![\"The](\"https:\/\/solutionsreview.com\/identity-management\/files\/2018\/01\/digital-binario-mod.jpg\")
<\/p>\n<\/p>\n
Unfortunately, we have another contender for Breach of the Month. In fact, this one could radically change the trajectory of modern authentication<\/a>, depending on the aftermath.\u00a0<\/span><\/p>\n Yesterday, security researchers Noam Rotem and Ran Locar announced the discovery of a security hole in Suprema\u2019s network. Based in South Korea, Suprema serves as a biometric authentication and identity security provider across the globe. The security hole allowed the researchers access to the authentication data of more than 1 million users. This information includes facial recognition data, fingerprints, unencrypted usernames, and passwords.\u00a0<\/span><\/p>\n Moreover, the researchers discovered they could view administrator passwords, replace users\u2019 fingerprints, and observe the usage of biometric data. Indeed, Suprema allegedly stored fingerprints unhashed as actual fingerprints, allowing hackers to exploit them.\u00a0<\/span><\/p>\n Additionally, the researchers discovered the exposed personal data records of 27.8 million users in the Suprema Biostar 2 database. The information in this database had no cybersecurity protections and little in the way of encryption. For example, Suprema seemingly stored both user and administrator passwords in the database in plaintext.\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n The researchers worked with <\/span>vpnMentor<\/span><\/a> to discover the security hole. They found it by scanning ports for familiar IP blocks which led them to the public-facing dataset. Allegedly, Suprema proved reluctant to listen to the researchers about the security hole; subsequently, they told <\/span>The Guardian <\/span><\/i>the hole had been plugged and that they would inform customers of any resulting threat. However, it remains ambiguous whether a malicious threat actor discovered the vulnerability before the researchers.\u00a0<\/span><\/p>\n The Suprema Breach represents the first major breach of biometric data of its kind. Of course, the potential consequences become impossible to predict accurately. We don\u2019t know whether hackers ever discovered the problem previous to the researchers\u2019 discovery. As such, we don\u2019t know whether hackers weaponized the data already.\u00a0<\/span><\/p>\n If they had, the Suprema breach indicates the dangers of over-relying on biometric authentication. Across our articles, we constantly decry the usage of passwords in enterprise authentication; we stand by those assessments of passwords as unreliable, easily cracked, and damaging to business workflows.\u00a0<\/span><\/p>\n However, the real issue doesn\u2019t lie with passwords but with single-factor authentication. Any time your enterprise only places a single layer of identity security between access request and database puts your entire business at risk. The Suprema Breach shows not even biometrics are immune to this maxim.\u00a0<\/span><\/p>\n Instead, your enterprise needs to embrace biometric authentication<\/a> through the lens of multifactor authentication<\/a> (MFA). The more layers you can enact, the more challenge hackers face in trying to breach your databases. Even if biometric data becomes compromised, it doesn\u2019t leave you completely vulnerable.\u00a0<\/span><\/p>\n Additionally, please take the Suprema vulnerability as a warning to configure your data storage options. You should never store sensitive data in plaintext, should always hash sensitive data, and databases should never face the public. In fact, you should deploy step-up authentication to ensure only the most trusted users can access the data.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n What does the Suprema breach mean in the long and short term? How can enterprises learn from it, and how can they prepare? We consulted with identity management and security experts to find out. Here\u2019s what they say:\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n This data breach comes at a critical moment, as a growing number of consumers are comfortable using biometric technology on a daily basis to unlock their phone or authorize a digital payment. Storing sensitive biometric data without encryption, such as the actual fingerprint and facial recognition information compromised with this breach, is gross negligence.\u00a0<\/span><\/p>\n At the bare minimum, biometric data requires strong encryption but additional steps, like hashing and creating mathematical models that can\u2019t be reverse engineered, should be applied to further increase data security. Retaining the actual fingerprint images proves dangerous on behalf of Suprema; biometrics cannot be changed and this puts 28 million people at extreme risk.\u00a0<\/span><\/p>\n If a username or password is compromised, consumers can recover the account and update their credentials. This won\u2019t work with biometrics\u2014once the information is leaked, the end-user is out of luck and their biometrics can be used in future attacks.\u00a0<\/span><\/p>\n This data breach proves that biometric data remains extremely valuable to fraudsters, but when used on its own, isn\u2019t enough to prove an individual\u2019s identity. This is why liveness detection is absolutely crucial in the digital identity verification process. A liveliness check can quickly ensure an account holder is physically present during the transaction to prevent cybercriminals from spoofing a system using stolen biometric data in an attempt to acquire someone else\u2019s privileges or access rights.