-: Biometric readers.
Biometrics rely on physical characteristics
to identify a person properly.
This is most commonly done by using your fingerprints,
by scanning the retina inside your eye,
or by measuring the distance
between different parts of your face.
Now, if you remember all the way back
to section one of this course,
we talked about the five factors of authentication.
This was something you know, something you have,
something you are, something you do,
and somewhere you are.
Now, when we talk about biometrics,
we're focused on that third factor: something you are.
Because this is some part of you.
It's your eye, it's your fingerprint, it's your voice,
it's something that is innately
part of your ability and part of your person.
Now, when we talk about fingerprints,
fingerprints have become
a very common identification system.
At this point, it's even gone beyond door locks,
and it's now integrated into our smartphones
and our laptops for log in.
For example, if you have an iPhone between a 5s model
all the way up through the eight series,
those have a thumbprint login called touch ID.
Whenever you press your index finger
or your thumb to the sensor, it will log you in.
Now, the newest iPhones have done away with touch ID
in favor of face ID.
So, if you have an iPhone X or newer,
they actually have the front-facing camera scan your face
and measure the distance between
different areas of your face to uniquely identify you.
This allows you to just hold up the phone in front
and it logs you in automatically
by identifying that it is you that's holding the phone.
These types of devices are also being integrated,
into door locks and physical access control systems,
like man traps.
I used to work in one high security area
where every day you had to use a retina scan
to gain access to the facility.
I've also worked in places that have used
a fingerprint and a PIN number
that allowed you to get through a mantrap.
It really does depend on how your system wants to be set up,
and how your organization views its security practices.
Now, with biometrics, we do have
a couple of challenges that we have to focus on,
namely, the acceptance and rejection rates.
Obviously, since we're using biometrics,
as a form of authentication,
we should be worried about its false acceptance rate.
The false acceptance rate or FAR
is the rate that the system authenticates a user as valid,
even though that person should not have been
granted access to the system.
For example, if you walked up to the fingerprint reader,
placed your finger on it, and it accepts you,
because the system thought you were me,
that would be considered a false acceptance.
To prevent unauthorized people
from entering the building or using our system,
we would want to ideally get that false acceptance rate,
down to zero by increasing the sensitivity of our scanners.
Now, on the other side of the spectrum,
we have a false rejection.
And a lot of people don't think,
a false rejection is a problem
but it is just as big of a problem as a false acceptance.
Let's go back to the last example.
If I increase the sensitivity of the fingerprint scanner
to attempt to eliminate all
of the false acceptance rates or FAR,
I may inadvertently increase my false rejection rate or FRR.
A false rejection occurs any time
the biometrics system denies a user
who should have been allowed access to the system.
So, using that login example with my finger,
let's assume that you were able to
log in as me using your fingerprint.
So, I increase that sensitivity up to its highest level.
Now, there's no more false acceptances occurring.
But about half of the time,
when I try to log in, I'm being rejected
even though I'm an authorized user.
Now, this is the idea of a false rejection,
and why it's also considered a big problem.
Because if it's failing to allow me
to authenticate half of the time,
that means half the time, I can't get to work.
So, how can I perfectly tune the system
to eliminate the false acceptance and the false rejection?
Well, I try to achieve a balance
where the false acceptance rate
and the false rejection rate become equal.
This is known as the equal error rate or ERR,
more commonly, though, you'll see this called
the crossover error rate or CER out in the industry.
This is because your false acceptance rate
and your false rejection rate
intersect at that crossover error rate or CER.
The crossover error rate uses a measure
of the effectiveness of a given biometrics system.
So, when you're looking to purchase one,
you can use this as a factor
in your decision-making process.
You want one that doesn't have
a huge error to the positive side
or a huge error to the negative side.
If you can get one that has a good crossover error rate,
that's going to make sure that your people
are getting authenticated when you should be
and rejected when they should be.