Enterprises Must Consider Privacy Concern For Biometrics

On-server storage and processing of biometric authentication presents a host of regulatory and corporate responsibility issues.

Its bad enough when an organization exposes huge repositories of customer records and login information through large-scale data breaches. But the ante for pain is going up if organizations start collecting and storing biometric information indiscriminately.
When mega breaches regularly start including biometrics, individuals will be in a bind.
Unlike passwords, this information is unchangeable and the impact for consumers, citizens, and business users will be tremendous if enterprises dont start thinking seriously about the privacy of biometric information before it becomes a major attack target, experts say.
The regulators are still playing catch-up in the US when it comes to biometrics privacy controls, but already in the EU, Canada, and some parts of Asia, governments are clamping down. And as biometrics collection becomes more prevalent and more breaches involving biometrics information come to light, that compliance and risk environment is going to grow increasingly fraught for businesses hoping to leverage this information for authentication,
according to a report out today by PwC Legal and Nok Nok Labs
.
Weve already gotten a glimpse into the future of biometrics hacks, as the
OPM breach
of last year exposed the fingerprints of 5.6 million US citizens. As things stand, the opportunity to misuse fingerprints is still pretty small, but even the OPM admitted that this could change over time as technology evolves. What will also change rapidly is the technical chops of non-governmental agencies to collect the same volume of biometrics information that only governments used to be capable of gathering in the past. In addition, the time is coming where it will be much easier to collect that data without the individual even knowing it is being collected.
The collection of biometric data has historically been difficult to do from a technical perspective without the user being aware it is happening. The gathering of fingerprints, iris scans and retina images requires the user to be extremely close to the reading device, warns the report. However, advances in technology have changed this and as voice, facial and gait analyses becomes more prevalent, the risk of covert or incidental collection of biometric data significantly increases.
As such, organizations are going to not only have to think about privacy, but also collection transparency issues in the near future. Some of the biggest concerns that need to be addressed beyond transparency include how that information is stored if aggregated on enterprise servers, how to ensure that data is adequately destroyed if permission is removed by the individual to collect the data, and how organizations will organize cross-border transfers of the data.
PwC Legal notes that many of the complexities of biometrics data storage could be avoided by developing infrastructure that stores and matches biometrics on the device rather than the enterprise server. This kind of set-up gives the user greater individual choice around how their biometrics are handled and avoids the complications of cross-border legal issues. It also reduces the risk of a biometrics mega breach.
Each device retains its user’s biometric data and, therefore, the volume of data at risk is lower (when compared to storage of data many or all users’ biometric information on a server), PwC Legal said in
its study
. It must be noted however, with biometric data stored on the device, that in the event of a successful attack on a specific device, the data accessed is likely to provide a more detailed profile of an individual if matched with other data on the device.
Related Content:
The End Of Passwords?
Behavioral Biometrics On The Rise At RSA Conference
New Secure Online Check-Out Tech Goes For Less Friction, More Biometrics

Last News
▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Enterprises Must Consider Privacy Concern For Biometrics