Point/Counterpoint - Biometrics and the future of Advanced Authentication
Recently, I had the opportunity to sit down with Morey Haber, VP of Technology, BeyondTrust to discuss the future of biometrics and the role it played in advanced authentication techniques. While the general theme of the discussion is the role biometrics plays in an enterprise, we also touch on separating authentication from authorization, considerations of deploying a biometric solution, and new types of biometric-related authentication.
Part 1: Point/Counterpoint: The Current State and Future of Biometrics - Part One
Part 2: Point/Counterpoint: The Current State and Future of Biometrics - Part Two
Throughout Part 1, the term authorization is used in multiple places and on first glance, appears to be a misuse of the term. I fundamentally don't understand how biometrics could ever be considered authorization unless you are intermixing security and financial services terms. For example, authorization of a transaction is still and authentication process whereby I provide my identity for the purposes of non-repudiation/acknowledgement of the action. Further proof of identity through increased interaction (e.g. password and then biometrics) is still authentication. As the separation of authn and authz is integral to the article, could you please define the terms as you use them through? They seem to run counter to traditional definitions.
Cybersecurity Founder, Advisor, and Professor
9 年Thanks John - as always. My daydream prediction is that we will have a huge breakthrough if and when we can find a "biometric trap door algorithm". In other words something biometric that can be shared like a public key and used to encrypt things in a way that only the "donor" can decrypt using a different biological attribute. Right now, everything is symmetric and just silly from a cryptographic perspective. Securing things with your retina or fingerprint means you have to expose that "symmetric key" directly to every new fly-by-night vendor you want to work with. If, on the other hand, you could speak a sentence and have your vocal pattern used to encrypt something that could only be decrypted by your unique sense of hearing, we would be onto something big.