<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: iris]]></title>
    <link>http://securityratty.com/tag/iris</link>
    <description></description>
    <pubDate>Thu, 08 Feb 2007 21:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Biometrics Security: Thumbs Down?]]></title>
      <link>http://securityratty.com/article/2d619f54e5a60335b81b6dffcb529308</link>
      <guid>http://securityratty.com/article/2d619f54e5a60335b81b6dffcb529308</guid>
      <description><![CDATA[Security technologies don't get much cooler than biometric devices. Gadgets like fingerprint readers, iris-recognition units and facial-recognition systems possess a high-tech allure that...]]></description>
      <content:encoded><![CDATA[Security technologies don't get much cooler than biometric devices. Gadgets like fingerprint readers, iris-recognition units and facial-recognition systems possess a high-tech allure that ordinary...]]></content:encoded>
      <pubDate>Mon, 11 Aug 2008 06:22:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/systems possess">systems possess</category>
      <category domain="http://securityratty.com/tag/security technologies">security technologies</category>
      <category domain="http://securityratty.com/tag/high-tech allure">high-tech allure</category>
      <category domain="http://securityratty.com/tag/biometric devices">biometric devices</category>
      <category domain="http://securityratty.com/tag/fingerprint readers">fingerprint readers</category>
      <category domain="http://securityratty.com/tag/gadgets">gadgets</category>
      <category domain="http://securityratty.com/tag/ordinary">ordinary</category>
      <category domain="http://securityratty.com/tag/cooler">cooler</category>
      <category domain="http://securityratty.com/tag/units">units</category>
      <source url="http://feeds.feedburner.com/~r/itsecurity/~3/382697989/">Biometrics Security: Thumbs Down?</source>
    </item>
    <item>
      <title><![CDATA[Fly through airport security with Clear, but you don't have less security]]></title>
      <link>http://securityratty.com/article/f3778a613754d2131eeac02a94cd6468</link>
      <guid>http://securityratty.com/article/f3778a613754d2131eeac02a94cd6468</guid>
      <description><![CDATA[A couple of weeks ago I was offered a free year membership in the Clear airport security program for registered travelers. Though my home airports of Ft Lauderdale and West Palm Beach don't yet offer...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/clear.jpg"><img height="145" alt="clear" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/clear_thumb.jpg" width="139" align="left" border="0" style="BORDER-RIGHT: 0px; BORDER-TOP: 0px; MARGIN: 0px 5px 5px 0px; BORDER-LEFT: 0px; BORDER-BOTTOM: 0px" /></a> A couple of weeks ago I was offered a free year membership in the <a href="http://www.flyclear.com/index.html" target="_blank">Clear airport security program</a> for registered travelers.&nbsp; Though my home airports of Ft Lauderdale and West Palm Beach don't yet offer Clear access, I fly enough in airports that do like Denver and Regan that I thought for free, what do I have to lose.&nbsp; I filled out the forms on line and last time I was in Regan airport I handed it in along with fingerprints, Iris scans, passport, etc.&nbsp; This past week my Clear card came in the mail and I have been looking forward to using it.</p>

<p>I thought that with my background check and all, they knew that I was a low risk for terrorist or other type of activity and therefore would not be subject to the same scrutiny and testing that we all endure when we have to fly.&nbsp; Turns out that I don't think that is exactly the case.&nbsp; However what it does do is allow you to go right to the front of the line in security, much to the dismay of others waiting on those lines.</p>

<p>The experience was great.&nbsp; I went to a special entrance for Clear members where I was met by a very helpful young lady.&nbsp; She escorted me to a Clear machine where we inserted my card and did a fingerprint scan.&nbsp; After that was done she escorted me to another young lady who walked me past all of the people waiting on line (and a long line it was).&nbsp; At the head of the line, the Clear lady gave my boarding pass and ID to the TSA person.&nbsp; The TSA person checked my id and pass, same as always and they passed me through.&nbsp; Than my Clear escort brought me to a special metal detector line which had no one on it, just waiting for me.&nbsp; Again skipping another line.&nbsp; I put my computer and other metal objects in the same old grey bin, took off my shoes and went through the metal detector.&nbsp; I thanked the Clear escort came out the other side, scooped up my stuff and proceeded to my gate.&nbsp; The entire process took less than 3 minutes I bet!&nbsp; That was great!&nbsp; The looks on the faces of the people I bypassed on line also gave me a perverse pleasure as well, I will admit.</p>

