Topics in this domain
- Security Governance and Roles
- Data Classification and Ownership
- Security Policies
- Privacy Principles and GDPR
- Identity Management
- Authentication Factors
- Biometrics
- Access Models: DAC, MAC, RBAC
- Logical and Privileged Access
- Cryptography Basics
- Symmetric Encryption
- Asymmetric Encryption
- Hashing and Integrity
- Digital Signatures
- PKI and Certificates
- Firewalls
- IDS/IPS
- VPN, SSL/TLS, IPsec
- Wireless Security
- Endpoint and Mobile (BYOD)
- Cloud and Virtualization Security
- Physical Access Controls
- Environmental Controls: Fire, Power, HVAC
- Social Engineering
- Malware
- Network Attacks: DoS, Spoofing, Sniffing
- Application Attacks: SQLi, XSS
- Vulnerability Management and Pen Testing
- Incident Response
- Digital Forensics and Chain of Custody
- Security Awareness Training
- Logging, SIEM, and Auditing Security
Biometrics
Your body as a key
Unlocking your phone with your face or thumb is biometrics. When you set it up, the phone records your features as a template. Each time you unlock it, it compares a fresh scan with the template and lets you in if they’re close enough.
- Enrolment: after your identity is checked, your characteristic is captured several times and stored as a template.
- Verification: a new sample is compared with the template. If the match score passes the threshold, you’re in.
“Close enough” is the tricky bit. No two scans are ever identical, so the system has to decide how strict to be.
Two kinds of mistake
| Measure | Meaning |
|---|---|
| False rejection rate (FRR), type I error | How often genuine users are wrongly rejected |
| False acceptance rate (FAR), type II error | How often impostors are wrongly accepted |
| Crossover error rate (CER), or equal error rate (EER) | The point where FAR and FRR are equal |
For security, false acceptance is the serious one: an impostor gets in. False rejection mainly annoys people and hurts productivity.
The crossover error rate
- Make the system stricter and fewer impostors get in (FAR falls), but more genuine users are rejected (FRR rises).
- Make it looser and the opposite happens.
- Where the two lines cross is the CER. It’s the best single number for comparing systems, and lower is better.
Types of biometric
Physiological (what your body is), generally more accurate:
- Retina scan: the blood vessel pattern at the back of the eye. Very accurate, but intrusive, so user acceptance is low.
- Iris scan: patterns in the coloured part of the eye. Very accurate, less intrusive.
- Fingerprint: widely used and accepted.
- Palm vein and hand geometry.
- Face recognition: convenient, but affected by lighting and ageing, with privacy concerns.
Behavioural (what you do), generally less accurate: voice, signature dynamics, keystroke dynamics.
Risks of data you can’t change
You can reset a password. You can’t reset a fingerprint.
- Spoofing with photos, moulds or recordings: use liveness detection.
- Template theft: templates are sensitive personal data. Encrypt them, store them securely (ideally on the device), and don’t keep raw images.
- Privacy: biometric data is special category data under GDPR, needing a legal basis and safeguards.
- Replay attacks: protect the link between the reader and the matcher.
- Single factor: for high security, combine biometrics with another factor.
Example. A data centre’s fingerprint readers reject authorised staff several times a day, so the security team lowers the sensitivity. Complaints stop, but the FAR rises. The auditor asks whether the change was risk-assessed, and recommends a second factor (badge plus fingerprint) instead of lowering sensitivity.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most important biometric performance measure | Crossover / equal error rate (lower is better) |
| Most serious biometric error for security | False acceptance (type II) |
| Type I error | False rejection |
| Effect of increasing sensitivity | Lower FAR, higher FRR |
| Highly accurate but least accepted biometric | Retina scan |
| Control against spoofed fingerprints | Liveness detection |
In short
- Biometric systems enrol a user's characteristic as a template and compare later samples against it.
- False rejection rate (FRR, type I error) is how often legitimate users are rejected; false acceptance rate (FAR, type II error) is how often impostors are accepted.
- Raising sensitivity lowers FAR but raises FRR; lowering it does the opposite.
- The crossover (equal) error rate, CER or EER, is where FAR equals FRR; the lower the CER, the more accurate the system.
- From a security perspective, false acceptance is the most serious error.
- Physiological biometrics (fingerprint, iris, retina, face, palm) are generally more accurate than behavioural ones (voice, signature, keystroke).
- Biometric data is sensitive personal data and can't be changed if compromised; templates must be protected.
Exam traps
- Type I = false rejection; Type II = false acceptance. Type II is worse for security.
- Best overall measure of accuracy: CER. Lower is better.
- Retina scanning is highly accurate but intrusive, with low user acceptance.
- Biometrics should usually be combined with another factor, not used alone for high-security access.
- Liveness detection is needed to resist spoofing with photos, moulds or recordings.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The crossover error rate
Exam tipTighten sensitivity: fewer impostors, more real users rejected. CER is the best single measure for comparing systems; lower is better.
Types of biometric
Risks of data you can't change
ExampleData centre fingerprint readers keep rejecting staff, so security lowers the sensitivity. Complaints stop, but false acceptance rises. Better: keep sensitivity and add a badge as a second factor.
1 / 9