Pass your certification exam. Faster. Guaranteed.

Biometrics Transcription

Welcome to our biometric authentication systems module. When we talk about biometric systems configuration, these systems rely on measuring physical characteristics of a individual to uniquely identify that person. We want to rely on characteristics that do not change often, because if they change, that would require the user to re-enroll in the system.

There are metrics in place to determine the best biometric system for our needs. When we are considering the cost of a biometric system, we have to determine and consider the initial cost, as well as the total cost of ownership. And this is true whenever we're purchasing a system.

The initial cost could be a certain amount, but we have to consider any maintenance, and other ownership costs that will be on an ongoing basis when we're considering the total cost of ownership. We also have to discuss the crossover error rate, which is very important. This is abbreviated as CER and we'll discuss this on a later slide.

We should consider the time that it will take for us to enroll each of our users. We want a system that makes it easy to enroll our users because we don't wanna spend a significant amount of time enrolling every individual, especially if we have a large number of users in our company.

We also have to think about the time that it will take to verify the credentials. For example, if you require users to place their fingerprint on a sensor before entering the building and it takes 30 seconds per user, you'll have quite a line of employees that are waiting outside of your building to get in the morning.

So all of these are important to determine when we're looking at biometric systems. We also wanna make sure that our system is socially acceptable. There are some concerns with biometrics, of user privacy. And also some health concerns with iris and retina scans because users are required to put their eye up to a sensor, where other users have had their face, and there are some concerns about contamination.

The enrollment process for our biometrics is where we store the physical attributes relating to an individual user. These attributes are stored in a reference file. When the user is attempting to access a system or access a physical location, the attributes they provide at that time are compared to the information stored in the reference file.

If the information matches, the user is granted access to the building or to the system. If the information does not match then the user is denied entry because it is assumed that they are not the person that is authorized to access that system. During the authentication process, we are looking at highly detailed information relating to that individual, whether it's their fingerprint, where their retina or their iris or some other feature that they've provided during the enrollment process.

This means we can have two different types of errors that occur during the process. The type one error is where we reject someone who is authorized to enter the system in error. This is also known as the false reject rate, or FRR. A type two error is where we accept an impostor, an individual who should not have access to our system is granted access in error.

This is also known as a false acceptance rate, or FAR. It's important to remember that the false acceptance rate, or type two error, is the more egregious error, because we've now allowed an unauthorized person to access our system or our facility. With a type one error, we have rejected one of our own employees which, although it is inconvenient, it is not allowing an unauthorized person to access our environment.

This is important to remember for the CISSP examination because you will most likely see questions that discuss the false accept rate and the false reject rate. One way to remember this is that a type one error, there is one c in the word reject. And for a type two error, there's two c's in the word accept, and you'll also want to remember that the type two error is the more egregious error because we've let an unauthorized person into our system.

The crossover error rate for biometric devices is also known as the CER. This rating is used to help you to determine what and is an acceptable biometric device for your environment. The crossover error rate is the point at which the type one errors and the type two errors meet.

When you're looking at the crossover error rate, it's important to remember for the examination that a lower number is better. Typically with computers, we're always looking for higher number when it relates to our processor speed or our memory. Usually our specs, higher number is better. But here, the lower number is better.

You wanna remember that for the examination because you may see a question that asks about the crossover error rate. This concludes our biometric authentication systems module. Thank you for watching.