2 cissp ® Official Study Guide Eighth Edition

Biometric Registration
Biometric devices can be ineffective or unacceptable due to factors known as enrollment 
time, throughput rate, and acceptance. For a biometric device to work as an identifica-
tion or authentication mechanism, a process called 
enrollment
(or registration) must take 
place. During enrollment, a subject’s biometric factor is sampled and stored in the device’s 
database. This stored sample of a biometric factor is the 
reference profile
(also known as a 
reference template
).
The time required to scan and store a biometric factor depends on which physical or 
performance characteristic is measured. Users are less willing to accept the inconvenience 
of biometric methods that take a long time. In general, enrollment times over 2 minutes 
are unacceptable. If you use a biometric characteristic that changes over time, such as a 
person’s voice tones, facial hair, or signature pattern, reenrollment must occur at regular 
intervals, adding inconvenience.
The 
throughput rate
is the amount of time the system requires to scan a subject and 
approve or deny access. The more complex or detailed a biometric characteristic, the longer 
processing takes. Subjects typically accept a throughput rate of about 6 seconds or faster.
Multifactor Authentication
Multifactor authentication
is any authentication using two or more factors. 
Two-factor 
authentication
requires two different factors to provide authentication. As an example, 

---

600
Chapter 13 
■
Managing Identity and Authentication
smartcards typically require users to insert their card into a reader and enter a PIN. 
The smart card is in the something-you-have factor, and the PIN is in the something-
you-know factor. As a general rule, using more types or factors results in more secure 
authentication. 
Multifactor authentication must use multiple types or factors, such as 
the something-you-know factor and the something-you-have factor. In 
contrast, requiring users to enter a password and a PIN is not multifactor 
authentication because both methods are from a single authentication fac-
tor (something you know).
When two authentication methods of the same factor are used together, the strength of 
the authentication is no greater than it would be if just one method were used because the 
same attack that could steal or obtain one could also obtain the other. For example, using 
two passwords together is no more secure than using a single password because a password-
cracking attempt could discover both in a single successful attack. 
In contrast, when two or more different factors are employed, two or more different 
methods of attack must succeed to collect all relevant authentication elements. For exam-
ple, if a token, a password, and a biometric factor are all used for authentication, then a 
physical theft, a password crack, and a biometric duplication attack must all succeed simul-
taneously to allow an intruder to gain entry into the system.