<p>After finishing this though I sat down and thought about it.&nbsp; What security did bypass?&nbsp; They still checked my ID and boarding pass. I still went through the metal detector and took off my shoes.&nbsp; In fact if anything security was added to my check in, as they now did a fingerprint match.&nbsp; So fact is, with all of the background checks and everything, having the Clear program did not relieve me of any security obligations and tests. In fact it added to them.&nbsp; What it did give me was a &quot;first class&quot; personal escort to the front of the line and than a first class que for the metal detectors.&nbsp; Because I was willing to pay some money and have a background search, I got the first class treatment.</p>

<p>To me this is not a scalable solution.&nbsp; As more Clear passengers come on board, having a dedicated person walking me through the security line is just not going to work.&nbsp; Also, lets be clear (no pun intended), this is not about going through less security.&nbsp; Why the background check and all?&nbsp; This is about paying money and skipping the line, but still going through the same security procedures that everyone else goes through.&nbsp; Just faster.&nbsp; Hey, don't get me wrong.&nbsp; I loved it!&nbsp; But I was wrong to think this was about bypassing security, this is a &quot;first class&quot; traveler lane.&nbsp; As long as you are &quot;clear&quot; with that, it is good by me!</p></div>
]]></content:encoded>
      <pubDate>Wed, 04 Jun 2008 09:26:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security line">security line</category>
      <category domain="http://securityratty.com/tag/airport security program">airport security program</category>
      <category domain="http://securityratty.com/tag/line">line</category>
      <category domain="http://securityratty.com/tag/security procedures">security procedures</category>
      <category domain="http://securityratty.com/tag/background check">background check</category>
      <category domain="http://securityratty.com/tag/check">check</category>
      <category domain="http://securityratty.com/tag/security obligations">security obligations</category>
      <category domain="http://securityratty.com/tag/background">background</category>
      <source url="http://www.stillsecureafteralltheseyears.com/ashimmy/2008/06/fly-through-air.html">Fly through airport security with Clear, but you don't have less security</source>
    </item>
    <item>
      <title><![CDATA[Fly through airport security with Clear, but you don't have less security?]]></title>
      <link>http://securityratty.com/article/ff09269bb2fbd1d5211d58a23c93599e</link>
      <guid>http://securityratty.com/article/ff09269bb2fbd1d5211d58a23c93599e</guid>
      <description><![CDATA[A couple of weeks ago I was offered a free year membership in the Clear airport security program for registered travelers. Though my home airports of Ft Lauderdale and West Palm Beach don't yet offer...]]></description>
      <content:encoded><![CDATA[
<div xmlns="http://www.w3.org/1999/xhtml"><p><a href="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/clear.jpg"><img style="border-right: 0px; border-top: 0px; margin: 0px 5px 5px 0px; border-left: 0px; border-bottom: 0px" height="145" alt="clear" src="http://www.stillsecureafteralltheseyears.com/ashimmy/WindowsLiveWriter/clear_thumb.jpg" width="139" align="left" border="0"></a> A couple of weeks ago I was offered a free year membership in the <a href="http://www.flyclear.com/index.html" target="_blank">Clear airport security program</a> for registered travelers.&nbsp; Though my home airports of Ft Lauderdale and West Palm Beach don't yet offer Clear access, I fly enough in airports that do like Denver and Regan that I thought for free, what do I have to lose.&nbsp; I filled out the forms on line and last time I was in Regan airport I handed it in along with fingerprints, Iris scans, passport, etc.&nbsp; This past week my Clear card came in the mail and I have been looking forward to using it.</p> <p>I thought that with my background check and all, they knew that I was a low risk for terrorist or other type of activity and therefore would not be subject to the same scrutiny and testing that we all endure when we have to fly.&nbsp; Turns out that I don't think that is exactly the case.&nbsp; However what it does do is allow you to go right to the front of the line in security, much to the dismay of others waiting on those lines.</p> <p>The experience was great.&nbsp; I went to a special entrance for Clear members where I was met by a very helpful young lady.&nbsp; She escorted me to a Clear machine where we inserted my card and did a fingerprint scan.&nbsp; After that was done she escorted me to another young lady who walked me past all of the people waiting on line (and a long line it was).&nbsp; At the head of the line, the Clear lady gave my boarding pass and ID to the TSA person.&nbsp; The TSA person checked my id and pass, same as always and they passed me through.&nbsp; Than my Clear escort brought me to a special metal detector line which had no one on it, just waiting for me.&nbsp; Again skipping another line.&nbsp; I put my computer and other metal objects in the same old grey bin, took off my shoes and went through the metal detector.&nbsp; I thanked the Clear escort came out the other side, scooped up my stuff and proceeded to my gate.&nbsp; The entire process took less than 3 minutes I bet!&nbsp; That was great!&nbsp; The looks on the faces of the people I bypassed on line also gave me a perverse pleasure as well, I will admit.</p> <p>After finishing this though I sat down and thought about it.&nbsp; What security did bypass?&nbsp; They still checked my ID and boarding pass. I still went through the metal detector and took off my shoes.&nbsp; In fact if anything security was added to my check in, as they now did a fingerprint match.&nbsp; So fact is, with all of the background checks and everything, having the Clear program did not relieve me of any security obligations and tests. In fact it added to them.&nbsp; What it did give me was a "first class" personal escort to the front of the line and than a first class que for the metal detectors.&nbsp; Because I was willing to pay some money and have a background search, I got the first class treatment.</p> <p>To me this is not a scalable solution.&nbsp; As more Clear passengers come on board, having a dedicated person walking me through the security line is just not going to work.&nbsp; Also, lets be clear (no pun intended), this is not about going through less security.&nbsp; Why the background check and all?&nbsp; This is about paying money and skipping the line, but still going through the same security procedures that everyone else goes through.&nbsp; Just faster.&nbsp; Hey, don't get me wrong.&nbsp; I loved it!&nbsp; But I was wrong to think this was about bypassing security, this is a "first class" traveler lane.&nbsp; As long as you are "clear" with that, it is good by me!</p></div>

