CertiGuide to Security+  9  Chapter 1:  General Security Concepts (Domain 1.0; 30%)       9  1.2  Authentication

1.2.7  Mutual Authentication 1 1.3  Non-Essential Services and Protocols

Biometrics provides authentication based on something you are (physiological) or something you do (behavioral), not something you know, such as a password.

Currently the most popular biometric mechanism involves software that measures how long you hold a key on a keyboard and the speed at which you type. This keystroke-analysis software would be an example of a behavioral biometric device, which works because your typing style is almost as unique as a fingerprint. It is popular because it is non-intrusive (as opposed to “hold still while the laser scans your eyes”) and also the least expensive option. Other behavioral biometric options include voice recognition and signature scanning. See also section 5.1.1.2 for more information on biometrics.

Physiological biometric options include fingerprint scanning, iris or retinal scanning of the eye and, as visitors to some Disney theme parks have experienced first-hand, various types of hand-scanning. APC has brought the fingerprint scanner to sub-$50 USD levels⁵⁹.

Different biometric identification mechanisms are appropriate for different situations – when authenticating employees, citizens, and customers – and not all may be perceived as acceptable in all situations (do your customers really want to be authenticated at your site with their fingerprints?)

For more information about biometrics, at a management overview level, including discussions of privacy and the uses of biometrics in various vertical markets, see the book Biometrics⁶⁰ by Nanavati et al.

1.2.7  Mutual Authentication 1 1.3  Non-Essential Services and Protocols