The accuracy of biometric systems should be considered before implementing a biometric control program. Three metrics are used to judge biometric accuracy: the False Reject Rate (FRR), the False Accept Rate (FAR), and the Crossover Error Rate (CER).
False reject rate
A false rejection occurs when an authorized subject is rejected by the biometric system as unauthorized. False rejections are also called a Type I error. False rejections cause frustration of the authorized users, reduction in work due to poor access conditions, and expenditure of resources to revalidate authorized users.
False accept rate
A false acceptance occurs when an unauthorized subject is accepted as valid. If an organization’s biometric control is producing a lot of false rejections, the overall control might have to lower the accuracy of the system by lessening the amount of data it collects when authenticating subjects. When the data points are lowered, the organization risks an increase in the false acceptance rate. The organization risks an unauthorized user gaining access. This type of error is also called a Type II error.
Crunch Time
A false accept is worse than a false reject: most organizations would prefer to reject authentic subjects to accepting impostors. FARs (Type II errors) are worse than FRRs (Type I errors). Two is greater than one, which will help you remember that FAR is Type II, which are worse than Type I (FRRs).
Crossover Error Rate
The Crossover Error Rate (CER) describes the point where the False Reject Rate (FRR) and False Accept Rate (FAR) are equal. CER is also known as the Equal Error Rate (EER). The Crossover Error Rate describes the overall accuracy of a biometric system.
As the sensitivity of a biometric system increases, FRRs will rise and FARs will drop. Conversely, as the sensitivity is lowered, FRRs will drop and FARs will rise. Figure 1.2 shows a graph depicting the FAR versus the FRR. The CER is the intersection of both lines of the graph as shown in Figure 1.2, based on the ISACA Biometric Auditing Guide, G36.5
Domain 5
Eric Conrad, … Joshua Feldman, in Eleventh Hour CISSP® (Third Edition), 2017
Crossover error rate
The CER describes the point where the FRR and FAR are equal. CER is also known as the equal error rate (EER). The CER describes the overall accuracy of a biometric system.
As the sensitivity of a biometric system increases, FRRs will rise and FARs will drop. Conversely, as the sensitivity is lowered, FRRs will drop and FARs will rise. Fig. 5.1 shows a graph depicting the FAR versus the FRR. The CER is the intersection of both lines of the graph as shown in Fig. 5.1, based on the 2007 ISACA Biometric Auditing Guide, #G36.2
Fig. 5.1. Crossover error rate.
Domain 1
Eric Conrad, … Joshua Feldman, in CISSP Study Guide (Second Edition), 2012
Crossover error rate (CER)
The crossover error rate describes the point where the false reject rate (FRR) and false accept rate (FAR) are equal. CER is also known as the equal error rate (EER). The crossover error rate describes the overall accuracy of a biometric system.
As the sensitivity of a biometric system increases, FRRs will rise and FARs will drop. Conversely, as the sensitivity is lowered, FRRs will drop and FARs will rise. Figure 2.11 shows a graph depicting FARs versus FRRs. The CER is the intersection of both lines of the graph shown in Figure 2.11, which is based on the ISACA IS Auditing Guideline G36: Biometric Controls [13].
Figure 2.11. Crossover Error Rate.