<p><a href="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?a=W8nuzy"><img src="http://feeds.feedburner.com/~a/StillsecureAfterAllTheseYears?i=W8nuzy" border="0"></img></a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=JR6aYI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=JR6aYI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=NFcYcI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=NFcYcI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=1ZVVqI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=1ZVVqI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=pCSkoI"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=pCSkoI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=XHPWQi"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=XHPWQi" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?a=HHQGDi"><img src="http://feeds.feedburner.com/~f/StillsecureAfterAllTheseYears?i=HHQGDi" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~4/304685966" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 04 Jun 2008 08:26:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security line">security line</category>
      <category domain="http://securityratty.com/tag/airport security program">airport security program</category>
      <category domain="http://securityratty.com/tag/line">line</category>
      <category domain="http://securityratty.com/tag/security procedures">security procedures</category>
      <category domain="http://securityratty.com/tag/background check">background check</category>
      <category domain="http://securityratty.com/tag/check">check</category>
      <category domain="http://securityratty.com/tag/security obligations">security obligations</category>
      <category domain="http://securityratty.com/tag/background">background</category>
      <source url="http://feeds.feedburner.com/~r/StillsecureAfterAllTheseYears/~3/304685966/fly-through-air.html">Fly through airport security with Clear, but you don't have less security?</source>
    </item>
    <item>
      <title><![CDATA[The ID Divide]]></title>
      <link>http://securityratty.com/article/b0a737cc0f9a6c65ffad3d37edfe8736</link>
      <guid>http://securityratty.com/article/b0a737cc0f9a6c65ffad3d37edfe8736</guid>
      <description><![CDATA[Yesterday the Center for American Progress published its paper on identification and identification technologies: &quot; The ID Divide: Addressing the Challenges of Identification and Authentication in...]]></description>
      <content:encoded><![CDATA[<p>Yesterday the Center for American Progress published its paper on identification and identification technologies: "<a href="http://www.americanprogress.org/issues/2008/06/id_divide.html">The ID Divide: Addressing the Challenges of Identification and Authentication in American Society</a>."  I was one of the participants in the project that created this paper, and it's worth reading.</p>

<p>Among other things, the paper identifies six principles for identification systems:</p>

<ul><li>Achieve real security or other goals
<li>Accuracy
<li>Inclusion
<li>Fairness and equality
<li>Effective redress mechanisms
<li>Equitable financing for systems</ul>

<p>From the Executive Summary:</p>

<blockquote>How can these principles be honored in practice? That’s where the "due diligence" process comes into play when considering and implementing identification systems. Due diligence in the financial world of mergers and acquisitions and other important corporate transactions is conducted before a company makes a major investment. Proponents of, say, a merger (or in our case, a new identification program) can err on the side of optimism, concluding too readily that the merger (or new ID program) is clearly the way to go. Thorough due diligence protects against such over-optimism.

