Magazine menu Close Magazine menu

biometrics

Latest stories

identity theft university

How one university’s stolen student IDs caused a crime wave

  • min read
    • Cybercriminals see education as an amazing opportunity. But they're not taking classes or gaining qualifications – they target universities and other educational institutions for the wealth of personal information they hold. In Tomorrow Unlocked's video The Backdoor into Campus, Royal Holloway, University of London cybersecurity experts talk about how a major identity theft incident on campus happened and how they're working to keep students and staff safe in future. How educational institutions are attacked Universities and colleges often have many people using their systems, like staff, students and visitors. They also offer many kinds of services online. Mike Johnson, Chief Information Officer at Royal Holloway, University of London, describes a recent security incident. "A staff member's credentials were stolen and used to send convincing offers of part-time work to students. Some students undertook the work and were paid. But they were overpaid, then asked to return some of the money. It was money laundering on a significant scale." Why cybercriminals love stealing identities "Commonly, we find those who try to attack us are looking to harvest identities," says Johnson. "When they've got them, they'll try to harvest more until they're sure they can attack us in the way they want to." Education can stop attacks on education It's all about authentication, says Keith Martin, Professor of Information Security at Royal Holloway, University of London: Knowing the person trying to access something online is the person they say they are. "Imagine a front door. Whoever has the key can open it. To breach that, you need to get hold of the key. Entering a country is more high security: Border control looks at credentials like a passport and the person submitting it." Professor Martin continues, "In cyberspace, it's a bigger problem because we can't see who's asking for access. The most popular authentication is a password, but passwords are like keys – easily copied or stolen. So we need to use the passport model – asking for multiple things to gain access." That's called multi-factor authentication. You'd need more than a password to gain access, such as a code sent by SMS or biometrics, like a fingerprint. Senior security researcher at Kaspersky, Noushin Shabab, says for the best security, multi-factor authentication should combine biometrics like facial recognition with another credential. Developing 'cyber common sense' in education Professor Martin says the most important thing anyone can do to keep their identity safe is to develop 'cyber common sense.' "Hesitate before doing anything in cyberspace – if you're sent a link or a message asking for information, ask, why do they want this?" Johnson feels education institutes are perfect places to learn cybersecurity awareness. "We've got to be willing to have a conversation with students about digital security and what protecting their identities means. We're educators – we're well placed to help people operate in an environment they'll operate in for a long time."
body recognition eye

