Picking and Choosing Biometrics

Mar 1, 2008 12:00 PM, By MICHAEL FICKES

All of a sudden, everyone is getting biometric access control. The federal government is installing systems in offices across the United States. Federal government suppliers are installing systems in their facilities, as are state and local governments.

Maybe that's not everyone, but it is a lot of organizations. Should you follow along? Do you need biometric technology to support your access control system? If so, what kind of biometric technology will serve your needs?

The federal government's access control systems use a technology protocol called the Federal Information Processing Standard 201 (FIPS 201). FIPS 201 technology operates with smart cards and includes two biometric characteristics. Should you install a tested and proven system such as FIPS 201?

If you are a federal government supplier, you might consider it. Many are. If you work with major government contractors, it might be a good idea too since there is a good chance that these contractors will install FIPS 201 systems. It also makes sense for state and local governments and their suppliers to consider FIPS 201 technology.

If you are none of the above, then you should probably think about whether or not you need biometrics in the first place.

When biometric security technology makes sense

Identification credentials, often in the form of magnetic stripe swipe cards, proximity cards and smart cards, form the core of traditional access control systems. Employees carry cards and present them to readers. If the security department has authorized the card to open the door, the door opens. For many companies, this traditional method of access control works just fine.

Some companies, however, need to know if the person presenting the card to the reader is the same person to whom the card was issued. “The big biometrics driver is the need to conclusively tie cardholders to cards,” says Robert Allen, vice president for marketing and business development with Fidelica Microsystems Inc. in Milpitas, Calif. “If someone finds your card, he or she won't be able to use it because only the card-owner's fingerprint enables the card to work.”

Companies that need to tie cardholders to cards include multinational corporations that employ thousands of people who come and go regularly from many different facilities. “I think you will see these companies going to a smart card-embedded with fingerprints or a facial template that can be analyzed by a facial recognition system,” says James W. Ziglar, president and chief executive officer of Cross Match Technologies Inc., a Palm Beach Gardens, Fla., provider of high-end biometric security technologies. “Many will probably follow the FIPS 201 model that the federal government has adopted.”

Other candidates for biometric systems that tie cardholders to cards include companies with intellectual property or sensitive data. A pharmaceutical company, for example, might add a biometric to card-accessible doors inside its facilities. A card will provide access to the front door. But it will take a card and a biometric to get into sensitive research laboratories.

Financial services companies have similar concerns about controlling physical access to doors within their facilities in order to protect confidential data such as customer credit card numbers. The same is true of healthcare facilities that must protect the privacy of patients and patient data under the Health Insurance Portability and Accountability Act (HIPAA) of 1996.

“Today, the federal government is the biggest user of biometrics,” says Fidelica's Allen. “We're also seeing a lot of law firms using biometrics to protect confidential client information.”

Get rid of ID cards

Biometric systems also make it possible to eliminate cards or other physical credentials. If a system recognizes an individual's fingerprint or handprint, a company may be able to do away with cards and their accompanying expense.

However, such a system would require the company to store employee biometrics in a central database. Current security policies have moved away from storing biometrics out of fears that the database might be compromised.

For some companies, security is not an issue. Instead, the role of biometrics is to prevent the abuse of time-and-attendance records. Many manufacturers today provide hand-recognition biometric systems enabling employees to clock into work at the beginning of the day and clock out at the end of the day. The benefit is that employees can no longer clock in and out for friends by using their cards. To clock in, employees must physically go to work. ID cards typically aren't used in this application.

“Time-and-attendance is a huge and growing market,” says Terry Wheeler, president and chief operating officer with Tampa-based Identica Holdings Corp., which specializes in vascular pattern-matching biometrics. “Time theft is an important issue for many companies. Biometric systems eliminate that problem.”

Still another biometric access control application has to do with keeping people out instead of letting them in. Casino security operations, for instance, maintain photographic records of cheaters, thieves, card-counters and others kept confidential. Facial recognition biometric systems can recognize faces on the “do not admit” list when they appear at the door.

“Biometrics also provides utility,” says Vic Berger, a technologist with CDW-G of Vernon Hills, Ill., a value-added reseller of security and other technology systems. “There are network environments that require users to have lots of passwords. At the Department of Defense, for instance, some users need to access more than 20 systems. Policy requires them to refresh their passwords every 90 days. It becomes virtually impossible to manage the passwords without writing them down, which violates policy.”

Want to use this article? Click here for options!
© 2008 Penton Media Inc.

This month in Access Control

• Opening Up About Door Closers
• An Enterprise Approach
• The Framework For Open Systems
• On A Higher Plane
• More from April's issue