To what exactly would a request for biometric data from an insurance provider pertain?

BROWSE BY TAG Identity Management and Access Control,   Enterprise Identity and Access Management,   User Authentication Services,   Biometric Technology,   Enterprise Data Protection,   Enterprise Data Governance,   Expert Archive: Identity Management and Access Control,   VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Identity Management and Access Control Is Identity Management as a Service (IDaaS) a good idea? How to log in to multiple servers with federated single sign-on (SSO) How to confirm the receipt of an email with security protocols Learn about enterprise strategy for server virtualization single sign-on Employee information security awareness training for new IAM systems Can you combine RFID tag technology with GPS to track stolen goods? Is there a free enterprise-caliber password-management tool? Cryptosystem attacks that do not involve obtaining the decryption key Can any firm or organization get a digital signature certificate? Should the CTO have domain administrator access? Biometric Technology Group to shed light on secure identity management threats Biometrics project studies ways to combat bank fraud Apple iPhone app could boost two-factor Vein-reader biometric authentication for health care, financials Exploring authentication methods: How to develop secure systems Biometric authentication know-how: Devices, systems and implementation Pre-boot biometric user authentication tools and strategies Keystroke recognition aids online authentication at credit union What are the possible benefits of microchip implants and RFID tags for employees? Biometrics vs. biostatistics Biometric Technology Research Enterprise Data Governance Creating an enterprise data protection framework Analyst DLP study finds maturity, ranks top DLP vendors Voltage, RSA spar over tokenization, data protection Twitter gets condemned by CISOs at Forrester forum PCI DSS compliance requirements: Ensuring data integrity Trustwave acquires data loss prevention vendor Vericept Data has become too distributed to secure, Forrester says Cloud-based security services should start private Compliance in the cloud How to write technology outsourcing contracts

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary biometric payment  (SearchSecurity.com) electro-optical fingerprint recognition  (SearchSecurity.com) false acceptance  (SearchSecurity.com) finger vein ID  (SearchSecurity.com) fingernail storage  (SearchSecurity.com) keystroke dynamics  (SearchSecurity.com) live capture  (SearchSecurity.com) multifactor authentication (MFA)  (SearchSecurity.com) password hardening  (SearchSecurity.com) ridge  (SearchSecurity.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

Biometric data serves only one purpose: to verify someone's identity. An insurance provider is probably requesting it to verify the identity of someone either applying for a policy or filing a claim. Before delving into the confidentiality of biometric data, let's take a quick look at biometrics to get a better understanding of what the insurance provider is probably doing.

Biometrics is a factor of authentication that is a physical characteristic, like a fingerprint, face pattern or the sound of someone's voice.

Because physical characteristics are difficult, if not impossible, to spoof in most cases, they're considered the strongest authentication factor. There are ways to copy fingerprints onto a gel or mold to fool a scanner, but such cases are rare.

In addition, biometric data is analog and has to be converted into digital data so computer systems can read and process it. This digital data has to be protected from being sniffed in transit or stolen from identity stores. Though rare and difficult to carry out, attacks with compromised biometrics data can be used to gain malicious access to systems.

The other issue to consider with biometric data is that once compromised, it's difficult to replace. A lost or stolen user ID and password can be reset, but a lost fingerprint or iris scan can't. Biometric credentials are set in stone. One way around this problem with fingerprints, for example, is to take only partial fingerprints. If the prints on file are stolen, more prints can be taken from other fingers or other parts of fingers.

Unfortunately, biometric data, like other authentication credentials, is considered just that -- authentication credentials and not confidential customer data to be protected. Just like other authentication credentials, biometric data should be securely collected, transmitted and stored, and that means encryption during the whole process.

It's wise to ask the insurance provider some questions about its handling of biometrics data before handing it over. But, first, ask the purpose for collecting the data. Is it to verify a claimant's identity, or for some other reason? How is the data collected and stored? Will it be encrypted?

If the company gives unsatisfactory answers, think twice before handing over any biometric information.

More information:

• Learn more about the military's use of biometrics.
• What are the possible benefits of implanted microchips and RFID tags for remote employees?