The good, the bad and the ugly of biometric authentication technology

  • min read
    • Imagine never having to manually log in again or remember the credentials for a hundred different online accounts. Or, you turn up at work and get back home without having to unlock a single door. Perhaps you need to pay a visit to the local pharmacy and pick up a prescription, but instead of having to wait in line, it's discretely deposited in front of you without needing to talk to anyone. Now imagine walking into a store and being greeted by a disembodied voice that doesn't only know your name, but also the sort of things you like to buy. Things are starting to sound a little disturbing, even if we're already well-accustomed to personalized advertising on the internet. But it gets worse – imagine being flagged as a criminal until the police figure out your arrest was due to a 92 percent margin of error. Biometric identification no longer belongs to the realms of science fiction. It's part of the technologies that are defining the future of cybersecurity and wider crime prevention tactics. Already, fingerprint scanners are standard on mid- to high-end smartphones. That's the good side. As for the bad side: things like face, fingerprint, iris and voice recognition can also be considered tools of state authority; an all-out assault on personal privacy. But whether we like it or not, biometrics are here to stay, so we may as well make it useful in protecting sensitive personal or business information. The good: simplifying and securing access to digital systems There's an average of 130 accounts associated with every email address. That's a whole lot of usernames and passwords to remember. It's hardly any wonder that so many people reuse the same passwords for most, if not all, of their online accounts. To make matters worse, a lot of people also favor simple, easily memorable passwords, such as names of pets or children. Not only are these relatively easy to guess – a brute-force hacking program can usually find them in mere seconds. Then, there's the constant threat of social engineering attacks, where criminals attempt to dupe victims into giving away their login credentials over email or through a malicious website masquerading as one belonging to a legitimate organization. We have a password problem, and compromising on digital security is not an option, especially for businesses, which routinely handle sensitive information belonging to themselves and their customers. Instead, they're increasingly turning to multifactor authentication (MFA) to add another layer of security that's far harder to compromise. Chances are, you've already used it for things like online banking, or whenever you log into your email from an unrecognized device. Even after you've entered your password, the system will ask you to verify your identity with a one-time security token, such as a code sent by SMS or a disconnected token generator. But there's another method that's rapidly gaining ground – biometric identification. Many high-end smartphones and business-grade laptops already feature fingerprint scanners, and facial recognition apps are an emerging technology that's steadily making its way into the consumer market too. Other less common biometric factors include irises, palm veins and prints, retinas and even DNA. What makes biometrics different from other authentication methods is that they're inherent to the user, which means they can't be compromised by your average social engineering scam. It's also much more efficient to look at a camera instead of manually entering login information or risk saving it on a potentially unsecured device. The bad: there's no such thing as a fool-proof system Biometric identification is highly effective because we all have distinct biological characteristics which can't easily be faked or exploited – although there are exceptions, such as criminal cases featuring identical twins. Actually, that's something of a myth – while biometrics may seem secure on the surface, that doesn't make them foolproof. While a password is something that only its owner knows, your biological traits, for the most part, are very much public. You leave your fingerprints everywhere you go, your voice can be recorded and your face is probably stored in hundreds of places, ranging from social media to law enforcement databases. If those databases are compromised, a hackers could gain access to your biometric data. There's no such thing as a system that's 100 percent secure, and there never will be. Any kind of digital data can be hacked and misappropriated. And, contrary to popular belief, it can even be faked. Just a day after the release of the iPhone 5, which featured the TouchID fingerprint scanner, a German hacking group managed to create a fake finger to unlock the devices. Sure, the technology has improved in the past seven years since that happened, but there's a big difference between improvement and perfection. Five years later, the same hacking group managed to crack the iris recognition in the Samsung S8 simply by placing a contact lens over a high-definition photo of an eye. The ugly: If you're hacked, there's no going back The fact that biometric data can be hacked can have far wider consequences, some of which are extremely worrying from both a security and privacy standpoint. If your password is stolen, then you can usually just reset it and choose a new one. If a hacker has a photo of your iris, you can't replace your eye – unless of course, you're Tom Cruise's character John Anderton in Minority Report, where he has an eye transplant to hide his true identity. Now, while hackers usually prefer less conspicuous methods than stealing body parts to access secure systems, it's a fact that biometrics can be abused and, once they are, there's no going back. Although biometric technologies are getting better all the time, there will always be a margin of error, which presents concerns for both security and privacy. The security concern is that, like any other identification method, biometric identification isn't perfect and never will be. From a privacy perspective, you could be misidentified as a criminal, and there's a good chance you'll remain in the system long after the misunderstanding has been resolved. Another issue is that, since they're created by people, biometric recognition is innately biased. Most facial recognition systems, for example, are primarily trained with images of white males, which results in higher margins of error for women and people of color. This uglier side to biometrics presents serious challenges for businesses, since they need to store biometric data as securely as possible. If the system is hacked, those affected will face an increased risk of hacking for the rest of their lives. In other words, they'll never be able to rely on biometric security again. This gives businesses, as well as governments and other organizations which rely on biometrics, enormous ethical and financial responsibilities. That's why it's important to consider where the biometric data is stored and to give its owners control over how it's used. A secure future without compromising privacy There's a line between security and privacy that shouldn't be crossed. The biggest challenge lies in figuring out exactly where this line is. Government-mandated regulations for the storage and use of biometric data are already being developed to protect personal privacy and security. For example, the Supreme Court of Illinois, US, recently ruled unanimously that employees should retain the right to know how their biometric data is collected and used, and that companies should only do so with opt-in consent. That biometrics are, for the most part, immutable, is both its biggest advantage and worst drawback. While it potentially provides an effective additional layer of security, it can also be a single point of failure – with potentially disastrous consequences. There's no denying it offers convenience and a high level of security, but it also paves the way for oppressive regimes and technology companies alike to infiltrate yet another aspect of our personal lives. With privacy being the concern of the century, businesses must be mindful about which technologies they choose to adopt and how. This article represents the personal opinion of the author.
business innovation privacy

