Identity-bound biometric measurements give the user a convenient way to authenticate who they are. Fingerprints, voice recognition, and other biometric methods are nontransferable; they can’t be lost, stolen, or faked. But beyond a secure method for authentication and the convenience for the user, companies are also considering the best ways to manage access and retain control over the integrity of their cybersecurity practices. 

Device-based and identity-bound approaches 

Even with biometric authentication methods, organizations need to understand differences in the level of security device-based biometrics offer versus identity-bound approaches. One of the key security differences is who has control over the biometric enrollment. With device-based biometrics, the power of enrollment is given to the user rather than the company. The user’s identity is enrolled and stored on the device, giving anyone with access to the device the ability to enroll additional users. When companies surrender the power of enrollment, they develop a security blind spot. They can verify that an enrolled user acted on an approved device, but this falls short of the company actually confirming that the enrolled user is the authorized user they intend to have access. What is being verified is an encrypted key from a device that ultimately has no direct connection to the person themselves. 

Identity-bound biometrics have users enroll their biometric measurements, which the organization then stores. For example, the data from a fingerprint is enrolled with the company, encrypted, algorithmically changed, and stored to be paired with the input from a user logging in, going through the same encryption and algorithmic process. By centralizing the biometric templates, organizations gain two distinct advantages. First, they can grant or restrict access to a single user across multiple devices and locations. This means that the authentication needed to log in can be verified from any device rather than enrolling a user onto every device they need access to, giving the user the flexibility to switch from device to device without re-enrollment. This agility and convenience are especially important when a worker deals with sensitive information, like financial statements across multiple locations.

Second, centralized enrollment also closes the security gap present in device-based options where unauthorized enrollments are possible based on access to the device. By maintaining the power to choose who has and does not have access centrally rather than on the device, unauthorized users cannot exploit device access to gain entry to the system at large. 

While biometrics offer a secure way to confirm a person’s identity, how that data is stored and managed impacts its level of security and, even more importantly, its integrity. In order to build trust and maintain a good reputation, companies need to factor in their own visibility into the identity of users accessing their systems beyond what a person knows or what they own and into the realm of actually verifying who they are. By keeping the power of enrollment, companies can stop data breaches or leaks, manage access across platforms and devices, and trust that the user is whom they say they are.