\u00a0\u00a0\u00a0<\/span><\/p>\n The Suprema incident is the first reported biometric database breach and is yet another example of a company that exposed highly sensitive consumer data due to a simple security mistake. Leaving a database publicly accessible is unacceptable\u2014especially given the extremely sensitive data with which Suprema is entrusted. While it is not currently known exactly how many accounts were compromised, it is reported that fingerprints and facial recognition records for millions of people have been exposed.<\/span><\/p>\n To avoid a similar mistake, organizations must have full visibility and control over their customer data. Security platforms that enforce real-time access control, encrypt sensitive data at rest, manage the sharing of data with external parties, and prevent the leakage of sensitive information are critical for organizations that want to be certain that their data is truly safe. Likewise, cloud security posture management (CSPM) is an indispensable tool in detecting misconfigurations that expose data.<\/span><\/p>\n Suprema\u2019s breach exposing biometric records for more than 28 million people\u2014including fingerprint data, facial recognition data, and face photos of users\u2014d<\/span>isrupts the long-held belief that biometrics are the most effective authentication solution. This breach not only exposes individuals to fraud but also makes them indefinitely vulnerable to future attacks, as biometrics, unlike passwords or credit card numbers, cannot be changed.<\/span><\/p>\n Today\u2019s cybersecurity ecosystem has commoditized the sale of consumer records and credentials on the dark web, making passwords and other traditional authentication methods easily susceptible to account takeover attacks. Biometric authentication technology emerged as the go-to solution in a post-password world. However, comprising the biometrics of millions of users could have long-term impact on its viability and security. We are in uncharted territory because this is the first major biometric breach to-date, and it\u2019s unclear how immediately cybercriminals will be able to weaponize this information to the detriment of 28 million victims impacted and 5,700 organizations currently using Suprema\u2019s biometric identity technology.\u00a0<\/span><\/p>\n What is clear, however, is that this highly-sensitive information should have never been left on an unprotected database. Data powers today\u2019s global economy, and businesses must understand their threat landscape and implement a proactive approach to fraud prevention.<\/span><\/p>\n The unprecedented Suprema breach today underscores why we still can\u2019t rely on a single factor or method of authentication. Whether you choose passwords or biometrics, there is always a risk that the factor will be compromised. Arguably, biometrics are a much stronger method of authentication than passwords and provide an improved user experience, but this risk is now much more real because of this breach.<\/span><\/p>\n This doesn\u2019t mean that we\u2014as an industry and consumers of biometrics\u2014need to jump ship. But we must scrutinize how and where we store our data, and understand what that means for our risk tolerance.<\/span><\/p>\n At this point in time, the breach report states that in addition to usernames and passwords, fingerprint data and facial recognition data leaked as well. It\u2019s important to remember that this doesn\u2019t necessarily mean that your actual fingerprint or face map data has been compromised. Some biometric solutions aren\u2019t actually storing a \u201cscan\u201d of your fingerprint, but rather the result of the scanner \u201cfingerprinting\u201d the key data points that make your fingerprint or facial scan unique.<\/span><\/p>\n We don\u2019t have enough data at this time to make a conclusion on how Suprema is storing biometric data, but it does remind us to ask questions of these biometric companies of how they are storing this information.\u00a0<\/span><\/p>\n Thanks to our identity management experts for their time and expertise! The Suprema breach may change the conversation about Biometric Authentication, but your enterprise should still consider incorporating biometric authentication in its access management. To learn more, check out our 2019 Biometric Authentication Buyer\u2019s Guide<\/a> or our 2019 Identity Management Guide<\/a>.\u00a0\u00a0<\/span><\/p>\n Unfortunately, we have another contender for Breach of the Month. In fact, this one could radically change the trajectory of modern authentication, depending on the aftermath.\u00a0 Yesterday, security researchers Noam Rotem and Ran Locar announced the discovery of a security hole in Suprema\u2019s network. Based in South Korea, Suprema serves as a biometric authentication and […]<\/p>\n","protected":false},"author":41,"featured_media":2227,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5,1],"tags":[142,1166,125,1208,237,56,16,112,76,1169,145,91,208,1214,1215],"acf":[],"yoast_head":"\n\t\t\t![\"Download](\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/01\/biometric-authentication-speedbump-cta.jpg\" "\\"Biometric")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\nOur Take on the Suprema Breach<\/b><\/h2>\n
What the Experts Said on the Suprema Breach<\/b>\u00a0<\/span><\/h2>\n
Robert Prigge, President, <\/b>Jumio<\/b><\/a><\/span><\/h3>\n
Anurag Kahol, CTO,<\/b> Bitglass<\/b><\/a><\/span><\/h3>\n
Kevin Gosschalk, CEO,<\/b> Arkose Labs<\/b><\/a><\/span><\/h3>\n
Jeff Hickman, Director of Solutions Engineering,<\/b> SecureAuth<\/b><\/a><\/span><\/h3>\n
<\/div><\/p>\n
Widget not in any sidebars
<\/p>\n","protected":false},"excerpt":{"rendered":"