<p>In the pages that follow, we apply this due diligence process to some recurring technical problems with current and proposed identification programs. And we discover—as you’ll see toward the end of the report—that ID programs that rely on "shared secrets," such as Social Security numbers or your mother’s maiden name, are becoming more insecure due to the increased use of identification. Similarly, ID programs based on biometrics such as fingerprints or iris scans are not the "silver bullets" that some proponents claim they are, but rather could become compromised rapidly if deployed in haphazard ways.</p>

<p>We then apply our progressive principles and due diligence insights to two current examples of identification programs. The first details why it would be bad policy to require government-issued photo ID for in-person voting. The second shows the basically sound policy rationale for the Transportation Worker Identification Card, used for workers with access to security-critical port facilities. By examining one identification program that is reasonable, and one that is not, our analysis shows the usefulness of the Progressive Principles for Identification Systems.</blockquote></p>

<p>I participated in the panel discussion announcing this report, along with Jim Harper (Director of Information Policy Studies at the Cato Institute).</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=B1sMZI"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=B1sMZI" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=VCBOKI"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=VCBOKI" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 04 Jun 2008 02:34:45 +0000</pubDate>
      <category domain="http://securityratty.com/tag/identification technologies">identification technologies</category>
      <category domain="http://securityratty.com/tag/identification">identification</category>
      <category domain="http://securityratty.com/tag/identification programs">identification programs</category>
      <category domain="http://securityratty.com/tag/identification systems">identification systems</category>
      <category domain="http://securityratty.com/tag/due diligence">due diligence</category>
      <category domain="http://securityratty.com/tag/due diligence insights">due diligence insights</category>
      <category domain="http://securityratty.com/tag/process">process</category>
      <category domain="http://securityratty.com/tag/due diligence process">due diligence process</category>
      <category domain="http://securityratty.com/tag/identification program">identification program</category>
      <source url="http://www.schneier.com/blog/archives/2008/06/the_id_divide.html">The ID Divide</source>
    </item>
    <item>
      <title><![CDATA[Marines Land in Afghanistan -- with Biometrics]]></title>
      <link>http://securityratty.com/article/341f8023eff4009290265af98b94419d</link>
      <guid>http://securityratty.com/article/341f8023eff4009290265af98b94419d</guid>
      <description><![CDATA[A year ago this June, Taliban fighters streamed into the remote town of Chora in southern Afghanistan expecting an easy victory over impoverished villagers. Instead, they met heavy resistance from...]]></description>
      <content:encoded><![CDATA[<p>A year ago this June, Taliban fighters streamed into the remote town of Chora in southern Afghanistan expecting an easy victory over impoverished villagers. Instead, they met heavy resistance from scores of uniformed Afghan men.</p>

<p>Those so-called Afghan National Auxiliary Police (ANAP), all formerly in the service of local warlords, had received two months of training by Dutch and American soldiers and were now the first line of defense against the Taliban.</p>

<p>Arming tribesmen was a risky idea. True, this sort of tribal initiative had been effective in Iraq. But NATO commanders feared that Afghan loyalties to their warlords ran too deep. NATO was “arming people who were not necessarily in line with the [Afghan] government,” U.S. Brig. Gen. Robert Cone told Wired.com.</p>

<p>So, last month, NATO fired the auxiliary cops and scrapped the tribal strategy, leaving gaping holes in Afghanistan's defenses. The fix? Marines, of course, armed with fingerprint pads, iris scanners and electronic databases.</p>

<p>With these biometric tools, the Marines are planning to recruit new cops who have no ties to tribal warlords. “We know there are some shadow police and some militia-type police,” Lt. Col. Ray Hall, the Marine commander, said. “Once we go through the vetting process, we'll have everybody screened … so that problem should go away.”</p>


<p>That means scanning every new recruit's unique iris “eye prints,” logging their thumb prints and feeding it all into a growing, but still very spotty, national database linked to criminal and intelligence records. If a cop has any known warlord ties, he's disqualified from serving.</p>


<p>CIA teams used FBI biometrics while hunting for known Al Qaeda operatives in Afghanistan in 2001, and since then, the military has gathered data on almost every Afghan it comes in regular contact with.</p>

