Usability and Security

e guessed, which results in a low security level. Thus, having a controlled question/ answer typeresults in a well balanced level of usability and security;• Tokens: tokens are used more commonly for the physical domain and are considered a weakmechanism outside the financial sector because presentation of a valid token does not proveownership and can been stolen. One Time Password (OTP) such as the SecurID are one way ofsignificantly reducing the risk of using passwords. There are weaknesses with using only thisapproach but the chance of someone stealing or fraudulently obtaining the key fob and knowing theuser's id to successfully masquerade as the identity is considered unlikely to happen. Thus, OTPprovides the most balanced level of usability and security;• Biometrics: the different types of biometrics are very dependant of the error tolerance which can bemeasured by the False accept rates (FAR) and False reject rates (FRR). The fingerprint is the mostmature biometric technology and its reliability is well accepted. The Iris is becoming very stableover time and is characterized by its uniqueness. Thus, both fingerprint and Iris provide the mostbalanced level of usability and security.5.1 More secure authenticationThe separate authentication mechanisms as we discussed earlier provides a way to establish security andare in fact forms of single factor authentication. The classic form is the user id and password. This form ofuser authentication while used extensively is relatively weak because the same password is used over andover again, giving many opportunities for it to be illicitly captured 41 . The two way factor authentication isconsidered to be stronger than the single one 41 . Two factor authentications usually involve usingsomething you have and something you know. The most widely used forms are:• Automatic Teller Machine (ATM) card and PIN: one needs the card and needs to know the pincode;• Token and PIN: one needs the token and needs to know the pin code.An even more secure form of user authentication is the three factor authentication. This involves usingsomething you have, something you know and something you are. This involves for example; using anaccess control token, such as a smart card, a PIN to access the smart card and a biometric value held in acentral database. The card will be entered into a reader, the PIN is entered via a special PIN pad orkeyboard, the biometric is read and encrypted under a cryptographic key held on the smart card. The userid, read from the smart card, together with the encrypted biometric are sent to the central access controlsystem where the biometric can be decrypted and compared with the value on the central access controldatabase. Note here that the user PIN is not sent to the central access control system, but is checked locallyby the smart card 41 . Thus, having a more secure environment, by means of two or three way factorauthentication, a user need to perform more steps which is not always efficient.5.2 More usable authenticationThe usage of various multiple application and information systems has grown in the last decade. Usersoften require access to multiple systems or applications using different authentications every time, not24