2 cissp ® Official Study Guide Eighth Edition

Biometrics
Another common authentication and identification technique is the use of 
biometrics
. 
Biometric factors
fall into the Type 3, something you are, authentication category.

---

596
Chapter 13 
■
Managing Identity and Authentication
Biometric factors can be used as an identifying or authentication technique, or both. 
Using a biometric factor instead of a username or account ID as an identification fac-
tor requires a one-to-many search of the offered biometric pattern against a stored 
database of enrolled and authorized patterns. Capturing a single image of a person 
and searching a database of many people looking for a match is an example of a one-
to-many search. As an identification technique, biometric factors are used in physical 
access controls.
Using a biometric factor as an authentication technique requires a one-to-one match of 
the offered biometric pattern against a stored pattern for the offered subject identity. In 
other words, the user claims an identity, and the biometric factor is checked to see if the 
person matches the claimed identity. As an authentication technique, biometric factors are 
used in logical access controls.
Biometric characteristics are often defined as either physiological or behavioral. 
Physiological biometric methods include fingerprints, face scans, retina scans, iris scans, 
palm scans (also known as palm topography or palm geography), hand geometry, and 
voice patterns. Behavioral biometric methods include signature dynamics and keystroke 
patterns (keystroke dynamics). These are sometimes referred to as something-you-do 
authentication.
Fingerprints Fingerprints
are the visible patterns on the fingers and thumbs of people. 
They are unique to an individual and have been used for decades in physical security for 
identification. Fingerprint readers are now commonly used on laptop computers and USB 
flash drives as a method of identification and authentication.