* Greg Faust, CEO of Florida-based Valid Technologies offers some practical information about using biometric authentication for enterprise IT
For the past two weeks, I’ve written about the growing use of biometrics as a means of identification as well as authentication for a range of services. Greg Faust, CEO of Florida-based Valid Technologies, wrote to me to offer some practical information about using biometric authentication for enterprise IT.
Back in 2004, Faust and his colleagues sat around discussing the features they thought would be critically important when designing and implementing a system using biometrics for authentication into enterprise systems and applications. From those early discussions, the company developed a solution they call VSSA (Valid Secure System Authentication), which replaces passwords with secure, scalable and adaptable fingerprint biometric authentication. Since then, the company has implemented this solution in more than 20 large organizations, including banks and other financial institutions. Thus, the information in today’s newsletter is brought to you by someone in the trenches who works with this technology every day.
“Fingerprint biometrics present a world of benefits — if properly designed and applied,” according to Faust. “We (Valid Technologies) spent several years developing and market-validating biometric authentication built specifically for the needs of enterprise IT.”
While scores of companies offer biometric solutions, not all solutions are created equal, or are appropriate for enterprise IT, says Faust. And, what works well in one situation may not work for another. He offers his advice in what to look for in a biometrics-based authentication system:
* Weed out the “toys” from the enterprise-class solutions. “Many biometric ‘gadgets’ are marketed with promises so grandiose they would make P.T. Barnum proud,” says Faust. Your business needs proven solutions, not gadgets.
* Study the fit of the solution with your enterprise security policy and IT architecture. Biometric solutions interact with multiple parts of your network, hardware, and application architectures. A solid solution is one that complements your existing framework and policies. Look for compatibility with enterprise architectures such as SOA, Active Directory, Tivoli, WebSphere, Java and PHP, advises Faust.
* Consider whether this is a single-application solution or part of an enterprise-wide strategy for user authentication. Various applications, systems, and security levels exist in your enterprise. Solutions for enterprise computing must extend beyond today’s need – and do so securely.
* Do you want server or client-driven authentication? “If the answer is ‘on the PCs and laptop’ or ‘on device’ you are getting more ‘convenience’ than security,” cautions Faust. He prefers to build a server-based architecture in order to remove the risk of a vulnerability at the client level, like with the operating system.
* Consider what the impact will be to your network. Large communication packets such as those used to authentic a person’s identity and credentials can cripple network traffic. There are ways to architect a solution such that the impact to the network is minimized.
* Is your chosen solution reliable, adaptable, secure and manageable? Authentication is a critical enterprise function, and proven reliability is a must. Look for a solution that works at the transaction level, with secure communications, and is compatible with your existing enterprise applications. Demand centralized reporting and administration capabilities, and the use of sensors that cannot be spoofed with a photocopy of a fingerprint.
* Don’t forget about ease-of use and privacy protection. Slow or complicated solutions get avoided – and discarded. Storage of user fingerprint images can invade privacy. Speedy solutions that deploy secure template technologies are available.
* Last, but not least, be sure to ask: How does this solution build competitive advantages and support growth? “Sure, you can get a quick ROI, but demand more,” says Faust. “Biometrics can enable new products and services that add to top-line revenue growth.”
* Before you buy, take a test drive. Install the solution in your shop, on your network, and see how it performs. Any provider that declines to support such a trial does not deserve your business.
Good advice from someone who is in the know.