<p>There's one more problem. Not all the military databases can talk to one another. “We haven't standardized,” said Larry Schneider, a Northrop Grumman VP who last year was working on collapsing many biometrics systems into just one.</p>

<p>Until everyone is looking at the same data, seditious Afghan cops will probably keep falling through the cracks. </p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=8e864b5693d073a8576ef6a5f0dcd116" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=8e864b5693d073a8576ef6a5f0dcd116" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=P1dSOH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=P1dSOH" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=xrzogh"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=xrzogh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=nJh6oh"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=nJh6oh" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=Di90gH"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=Di90gH" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=WFlSZH"><img src="http://feeds.wired.com/~f/wired/politics/security?i=WFlSZH" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=e7NoWh"><img src="http://feeds.wired.com/~f/wired/politics/security?i=e7NoWh" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=GYyrjh"><img src="http://feeds.wired.com/~f/wired/politics/security?i=GYyrjh" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=5IrDNH"><img src="http://feeds.wired.com/~f/wired/politics/security?i=5IrDNH" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/296157070" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/296157079" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 22 May 2008 18:30:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/afghan">afghan</category>
      <category domain="http://securityratty.com/tag/afghan government">afghan government</category>
      <category domain="http://securityratty.com/tag/seditious afghan cops">seditious afghan cops</category>
      <category domain="http://securityratty.com/tag/afghanistan">afghanistan</category>
      <category domain="http://securityratty.com/tag/cops">cops</category>
      <category domain="http://securityratty.com/tag/afghan loyalties">afghan loyalties</category>
      <category domain="http://securityratty.com/tag/nato commanders">nato commanders</category>
      <category domain="http://securityratty.com/tag/nato">nato</category>
      <category domain="http://securityratty.com/tag/warlords">warlords</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/296157079/biometrics_afghan_marines">Marines Land in Afghanistan -- with Biometrics</source>
    </item>
    <item>
      <title><![CDATA[Customer information vulnerable in the hands of corporates]]></title>
      <link>http://securityratty.com/article/aa755a438a50cb8991ebe58ac7a777a4</link>
      <guid>http://securityratty.com/article/aa755a438a50cb8991ebe58ac7a777a4</guid>
      <description><![CDATA[Privacy agreements are being scrapped as fingerprints, iris scans and voiceprints are at risk of being hocked off through business...]]></description>
      <content:encoded><![CDATA[Privacy agreements are being scrapped as fingerprints, iris scans and voiceprints are at risk of being hocked off through business acquisitions.<p><NOLAYER>
<IFRAME id="rss" src="http://ad.doubleclick.net/adi/idg.us.nwf.rss/security;sz=468x60;ord=65033?" width="468" height="60" frameborder="no" border="0" marginwidth="0" marginheight="0" scrolling="no">
<A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=65033?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=65033?" border="0" width="468" height="60"></A>
</IFRAME>
</NOLAYER></p>]]></content:encoded>
      <pubDate>Sun, 30 Mar 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/iris scans">iris scans</category>
      <category domain="http://securityratty.com/tag/business acquisitions">business acquisitions</category>
      <category domain="http://securityratty.com/tag/privacy agreements">privacy agreements</category>
      <category domain="http://securityratty.com/tag/fingerprints">fingerprints</category>
      <category domain="http://securityratty.com/tag/voiceprints">voiceprints</category>
      <category domain="http://securityratty.com/tag/risk">risk</category>
      <source url="http://www.networkworld.com/news/2008/033108-customer-information-vulnerable-in-the.html?fsrc=rss-security">Customer information vulnerable in the hands of corporates</source>
    </item>
    <item>
      <title><![CDATA[Biometrics would not have prevented SocGen incident]]></title>
      <link>http://securityratty.com/article/742082755108b01479e6ffd9bef66811</link>
      <guid>http://securityratty.com/article/742082755108b01479e6ffd9bef66811</guid>
      <description><![CDATA[An early contender for the biggest load of security tosh of the year comes within the report produced by Société Générale in response to the recent trading fraud scandal. The report identifies a...]]></description>
      <content:encoded><![CDATA[
      An early contender for the biggest load of security tosh of the year comes within the report produced by Société Générale in response to the recent trading fraud scandal. The report identifies a number of actions "as part of a structured plan", and the very first one of those is described as follows:

- <strong>Strengthening IT security through the development of strong identification solutions (biometry).</strong>

I cannot see anything to suggest that insufficient authentication and access controls were to blame for the incident. What we had was a breakdown in process, supervision, management and audit controls that should have worked together and flagged an issue long before it became newsworthy. Call me what you like but I just don't see that biometrics would have mitigated any of the risk. Am I missing something?

