Usability and Security

unique set of advantages and disadvantages. Cost, size, and method of use often dictate applicability toany given situation.Fingerprints, retinal scanning and Iris scanning are the only biometrics types that can accurately identifyan individual. Biometrics technologies have a wide range of accuracy, reliability, and usability. Thus,despite the difficulty in comparing biometrics, they will always have some comparable accuracy versususability balance that can be compared with other technologies 34 . With regards to the security aspectsaround biometrics; incorporating biometrics techniques into the organizations security architecture mayincrease information security by means of eliminating the ability of sharing passwords and making itmuch more difficult to counterfeit or steal the security key. The specific level of security provided by adevice also depends on the number of “reference points,” which are the individual metrics taken in eachscan 35 . According to Purnell & Marks, Iris scanners capture 200+ reference points while fingerprintreaders typically capture around 80. Furthermore, the effectiveness of the reference points also depends onthe algorithms used. More reference points can mean more false negative identifications 35 . This meansusing better accuracy might result in rejecting the right individual. While more reference pointstheoretically mean a better “signature,” it can also mean that there are more chances for failure in thesecondary scan. In relation to this, if the individual using the device is not positioned in a correct way,then the scanner may not pick up each reference point properly. The individual sensitivity settings on adevice control whether it will error the side of caution (rejection) or convenience (acceptance) 35 . Theaccuracy of many biometric systems is still not high enough for some applications e.g. negativeidentification or matching against a very large database 36 . Facial recognition systems are often used tocreate a manageable subset of possible identities, but must be scrutinized by a human observer. Thus,facial systems may not be suitable for real-time identification 37 .The actual performance of these devices is typically measured in terms of two measures 34 :• False accept rates (FAR). The likelihood that the wrong person will be able to access the system;• False reject rates (FRR). The likelihood that a legitimate person will be denied access.Setting the sensitivity too high can result in too many False Rejection Rate (FRR) and setting it too lowcan increase the False Acceptance Rate (FAR) 35 . Reported values for FAR and FRR are usually based ontheoretical calculations performed with clean, high-quality data, instead on actual observations and realworldperformance 34 . The realized performance may not be as good as the predicted performance.Performance estimates are often far more impressive than actual performance 38 . Many systems do not liveup to expectations because they prove unable to cope with the enormous variations among largepopulations, or fail to take into account people’s needs and behaviors 39 .Regarding the usability aspects around biometrics; various biometric sensors require more or lessinvolvement of the users. An important aspect is the nature of the signatures collected that impact the easeof enrollment and implementation of the equipment 35 .19