2 cissp ® Official Study Guide Eighth Edition

Face Scans Face scans
use the geometric patterns of faces for detection and recognition. 
Facebook has been using facial recognition software for years to provide tag suggestions. 
For example, if a picture of yourself combined with your name exists on Facebook (such 
as in your profile picture), it can use this information to identify you. It scans newly posted 
pictures and provides tag suggestions (the name of the person in the picture). Every time 
someone tags you in a photo, it provides more information for Facebook to correctly iden-
tify you the next time your picture is posted. Facebook has recently started allowing users 
to unlock their account using facial recognition along with another authentication method. 
Casinos use it to identify card cheats. Law enforcement agencies have been using it to catch 
criminals at borders and in airports. Face scans are also used to identify and authenticate 
people before accessing secure spaces such as a secure vault.
Retina Scans Retina scans
focus on the pattern of blood vessels at the back of the eye. 
They are the most accurate form of biometric authentication and can differentiate between 
identical twins. However, some privacy proponents object to their use because they can 
reveal medical conditions, such as high blood pressure and pregnancy. Older retinal scans 
blew a puff of air into the user’s eye, but newer ones typically use an infrared light instead. 
Additionally, retina scanners typically require users to be as close as three inches from the 
scanner.
Iris Scans
Focusing on the colored area around the pupil, 
iris scans
are the second most 
accurate form of biometric authentication. Like the retina, the iris remains relatively 

---

Comparing Identification and Authentication 
597
unchanged throughout a person’s life (barring eye damage or illness). Iris scans are consid-
ered more acceptable by general users than retina scans typically because scans can occur 
from far way. Scans can often be done from 6 to 12 meters away (about 20 to 40 feet). 
However, some scanners can be fooled with a high-quality image in place of a person’s eye. 
Additionally, accuracy can be affected by changes in lighting and the usage of some glasses 
and contact lenses. 
Palm Scans
Palm scanners
scan the palm of the hand for identifi cation. They use near-
infrared light to measure vein patterns in the palm, which are as unique as fi ngerprints. 
Individuals simply place their palm over a scanner for a few seconds during the registra-
tion process. Later, they place their hand over the scanner again for identifi cation. As an 
example, the Graduate Management Admissions Council (GMAC) uses palm vein readers 
to prevent people from taking the test for others and also to ensure that the same person 
reenters the testing room after a break. 
Hand Geometry
Hand geometry
recognizes the physical dimensions of the hand. This 
includes the width and length of the palm and fi ngers. It captures a silhouette of the hand, 
but not the details of fi ngerprints or vein patterns. Hand geometry is rarely used by itself 
since it is diffi cult to uniquely identify an individual using this method.