For example, page 8 of the report (and here I will admit that I haven't read it all, just the bits I can pick out in five quick minutes) lists a number of controls that were bypassed in order to "hide the fictitious nature" of the trading. Given that the purpose of biometrics is to determine identity, I do not see how using a fingerprint, blood sample or iris scan would have prevented the trader from not complying with the list of procedural controls listed such as "no confirmation for internal transactions."

This is also a view shared by Kenneth Paterson of the Royal Holloway in this very insightful <a href="http://www.computerweekly.com/Articles/2008/03/05/229714/royal-holloway-control-the-controllers.htm">article </a>published as part of the latest Computer Weekly Think-Tank on insider threats.

Read the full report <a href="http://www.sp.socgen.com/sdp/sdp.nsf/V3ID/6D44E7AEF3D68993C12573F700567904/$file/comiteSpecialFevrier08gb.pdf">here</a>.

      
   ]]></content:encoded>
      <pubDate>Fri, 07 Mar 2008 16:25:37 +0000</pubDate>
      <category domain="http://securityratty.com/tag/controls">controls</category>
      <category domain="http://securityratty.com/tag/procedural controls">procedural controls</category>
      <category domain="http://securityratty.com/tag/report">report</category>
      <category domain="http://securityratty.com/tag/report identifies">report identifies</category>
      <category domain="http://securityratty.com/tag/audit controls">audit controls</category>
      <category domain="http://securityratty.com/tag/biometrics">biometrics</category>
      <category domain="http://securityratty.com/tag/security tosh">security tosh</category>
      <category domain="http://securityratty.com/tag/strong identification solutions">strong identification solutions</category>
      <category domain="http://securityratty.com/tag/computer weekly think-tank">computer weekly think-tank</category>
      <source url="http://www.computerweekly.com/blogs/stuart_king/2008/03/an-early-contender-for-the.html">Biometrics would not have prevented SocGen incident</source>
    </item>
    <item>
      <title><![CDATA[Embedding Iris Watermarking in Photos]]></title>
      <link>http://securityratty.com/article/0bfd5041f245116ac9b6c61d84333069</link>
      <guid>http://securityratty.com/article/0bfd5041f245116ac9b6c61d84333069</guid>
      <description><![CDATA[Canon has filed a patent on embedding an iris scan of the photographer in the metadata of photographs, presumably secured with a digital...]]></description>
      <content:encoded><![CDATA[<p>Canon has <a href="http://www.photographybay.com/2008/02/09/canon-iris-registration-watermark/">filed a patent</a> on embedding an iris scan of the photographer in the metadata of photographs, presumably secured with a digital signature.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=XdkGWWE"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=XdkGWWE" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=hAzH19E"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=hAzH19E" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 14 Feb 2008 10:06:56 +0000</pubDate>
      <category domain="http://securityratty.com/tag/digital signature">digital signature</category>
      <category domain="http://securityratty.com/tag/iris scan">iris scan</category>
      <category domain="http://securityratty.com/tag/photographs">photographs</category>
      <category domain="http://securityratty.com/tag/canon">canon</category>
      <category domain="http://securityratty.com/tag/photographer">photographer</category>
      <category domain="http://securityratty.com/tag/filed">filed</category>
      <category domain="http://securityratty.com/tag/patent">patent</category>
      <category domain="http://securityratty.com/tag/metadata">metadata</category>
      <source url="http://www.schneier.com/blog/archives/2008/02/embedding_iris.html">Embedding Iris Watermarking in Photos</source>
    </item>
    <item>
      <title><![CDATA[U.K. airport gets iris recognition program]]></title>
      <link>http://securityratty.com/article/fb4c966d16c877aaa3cb66d7c3b49d7b</link>
      <guid>http://securityratty.com/article/fb4c966d16c877aaa3cb66d7c3b49d7b</guid>
      <description><![CDATA[Manchester has implemented what it claims is the U.K.'s first biometric access control system based on iris recognition. The system officially went live just before Christmas, and is used to control...]]></description>
      <content:encoded><![CDATA[Manchester has implemented what it claims is the U.K.'s first biometric access control system based on iris recognition. The system officially went live just before Christmas, and is used to control access to secure parts of the airport for airport workers.
			
