Application and Acquisition Support Services
There are a number of factors that should be considered when evaluating the deployment of biometric technology as a risk management tool for identity assurance. These include:
- Cost: In certain environments (i.e.: consumer applications such as retail banking) end-user applications may require thousands of devices which could translate into hundreds of thousands of dollars in device costs alone.
- User Acceptance: Privacy, hygiene and cultural concerns may impact end user acceptance and adoption of the technology despite the security enhancements it offers.
- Quality of Breeder Documents: The vetting of ID verification enrollment documents is especially critical in biometric applications.
- Storage and Management of Templates: Who will store and manage the biometric templates? What resources will be required to provide the stringent security measures that must be undertaken to protect the data? Will the user organization assume this responsibility or will it be outsourced it to a "trusted advisor" whose security measures are beyond reproach?
These are only a few of the considerations that should be assessed as part of a rigorous requirements definition process. Some of the elements of a thorough requirements definition, which BSI can help develop, include:
- Operational requirements surveys
- What is being protected and against what threat?
- What is the vulnerability assessment of the operating environment?
- Application impact studies
- Frame commercial/operational issues that will envelop the operational parameters of the biometric technology to be deployed.
- Minimize impact on ability to function efficiently
- Privacy Impact Assessment
- Defined scenarios for policy planning
- Test the validity of field operations concept
- Pre-implementation planning is critical
- Systems design parameters
- Probe the initial system design for potential gap analyses; evaluate the proposed system architecture against the operational requirements.
- Statements of work and source selection
- SOW's must be requirements-driven as opposed to technology- focused.
- Technology performance analyses
- Field test the system for real-world performance
- Training and evaluation
- Management, technical, and maintenance training is crucial to success