Resources
Laura Taylor, Matthew Shepherd Technical Editor, in FISMA Certification and Accreditation Handbook, 2007
Acronyms
- AIS
-
Automated Information Systems
- ALE
-
Annual Loss Expectancy
- ARO
-
Annualized Rate of Occurrence
- ATO
-
Authority to Operate
- BIA
-
Business Impact Assessment
- CER
-
Cross-over Error Rate
- CIO
- C&A
-
Certification and Accreditation
- CMT
-
Cryptographic Module Testing
- CMVP
-
Cryptographic Module Validation Program
- CSIRC
-
Computer Security Incidence Response Center
- DAA
-
Designated Approving Authority
- DCID
-
Director of Central Intelligence Directive
- DISA
-
Defense Information Systems Agency
-
Defense Information Technology Systems Certification and Accreditation Process
- DoD
-
Department of Defense
- FAR
- FEMA
- FIPS
-
Federal Information Processing Standard
- FISMA
- FRR
- FTA
-
Failure to Acquire
- FTE
-
Failure to Enroll
- GAO
- HIPAA
- IATO
-
Interim Authority to Operate
- IG
-
Inspector General
- IT
-
Information Technology
- LAFE
-
Local Annual Frequency Estimate
- NIACAP
-
National Information Assurance Certification and Accreditation Process
- NIST
-
National Institute of Standards and Technology
- NSTISSC
-
National Security Telecommunications and Information Systems Security Committee
- OIG
-
Office of Inspector General
- OMB
-
Office of Management and Budget
- PDA
- POA&M
-
Plan of Action & Milestones
- RBAC
-
Role-based Access Control
- SAFE
-
Standard Annual Frequency Estimate
- SAISO
-
Senior Agency Information Security Officer
- SBU
-
Sensitive But Unclassified
- SLE
- ST&E
-
Security Test & Evaluation
Independent Assessor Audit Guide
Laura P. Taylor, in FISMA Compliance Handbook, 2013
Testing biometrics
If the system is using biometric devices, the False Acceptance Rates (FAR), the False Reject Rates (FRR), and the Cross-over Error Rates (CER) should be tested. A biometric device is more accurate and reliable as the CER goes down and you will want to establish acceptable thresholds in your test plan. Other metrics to take into consideration for biometrics include the Failure to Enroll (FTE) rate and the Failure to Acquire (FTA) rate. FTE denotes the amount of people who are not able to use the system due to some sort of incompatibility and FTA denotes the number of users who are not able to render an acceptable enrollment image to use the device.
Securing Biometric Devices
The following list explains the various rates that should be tested whenever you use biometric devices.
- •
-
FAR = the percent of unauthorized users incorrectly matched to a valid user’s biometric
- •
-
FRR = the percent of incorrectly rejected valid users
- •
-
CER = the error rate at which FAR equals FRR
- •
-
FTA = the failure to acquire rate
- •
-
FTE = the failure to enroll rate
Performing the Security Tests and Evaluation
Laura Taylor, Matthew Shepherd Technical Editor, in FISMA Certification and Accreditation Handbook, 2007
Confidentiality Tests
Confidentiality tests determine if unauthorized disclosure is possible. When you perform confidentiality tests, you are trying to determine if data is disclosed to people that it is not intended for. You are also trying to determine that data is readable and executable by the people it is intended for.
Before you can set up tests to ensure confidentiality, you have to understand a bit about confidentiality risks and vulnerabilities. Data traveling in plaintext over communications lines is vulnerable to sniffing. Weak passwords can be compromised using password crackers. Confidentiality tests look to ensure that authentication and encryption mechanisms work according to the security requirements. It’s also important to ensure that the authentication and encryption mechanisms have not just been implemented, but that they have safeguards built around them to protect them from being sabotaged.
If you have reason to believe “shoulder surfing” is a risk, then a security policy should be written that requires all users to be partitioned from other users. If you have reason to believe social engineering (tricking a user into revealing information to unauthorized individuals) is a risk, you should be sure to address that in your Security Awareness & Training Plan. If you believe that cryptographic algorithms may not have been implemented correctly, you should use only products that have passed FIPS 140-2 testing performed using the Cryptographic Module Validation Program (CMVP).1
If password files exist, you may want to perform a test to ensure that the passwords are properly encrypted and the encrypted passwords are not easily discovered using a dictionary password cracker. You’ll also want to ensure that the permissions on the password files are set correctly and are not writeable to the world.
If you are using biometric devices, you will want to be sure to test the False Acceptance Rates (FAR), the False Reject Rates (FRR), and the Crossover Error Rates (CER). A biometric device is more accurate and reliable as the CER goes down and you will want to establish acceptable thresholds in your test plan. Other metrics to take into consideration for biometrics include the Failure to Enroll (FTE) rate and the Failure to Acquire (FTA) rate. FTE denotes the amount of people who are not able to use the system due to some sort of incompatibility and FTA denotes the number of users who are not able to render an acceptable enrollment image to use the device.
