Friday, April 23, 2010

IDF buys computers to prevent further information theft

From The Jerusalem Post:
Some of the new computers... will come with specially-designed keyboards that can only be accessed by the insertion of a smart card into its side and the biometric identification of the designated user’s fingerprint.
Token: Something you have.
Password: Something you know.
Biometric: Something you are.

The system described above combines two of the three (and I'd be surprised if passwords aren't used as well) to increase the confidence that those who access the computers in question are who they say they are.

The smart card in this example is the token. Your house key is also a token. Tokens are issued to someone whose identity is known so that they might access a virtual or physical location. The vulnerability of (most) tokens is that they work, no matter who possesses them.

One major redeeming quality of tokens, however is that they are not easily duplicated and when someone loses one, they usually know it and then at least they don't still have it. If there is one key to your house and you lose it, you only have to worry about on key.

This is not true of passwords. Passwords are information and the thing that's great about information is that it's practically free to reproduce and disseminate. That does make for pretty weak security, though. If you lose control of the password to a computer network you might not know it and it can be shared without limit.

Stand-alone, unattended biometric tools are also imperfect solutions. The Mythbusters overcame a fingerprint sensor, for example. But by combining tokens, passwords and biometrics, the security of high value systems can be dramatically improved.