Page 138 - CISSO_Prep_ Guide

health or other personal information and may evoke resistance
amongst users. It has happened that putting in a biometrics
system actually decreased the level of security in a facility since
the users resisted it so much that they worked to circumvent the
system.

A biometric system measures one or more unique physical
characteristics of a user. These may range from fingerprints and
palm scans to retina scans, iris scans, and handwriting style.
The choice of biometric device is dependent on several factors,
including costs to purchase, install and operate, the impact on
productivity, and acceptance by the user community.

The use of biometrics in a technical sense has usually been to
authenticate a user. However, when used for physical security,
biometrics is often used for identification. The difference is in
whether the user provides some identification to the system
which is then validated using biometric data or whether the user
is identified by the system from a list of known biometric
values.

Biometric systems, like all other systems, are subject to error.
The errors on a biometric system would be to grant access to an
unauthorized person or to deny access to an authorized person.
Of the two, the granting of access to an unauthorized person is
more dangerous. This is called a Type II error. Denying
authorized person access (thinking that they were an imposter)
would be more of an inconvenience to the user than a serious
risk to the organization. This would be called a Type I error.
Most biometric devices have the capability of adjusting the
sensitivity or precision of the device, and adjusting the
sensitivity will affect the error rate accordingly. A device set for