ST&E Best Practices…
Securing Biometric Devices
The following list explains the various rates that should be tested whenever you use biometric devices.
- ▪
-
FAR = the percent of unauthorized users incorrectly matched to a valid user’s biometric
- ▪
-
FRR = the percent of incorrectly rejected valid users
- ▪
-
CER = the error rate at which FAR equals FRR
- ▪
-
FTA = the failure to acquire rate
- ▪
-
FTE = the failure to enroll rate
If VPNs are a part of the infrastructure that you are certifying, you’ll need to devise some tests to ensure that the VPN has been properly configured and cannot be penetrated by unauthorized users. You’ll also need to clearly describe whether the VPNs being tested are secure remote access VPNs (used by remote users) or end-to-end VPNs that encrypt all traffic that goes between designated sites. VPNs can be configured to pass packets in tunnel mode, transport mode, or both. Which modes does your security policy require? You’ll need to ensure that VPNs are configured in accordance with your security policy.
Confidentiality problems that you’ll want to check for include:
- ▪
-
Passwords that do not comply with the security policy
- ▪
-
Authentication systems that are not properly configured
- ▪
-
Use of algorithms that do not comply with the security policy
- ▪
-
Secure implementations of encryption products (VPNs, PKI, etc.)
- ▪
-
Implementations that do not produce logging capabilities
To help you understand how to test for confidentiality, construct questions regarding confidentiality security controls. For example:
- 1.
-
What security controls ensure that passwords comply with the security policy?
- 2.
-
What security controls ensure that authentication systems are properly configured?
- 3.
-
What security controls ensure that algorithms comply with the security policy?
- 4.
-
What security controls check for proper configuration of encryption products?
- 5.
-
What security controls ensure that authentication and encryption systems produce log files that comply with the security policy?
By answering these questions, you can put together a list of security controls that address confidentiality mechanisms. Your confidentiality security controls can be managerial, operational, or technical in nature. Once you have developed your list of security controls, you can devise tests for them.
Domain 1: Access Control
Eric Conrad, … Joshua Feldman, in Eleventh Hour CISSP (Second Edition), 2014
Type 3 authentication: something you are
Type 3 authentication (something you are) is biometrics, which uses physical characteristics as a means of identification or authentication. Biometrics may be used to establish an identity or to authenticate (prove an identity claim). For example, an airport facial recognition system may be used to establish the identity of a known terrorist, and a fingerprint scanner may be used to authenticate the identity of a subject (who makes the identity claim and then swipes his or her finger to prove it).
Biometric enrollment and throughput
Enrollment describes the process of registering with a biometric system: creating an account for the first time. Users typically provide their username (identity), a password or PIN, and then provide biometric information, such as swiping fingerprints on a fingerprint reader or having a photograph taken of their irises. Enrollment is a one-time process that should take 2 minutes or less.
Throughput describes the process of authenticating to a biometric system. This is also called the biometric system response time. A typical throughput is 6-10 seconds.
Accuracy of biometric systems
The accuracy of biometric systems should be considered before implementing a biometric control program. Three metrics are used to judge biometric accuracy: the False Reject Rate (FRR), the False Accept Rate (FAR), and the Crossover Error Rate (CER).
False reject rate
A false rejection occurs when an authorized subject is rejected by the biometric system as unauthorized. False rejections are also called a Type I error. False rejections cause frustration of the authorized users, reduction in work due to poor access conditions, and expenditure of resources to revalidate authorized users.
False accept rate
A false acceptance occurs when an unauthorized subject is accepted as valid. If an organization’s biometric control is producing a lot of false rejections, the overall control might have to lower the accuracy of the system by lessening the amount of data it collects when authenticating subjects. When the data points are lowered, the organization risks an increase in the false acceptance rate. The organization risks an unauthorized user gaining access. This type of error is also called a Type II error.
Crunch Time
A false accept is worse than a false reject: most organizations would prefer to reject authentic subjects to accepting impostors. FARs (Type II errors) are worse than FRRs (Type I errors). Two is greater than one, which will help you remember that FAR is Type II, which are worse than Type I (FRRs).
