Biometrics and information security management systems

November 2010 Cyber Security

Biometrics goes far beyond physical access control.

Charlie Stewart of biometric application specialists, SuperVision Biometric Systems, says that information security management systems (ISMS) and data loss prevention (DLP) are currently some of the hottest topics in IT. He thinks that is hardly surprising given the rise in IT-related crime in the workplace and the fact that insiders are increasingly committing it.

Stewart points out that, “A couple of heavyweight surveys recently reaffirmed the fact that insiders are now committing most of the economic crime within organisations. Two global surveys, by Ernst and Young and Price Waterhouse Coopers, highlight the fact that insider crime is on the increase and is being fuelled by the economic downturn.

“We see there being another factor that is driving the growth of insider crime: passwords. Organisations simply have to stop using them.”

Migrating biometrics into ISMS

Having worked with biometrics for many years, Stewart is familiar with their application in physical access control and time and attendance solutions. As he points out, “For several years now, we have been replacing traditional cards, passwords and PINs with biometrics. In a huge diversity of workplaces, they are an accepted component of physical access control and workforce management solutions.”

So why has it taken so long for biometrics to migrate into IT security? For Stewart, the answer is that there has been a lack of competent software to allow professional integration of biometrics within IT systems: “Consequently, we had to develop our own: SuperSign. And that did not happen overnight. There are several years of development work behind our password replacement solution and we have had to spend a lot of time in Europe and the States in order to perfect it.”

Stewart stresses that first and foremost SuperSign is an IT security solution that provides a deterrent and a protection against insider crime: “We use Morpho MSO 1300 readers because biometrics are the only technology that can link who did what, where and when within an IT system. It is a deterrent because of the unbreakable bond it forms between users and their transactions. It is a protection because it enables the most stringent access controls.”

Data loss prevention

DLP is a hot topic because of the challenges increasingly presented by increased data mobility. For Stewart, this does not just mean the mobility enabled by portable devices or the Cloud: Sometimes referred to as ‘information leakage’, data security is certainly not a new problem and people have been battling with it for years. Its roots lie in the fact that digital information is mobile by its very nature. The Information Security Forum provides a wealth of insight into how leakage occurs and ways to prevent it happening.

The Forum describes information leakage as “an incident where the confidentiality of information has been compromised, typically as the result of unintentional insider action. The disclosure of business information outside of its intended audience has been an information security-related issue for many years, but the term information leakage has recently seen increasing use in the media, who are keen to draw attention to high profile breaches of confidentiality in large public and private organisations.”

As Stewart points out, “The insider who accesses your PC or laptop without permission may not necessarily have major criminal intent but could just be a sneaky snooper. It is not always about someone trying to rip you off.

“Data-loss threats will vary from company to company, but the simple fact remains that traditional passwords and PINs create massive vulnerabilities. These can be exploited intentionally by the criminally-minded, or lead to inadvertent losses through people doing things they are not trained or authorised to do.”

Passwords: the root of all data evil?

Controlling access to devices, data, applications and networks has traditionally been a complex challenge for IT departments. As authorisations alter to meet changing business requirements, users and administrators struggle with antiquated processes for managing user-names, PINs and passwords.

Not only are the old processes time-consuming and costly, their shortcomings actively encourage all of us to simplify sign-ons by writing passwords on post-it notes, re-using the same logon credentials or sharing passwords. Driven by the need for speed and convenience, this activity is routine and happens every day in offices all over the place.

Unauthorised access to IT systems through the abuse of passwords, PINs and usernames is universal and extremely damaging. Stewart highlights some of the dangers as follows:

* Illicit payments.

* Unauthorised access and transmission of information.

* Loss of confidentiality.

* Unauthorised changes and deletions.

* Loss of operating capacity and costs of downtime.

* Increased recovery and system restoration costs.

Biometric sign-on: keep it simple

Stewart believes that eliminating the serious dangers and losses from these wide-ranging threats has to start by addressing the gaping hole in IT security: passwords. “SuperSign replaces passwords and PINs with fingerprints and it integrates with most applications, including web applications, with no custom scripting or development.”

Very often, IT managers are rightfully concerned about the addition of applications and solutions to their existing infrastructures. Stewart fully understands this and that is why he stresses: “Start with straightforward biometric sign-on. This will not instantly close all the loopholes in your IT security, but it is the first step in implementing a solution that can then be extended to deliver other, organisation-specific benefits.”

Although SuperSign can be used with a range of traditional cards, tokens and credentials, Stewart sees fingerprints as being the obvious platform for securing IT systems: “Biometric sign-on is just as fast as using passwords – if you can remember them all – but that is where the similarities end. No replacements, minimal administration and they form an irrefutable link between the user and the systems they accessed.

“With absolute certainty, biometric based sign-on links the user to their transaction. By doing this, it creates a powerful monitoring and audit trail – who did what, where and when. Fingerprints really can make passwords and all the damage they cause a thing of the past.”

For more information contact Supervision Biometric Systems, +27 (0)21 913 6075,

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Cybersecurity for video surveillance systems
September 2019 , Cyber Security, CCTV, Surveillance & Remote Monitoring
Video surveillance systems are increasingly accessible over any IP network, which has led to the rise of potential cyberattack.

Cyber-securing your surveillance infrastructure
September 2019, Genetec, Hikvision South Africa , Editor's Choice, CCTV, Surveillance & Remote Monitoring, Cyber Security
When it comes to cybersecurity, understanding the risks and the solutions as well as engaging in open communication helps everyone.

Cybersecure surveillance partnership
September 2019, Bosch Building Technologies, Genetec , Cyber Security, CCTV, Surveillance & Remote Monitoring
With Bosch and Genetec, you can feel confident that your data is protected by one of the world?s best security solutions, end to end, day after day.

Keeping your things to yourself
October 2019, Technews Publishing , Editor's Choice, Cyber Security, Integrated Solutions, IT infrastructure
Three experts spoke to Hi-Tech Security Solutions to offer advice on keeping your IoT working for you and not for cyber criminals.

IoT in security
October 2019, Duxbury Networking, Technews Publishing , Editor's Choice, Cyber Security, Integrated Solutions, IT infrastructure
Using the Internet of Things is not really optional these days, but securing the Internet of Things is compulsory, no matter what industry you operate in.

Your business needs synchronised security
September 2019 , Cyber Security, Products
This complete security portfolio from Sophos offers endpoint, servers, firewall, Wi-Fi, mobile, email and encryption that is fully scalable to grow as your business does.

NFa2p security certification
October 2019 , News, Cyber Security
Advisor Advanced obtains the highest level of certification to the NFa2p Electronic Security Standard for a complete security system.

SOAR an essential part for security operations
October 2019 , Editor's Choice, Cyber Security, Security Services & Risk Management
MJ Strydom, MD of cybersecurity specialist company DRS discusses the challenges around the security incident response lifecycle.

Stalkerware on the increase
October 2019, Kaspersky Lab , Cyber Security
The number of users that encountered stalkerware (commercial spyware often used as a tool for domestic espionage) increased by 35% to 37 000 in 2019.

Reductor malware hijacks HTTPS traffic
October 2019, Kaspersky Lab , Editor's Choice, Cyber Security, News
Kaspersky researchers have discovered new malware that hijacks victims' interaction with HTTPS web pages in the process of establishing encrypted communication between the user and the website.