Biometrics prevent sleight of hand at Wells Fargo

Aug 1, 1999 12:00 PM, KATE HENRY

With its asset base of $200 billion, San Francisco-based Wells Fargo Bank regards control of access to its data facilities as critical. The global financial institution has integrated biometrics with other security systems for data protection.

Every aspect of Wells Fargo's operations is secured using a strong chain of physical security measures, including, but not limited to, dedicated security officers at retail locations and data centers, CCTV surveillance, security doors and turnstiles, on-site and remote alarm monitoring, fire and emergency services, and proximity systems for access control. Biometric hand readers are the final link in staving off fraud and crime; they secure the bank's data centers, the brains of its operations.

"We have come up with a layered approach that is complex and sophisticated," explains Ted Barron, vice president of technical security at Wells Fargo. "Communications throughout the bank's operations are interwoven and redundant. If any of the facilities go down," he says, "the duplication picks it up immediately, almost as if the systems are running in tandem."

The challenge of charting a course.

Barron has been with Wells Fargo for 12 years, experiencing its evolution from a large, regional California bank to its current status as a worldwide leader in the many financial services it offers. The scope of Barron's responsibility is bank-wide, providing risk and hazard analysis and a range of project management services.

"We were one of the first banks to use a UL-AA equivalent for network communications for our alarm systems," notes Barron. "We completed it over two years and are very happy with it, because we do not require leased lines for UL-AA transmission. We use digital monitoring from DMP, Springfield, Mo., which offers a commercially available, generic UL-AA control panel with myriad services. Security firms such as Mosler and Diebold are now offering frame-relay-based communications, as well. It's the trend of the future."

The layering of security at Wells Fargo branches is largely uniform, but because it is an international company, different products are used at different locations, explains Barron. He cites coming up with the best kind of product for a given region as an equipment challenge for security professionals. "We use whatever product a dealer in a given area can warranty," he says. "There are several philosophies about this, but basically, we can either drive a product into the market or use the market as it stands. We tend to use the market as it stands, because you get a better quality product."

Products currently used by Wells Fargo throughout its operations include Safesec doors; Sony and Ikegami cameras; and MDI, Motorola, Checkpoint and Casi-Rusco access systems. These last are integrated with HandKey hand geometry readers from Recognition Systems, Campbell, Calif., in the company's data centers to achieve proof-positive security.

Integration of biometrics.

Data centers serve as focal points for a given region, according to Barron.

About 6,000 finance and mortgage stores and the same number of branch banks are supported by these data centers nationwide. In a typical application, he explains, security personnel handle clearing of visitors at the first point of entry. Revolving doors or optical turnstiles serve as the next point of access processing. Proximity cards and PINs are required for ingress and egress through doors, and activity is monitored through the use of cameras.

But something more was needed to ensure only authorized personnel could access data centers. "I started looking at voice recognition systems when they first came out in the early '80s, so I have a long history of watching biometric systems," says Barron.

He describes the move to biometrics as more functional than preferential. "The question was, could we absolutely say that the individual coming through the door is who they say they are? Because of the number of people coming through a specific high-security area, we could not say 'yes' at all times. With the application of biometrics, we can say with 99 percent certainty that once a person is enrolled and has been checked against the biometric print, that person is who they say they are."

To access data centers, a proximity card, PIN entry and hand geometry verification are required. The hand geometry technology looks at the three-dimensional size and shape of the hand. The result of more than 90 hand measurements is converted into a nine-byte template. The template is typically stored in the scanner's resident memory and can also be transferred to other media such as computer, or magnetic, printed or smart card. The hand readers also prevent tailgating, and their quick transaction time allows high-volume use, says Barron.

He is quick to point out that the installation of biometrics was not prompted by crime or fraud problems at Wells Fargo. Rather, it was a proactive measure borne ofrecognizing hazards in the world of technology. "The systems defend against the possibility of employee or third-party trespassing into our data centers," he says.

"We work closely with the information technology people, because they are the customers buying the product, so in the end, they are the drivers of the design," Barron says. "We advise them on hazards and they advise us on certain exposures, and we supply the tools that ensure they can manage the process in a way that is smooth and trouble-free."

The IT people have been very satisfied with the HandKey systems, adds Barron. "Before the upgrade, they would have to apply manpower to ensure certain processes were being overseen. We automated the process and sped it up, and if there is anything an IT person likes, it is speed!"

Keeping pace with emerging technologies.

With more than 100,000 employees and 200 to 300 projects a year in queue, the biggest challenge facing Barron is the coordination of project management and the correct application of resources. Priorities are changing more quickly, he points out. "We have to ensure our systems continue to provide high-quality ease of operation and high security. That's no problem with the biometric equipment we use now." He points to discussion about the use of smart cards in banking applications as promising, because the cards are capable of containing biometric identifiers. "Wells Fargo is part of a consortium on testing use of fingerprint or facial recognition for ATM machines, and there are some very excited people out there, but it has yet to hit the mainstream." In such an application, a user's fingerprint or face takes the place of PIN entry as the unique identifier granting account access.

Wells Fargo Bank has been preemptive in researching smart card applications, according to Barron. It partners with a company called Mondex whose smart card has been piloted in the United States, on a large scale, he says. The biggest issue in the United States, he says, is that because of the widespread dissemination of point-of-purchase-type, magnetic-stripe readers, and because of the billions of magnetic stripe cards on the market, it is a monumental task to gain support for the use of smart cards.

"Wells Fargo has always had a history of piloting high-tech projects first," emphasizes Barron. "We are interested in any systems that will give the customer an advantage."

Want to use this article? Click here for options!
© 2008 Penton Media Inc.

This month in Access Control

• Targeting The Customer
• Electronic Pedigrees
• One Hero Among Many
• Who? What? When? Where? Why?
• More from September's issue