			<div style="margin-top:20" />
			<table border="1" BORDERCOLOR="#0033CC" cellspacing="0" cellpadding="2">
				<tr valign="top" align="left">
					<td>
						<table border="0" cellspacing="3" cellpadding="2" width="100%">
			
			
		  
		<tr> 
		<tr>
      <td width="*">
				<font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" size="-1">
				<p>	
			
			<a href="http://rsslinks.industrybrains.com/click?sid=93&scid=10069&rqctid=589&lid=463835&cid=131427&pr=2&tstamp=20080123000000&url=http://www.silver-peak.com/html/landing/technology_primer_landing_page.asp%3fsid%3dIndustry-Brains-Tech-Primer" target=_blank><strong>Register for a WAN Acceleration Technology Primer</strong></a></p>
				<td align="right">
					<font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" COLOR="#0033CC" size="-1"><p>Advertisement</p></font>
				</td>
				</tr>
				<tr><td colspan="2"><font face="Arial,Helvetica,Geneva,Sans-serif,sans-serif" size="-1"><p>This paper explores the differences between commonly used WAN acceleration technologies.
			
				</p>
				</font>
		 	</td>
     </tr>
		 
		 
			
						</table>
					</td>
				</tr>
			</table>
			<div style="margin-top:20" />
			
			]]></content:encoded>
      <pubDate>Tue, 22 Jan 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/airport">airport</category>
      <category domain="http://securityratty.com/tag/iris recognition">iris recognition</category>
      <category domain="http://securityratty.com/tag/wan acceleration technologies">wan acceleration technologies</category>
      <category domain="http://securityratty.com/tag/airport workers">airport workers</category>
      <category domain="http://securityratty.com/tag/paper explores">paper explores</category>
      <category domain="http://securityratty.com/tag/control access">control access</category>
      <category domain="http://securityratty.com/tag/advertisement">advertisement</category>
      <category domain="http://securityratty.com/tag/manchester">manchester</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <source url="http://www.networkworld.com/news/2008/012308-uk-airport-gets-iris-recognition.html?fsrc=rss-security">U.K. airport gets iris recognition program</source>
    </item>
    <item>
      <title><![CDATA["Prosthetic Biometrics": Microchips Under Your Skin]]></title>
      <link>http://securityratty.com/article/3f5f011a90ae964fd033754038a66d21</link>
      <guid>http://securityratty.com/article/3f5f011a90ae964fd033754038a66d21</guid>
      <description><![CDATA[Several years ago, I gave a talk at a local university on biometric authentication--the security applications of fingerprint recognition, iris scanning, and so forth. A faculty member approached me...]]></description>
      <content:encoded><![CDATA[Several years ago, I gave a talk at a local university on biometric authentication--the security applications of fingerprint recognition, iris scanning, and so forth. A faculty member approached me afterward to ask why I was bothering. After all, wouldn't we all be surgically implanted with digital authentication devices in the not-too-distant future?

I laughed at the idea of "prosthetic biometrics." Gently, I hope. Today a company called VeriChip conducted an initial public offering. VeriChip sells small, encapsulated microchips (RFID tags) that transmit unique serial numbers over short distances via radioâ€”surgically implantable authentication devices, in fact.

Dogs and cats have been regularly implanted with RFID tags for years. That beta test, if you will, has been has largely successful: Many shelters are equipped to scan RFID tags in animals lacking other identification, and many pets and owners owe their happy reunification to the devices...]]></content:encoded>
      <pubDate>Thu, 08 Feb 2007 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/devices">devices</category>
      <category domain="http://securityratty.com/tag/implantable authentication devices">implantable authentication devices</category>
      <category domain="http://securityratty.com/tag/rfid tags">rfid tags</category>
      <category domain="http://securityratty.com/tag/scan rfid tags">scan rfid tags</category>
      <category domain="http://securityratty.com/tag/digital authentication devices">digital authentication devices</category>
      <category domain="http://securityratty.com/tag/prosthetic biometrics">prosthetic biometrics</category>
      <category domain="http://securityratty.com/tag/verichip sells">verichip sells</category>
      <category domain="http://securityratty.com/tag/verichip">verichip</category>
      <category domain="http://securityratty.com/tag/transmit unique serial">transmit unique serial</category>
      <source url="http://www.rsa.com/blog/blog_entry.aspx?id=1166">"Prosthetic Biometrics": Microchips Under Your Skin</source>
    </item>
  </channel>
</rss>
