Biometric authentication: the key to keeping businesses and users happy?

gallery

Retailers and restaurants are increasingly deploying biometric point of sale (POS) terminals to improve productivity, especially in situations where there are a lot of cash sales and temporary staff – the usual alternatives of video surveillance and analysing transactions tend to be expensive, time consuming and don’t make employees feel personally accountable.

Tokens are easy to pass back and forth between staff (and expensive to replace if an employee takes one when they leave) and passwords need to be reset regularly because of staff turnover. In addition to recording hours worked more accurately, the accountability of biometrics discourages unauthorised transactions or outright fraud. Hospitality businesses often see a return on investment in as little as 30 days. It also helps the business comply with PCI regulations for handling credit cards, which include giving each employee a unique ID.

Many cash registers let you connect a fingerprint reader as an internal module or a peripheral. Hertfordshire pub chain Giant Macaskills recently installed Unipower’s touchscreen Bar POS system in its bars and Unipower integrated Digtial Persona U.are.U fingerprint readers into the terminals. DigitalPersona has a OneTouchfor Windows SDK that simplifies adding biometrics to existing apps, and the DigitalPersona Pro server is available both as a workgroup system that supports authentication through a web service without Active Directory (AD) or requiring devices that are connected to a domain.

There’s also an enterprise version that integrates with AD by extending the schema, which can be centrally managed through group policy along with the rest of your systems. That means businesses can set the same identity and authentication system in the retail environment and the back office for invoicing and accounting. German bank Sparkasse has recently used the DigitalPersona system to move all internal users to biometric authentication for Windows as well as hundreds of applications.

The alternative is an appliance like Imprivata’s OneSign which works with identities from AD and LDAP. You need to deploy agents to PCs and set up policies to enforce biometrics but you don’t have to make any changes to the directory infrastructure or AD schema, which some companies find disruptive.

Fingerprint and hand biometrics have another advantage; you can use them for access to more than PCs and devices. A unified authentication and access control system lets you limit entry to specific areas, or if you want to use contextual security that stops a user logging into a PC if they haven't actually been registered as coming through the door into that area.

That’s also handy if someone tries the common trick of setting off a fire alarm to empty the building so they can get access to corporate PCs - people don’t always stop to log off when they think there’s a fire. A system like Overtis that links your physical security system to biometric access controls on computers will automatically lock them down in the case of an alarm sounding.

Voice biometrics are useful for remote authentication, like adding a level of security to self-service password resets - and with the spread of smartphones you can do it without the cost of buying devices like fingerprint readers.

HTK's Horizon Password Reset service, for example, only accepts calls from approved numbers and uses voice verification with pre-enrolled pass phrases. There are also fall back options of PINs and text messages for approval. It's a hosted solution that HTK can customise to integrate with AD or LDAP and the company is working on out-of the box integration.

Email to a friend

Print this page