Crossover Error Rate
The Crossover Error Rate (CER) describes the point where the False Reject Rate (FRR) and False Accept Rate (FAR) are equal. CER is also known as the Equal Error Rate (EER). The Crossover Error Rate describes the overall accuracy of a biometric system.
As the sensitivity of a biometric system increases, FRRs will rise and FARs will drop. Conversely, as the sensitivity is lowered, FRRs will drop and FARs will rise. Figure 1.2 shows a graph depicting the FAR versus the FRR. The CER is the intersection of both lines of the graph as shown in Figure 1.2, based on the ISACA Biometric Auditing Guide, G36.5
Figure 1.2. Crossover error rate.
Types of biometric controls
There are a number of biometric controls used today. Below are the major implementations and their specific pros and cons with regard to access control security.
Fingerprints
Fingerprints are the most widely used biometric control available today. Smartcards can carry fingerprint information. Many U.S. Government office buildings rely on fingerprint authentication for physical access to the facility. Examples include smart keyboards, which require users to present a fingerprint to unlock the computer’s screen saver.
The data used for storing each person’s fingerprint must be of a small enough size to be used for authentication. This data is a mathematical representation of fingerprint minutiae, specific details of fingerprint friction ridges, which include whorls, ridges, bifurcation, and others. Figure 1.3 shows minutiae types (from left) bifurcation, ridge ending, core, and delta.6
Figure 1.3. Fingerprint minutiae.10
Retina scan
A retina scan is a laser scan of the capillaries that feed the retina of the back of the eye. This can seem personally intrusive because the light beam must directly enter the pupil, and the user usually needs to press their eye up to a laser scanner eyecup. The laser scan maps the blood vessels of the retina. Health information of the user can be gained through a retina scan: conditions such as pregnancy and diabetes can be determined, which may raise legitimate privacy issues. Because of the need for close proximity of the scanner in a retina scan, exchange of bodily fluids is possible when using retina scanning as a means of access control.
Exam Warning
Retina scans are rarely used because of health risks and invasion-of-privacy issues. Alternatives should be considered for biometric controls that risk exchange of bodily fluid or raise legitimate privacy concerns.
Iris scan
An iris scan is a passive biometric control. A camera takes a picture of the iris (the colored portion of the eye) and then compares photos within the authentication database. This also works through contact lenses and glasses. Each person’s two irises are unique, even twins’ irises. Benefits of iris scans include high-accuracy, passive scanning (which may be accomplished without the subject’s knowledge), and no exchange of bodily fluids.
Hand geometry
In hand geometry biometric control, measurements are taken from specific points on the subject’s hand: “The devices use a simple concept of measuring and recording the length, width, thickness, and surface area of an individual’s hand while guided on a plate.”7 Hand geometry devices are fairly simple and can store information in as little as 9 bytes.
Keyboard dynamics
Keyboard dynamics refers to how hard a person presses each key and the rhythm by which the keys are pressed. Surprisingly, this type of access control is cheap to implement and can be effective. As people learn how to type and use a computer keyboard, they develop specific habits that are difficult to impersonate, although not impossible.
Dynamic signature
Dynamic signatures measure the process by which someone signs his or her name. This process is similar to keyboard dynamics, except that this method measures the handwriting of the subjects while they sign their name. Measuring time, pressure, loops in the signature, and beginning and ending points all help to ensure the user is authentic.
Voiceprint
A voiceprint measures the subject’s tone of voice while stating a specific sentence or phrase. This type of access control is vulnerable to replay attacks (replaying a recorded voice), so other access controls must be implemented along with the voiceprint. One such control requires subjects to state random words, protecting against an attacker playing prerecorded specific phrases. Another issue is people’s voices may substantially change due to illness, resulting in a false rejection.
Facial scan
Facial scan technology has greatly improved over the past few years. Facial scanning (also called facial recognition) is the process of passively taking a picture of a subject’s face and comparing that picture to a list stored in a database. Although not frequently used for biometric authentication control due to the high cost, law enforcement and security agencies use facial recognition and scanning technologies for biometric identification to improve security of high-valued, publicly accessible targets.