no way to be certain about who holds the device.

But, Meier said, deterministic decisions are binary. The device is or is not entitled to access resources, or system privileges. If device authentication is doing its job, there is 100 percent certainty in the decision.

Hearing 100 percent certainty is attractive to CEOs who prefer to think of any decision that is not strategic be binary whenever possible.

Biometrics is a probabilistic matter. Getting to 100 percent certainty through machine vision, for example, is not a realistic expectation.

Binding a privilege to a legal identity rather than, or at least in combination with, device authentication is the best way today to secure systems and data, particularly remotely, he said.

Biometric Update last week published a post by Meier making this point.

In it, he cited a Verizon survey indicating that weak authentication of people resulted in 85 percent of all breaches last year.

Meier used an example that is hard to ignore — the SolarWinds attack. Criminals executed remote access trojan malware in a supply chain exploit that succeeded despite strong device authentication. The hackers exploited weaker user authentication to great success.

Article Topics

authentication  |  biometric liveness detection  |  biometrics  |  digital identity  |  FaceTec  |  facial authentication  |  identity management  |  identity verification  |  mobile device  |  Scytáles