Nurturing innovation does more for privacy than strict regulation

  • min read
    • Every day, privacy commentators and activists point to new technology using our private data in ways we don't expect. It feels like innovation and privacy are in a constant power struggle. To move forward, we need both. If privacy policy changes tack, we can have just that. Privacy has come a long way Privacy has evolved into the social norm we know today, and it still varies between cultures and countries. Before industrialization, there was little social privacy – extended families shared one house (often one room) and neighbors entered each other's homes freely. Other people probably knew about everything you did. Our expectations of social privacy have increased alongside technological development, and in many cases, the technology itself has given us more privacy. We may even feel more comfortable sharing personal information online than offline because online, we feel we have more ways to manage our privacy. Is regulation the right way to protect privacy? European Union (EU) policymakers seem sure regulation like General Data Protection Regulation (GDPR) guard online privacy and increases public trust in, and use of, digital technology. In 2018 Vĕra Jourová, then EU Commissioner for Justice, Consumers and Gender Equality said, "The new rules are beginning to set a global standard for privacy. They will help to bring back the trust we need to be successful in a global digital economy." Evidence doesn't seem to agree. Regulation makes little or no difference to whether people use technology. According to European Commission opinion polls' Eurobarometer, in 2018 – the year GDPR came into effect – Europeans' online consumer trust fell to its lowest in a decade. The Commission says giving consumers new rights will empower them to control their data. Still, in 2019, Eurobarometer showed four in five Europeans felt they have no or only partial control over the information they give online. If regulation isn't the answer, we need businesses to approach their privacy challenges proactively. How do people really behave around privacy? Kaspersky's Global Privacy Research 2020 found about a third of people surveyed had their private information improperly accessed. Nearly a third of those cases meant consequences like financial loss or emotional distress. What are people doing to protect themselves? Not as much as they could. Only 41 percent protect their web browsing and 37 percent prevent others from using their devices. More than one in four store passwords in ways cybercriminals can easily find. Asking users to confirm they've read and accepted terms every time they visit a website would frustrate people more than improve their understanding. A 2019 Eurobarometer survey looking at Europeans' data sharing and protection views and behaviors found just over one in five say they're always informed about personal data collection and use conditions. But only 13 percent said they fully read privacy statements. If regulation won't improve our privacy, what will? Education is important in real empowerment. Developing our sense of how to become 'good digital citizens' would likely improve trust and awareness of privacy. Individually, each business can ensure their digital user experience – how easily users can find and use features of a site or application – enables privacy. People respond well to a shared visual trust language: Lock icons to show a secure process, warning labels to flag suspicious content and ticks for verified profiles. Well-communicated standards help businesses avoid unintended effects of adopting new technologies, like compliance and legal costs. For example, if there are concerns insurance companies might use genetic information to set premiums or deny coverage, policymakers could simply prohibit them from using it. Then insurers could focus on protecting consumers, knowing they're behaving responsibly in the eyes of regulators. Technology changes faster than social values. It makes sense for the regulator to create rules that reflect our values and protect individuals from harm rather than blocking technology and its benefits. Regulators must ask questions about new technologies, like where you can fly your drone or how you can use neural implants. Businesses and trade associations are increasingly held accountable and required to explain what new technologies will achieve and how they'll use and protect personal data. Can we have biometric authentication as well as privacy? Consumers like the convenience of biometric authentication, such as MasterCard's Selfie Pay and Samsung's iris scanning. Facial recognition is good for controlling access to the likes of public transport, smart buildings and devices. It's faster and more convenient than codes or keycards and prevents 'tailgating' – when an uninvited person slips in behind an authenticated visitor. Commercial demand for ways to apply biometric authentication keeps growing, from securing homes to ensuring hospitals give patients the right treatment. It has strong public support – in the US, only one in four (26 percent) wants the government to limit use of facial recognition. Some systems perform better than others. An often cited example is how some facial recognition systems fail to accurately identify ethnicity. Understandably, people expect regulators to set limits on its surveillance use and safeguard human rights. GDPR and California Consumer Privacy Act (CCPA) have imposed some restrictions. With this tech in its infancy, legislation that restricts or bans it may halt its further development to benefit society. Instead, regulating to limit potential misuse or abuse will improve public trust and encourage the commercial sector to develop, test and share best practices. There are cybersecurity concerns as biometrics evolve. These must be considered and tested as part of security design. Better policy guidance, and clear and common cybersecurity standards can help companies address security. Policymakers should encourage those developing innovative solutions to protect data, including using artificial intelligence (AI). Integrated with products like medical implants, autonomous vehicles and drones, AI's use in healthcare, education and government is fast growing. We face previous cybersecurity challenges alongside new threats. Adversaries can add malicious code to data that trains machine learning or bypass facial recognition to get access. Vulnerabilities like these need investigating. We need regulators and businesses to work together Businesses need regulation to innovate in ways that serve society. Some outdated, disproportionate laws mean companies using emerging technologies fear sanctions for non-compliance with rules which were designed to address past problems. Business leaders must keep up to date with proposed legislation and public sentiment. They must work with regulators to evolve laws, and proactively tackle privacy and security concerns. Now digital transformation is business as usual, it's critical that clear guidance helps them know how they can respect customers' privacy and protect their data. This article reflects the opinion of its author. Article published in May, 2020.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries