Technical Control Classification

          If you stored your fortune in a safe deposit box, you wouldn’t keep the key hanging on a hook outside your house. The same should be true of your passwords: if you keep them written on sticky notes at your desk, they’re not safe. But even if you don’ write them down, there are many ways that someone might discover your

          I look at some of the ways your passwords might fall into the wrong hands, and give you tips on keeping them safe. I also discuss recovering forgotten passwords, backing up your passwords, and devising a plan to ensure that your passwords are available in case of emergency.

In the previous chapter, we discussed information security. After reading this chapter on information privacy, you should realize that these concepts are very much related in practice. Security is the protection of information against threats such as unauthorized access to data, falsification of data, or denial of service. A company can provide every security protection possible for your information against these threats without necessarily having the intent of protecting the confidentiality of your information. Thus, information privacy is different than information security, even if these concepts are often used interchangeably.

          Technical protection is also referred to as logical protection. A simple way to recognize technical protection is that technical controls typically involve a hardware or software process to operate. Let's start with technical controls, which are also known as automated controls.

          Technical protection may be implemented by using a combination of mandatory controls, discretionary controls, or role-based controls. Let's discuss each:

          There are three broad categories of authentication: something you know (usually a password); something you are (a unique, measurable physical characteristic, such as a fingerprint or iris pattern); and something you have (a smart card, token, or other device that can be identified uniquely—something I don’t cover in this book).

          Passwords provide a reasonably good way to protect access to data and resources, but in some cases they may not be enough. After all, passwords can be guessed, found, or stolen. So where greater security is needed, you may want to use other forms of authentication instead of a password—or, better yet, in addition to one.

Types of Cryptography

         No matter what efforts an organization may make to provide the best security possible, and all of the technologies and tools they might invest in, there are always security risks involved. Risk management is the process of identifying, assessing, and prioritizing the security risks an organization may face. As a result of this process, organizations may decide to accept the risks, try to mitigate or prevent those risks by investing in security protections, or share the security risks with another organization, for example by buying insurance. Organizations can refer to different standards for risk management that are available from organizations like the Project Management Institute, the National Institute of Science and Technology, and the International Standards Organization.

Most medium to large organizations today have security policies, which describe what the general security guidelines are for an organization. Security policies tend to be for internal use. The policies include a number of security procedures, which are specific statements describing how to implement the security policies. For example, a security policy could be “All users must change their passwords every two months.” One of its related security procedures could then describe steps to be taken to change one's password. Another procedure could involve an automated system to force users to change their password every two months, while an additional one could include actions that should happen if a user attempts to enter an unacceptable (not strong) password. A security policy should have clear goals and objectives, a detailed list of security policies and procedures, and also a list of actions for the enforcement of procedures.

         There are two main types of cryptographic system used today: asymmetric or symmetric. This is based on whether the same key is issued to encrypt and decrypt the data or not. In asymmetric encryption, two keys are used. The public key is used to encrypt messages. It is sent to any person or system with which one wishes to exchange encrypted messages. Using the public key, anyone can encrypt messages for the intended recipient, who will then use their private key to decrypt those messages. The public key and the private key are linked (forming a key pair), but only the recipient has the private key. This is also called public key cryptography since one of the keys can be shared with anyone (public).

QUALITY-BASED RANK FUSION METHOD

Quality-based rank fusion method depends not only on the ranking list of the unimodal classifiers, but also on the quality of the input images. Usually, this method applies on other biometric rank fusion approach with the modification by incorporating the quality of the input image. Quality based fusion methods usually do not have any training phase and hence can be used in other biometric information fusion process, such as fuzzy logic based fusion. There is no specific rule or general equation for quality based fusion method. Researchers can apply this method to any of their existing methods to improve the identification or verification rate. For example, Abaza and Ross introduced a quality based rank fusion method by modifying the exist.

Different existing methodologies for rank level fusion methods for multimodal, biometric system have been reviewed. The methods for rank level fusion include plurality voting method, highest rank method, Borda count method, logistic regression method, and quality-based rank fusion method. Advantages and disadvantages of all of these rank fusion methods have been discussed in the context of current state of the art in the discipline. Also, with the help of appropriate diagrams, outcomes of different possible rank fusion methods have been shown. In the next chapter, a new rank fusion method, the Markov chain based rank fusion method will be discussed which has several advantages over the traditional rank fusion methods.

Before we discuss each of the security tools, we need to briefly mention that all tools and policies are meant to address one or more core security goals, which are known as CIA – Confidentiality, Integrity, and Availability.

   Confidentiality involves making sure that only authorized individuals can access information or data. Integrity involves making sure that data are consistent and complete. For example, as a message is transmitted, its content is not modified unwillingly during the transmission. Finally, availability involves ensuring that system and/or data are available when they are needed. For systems to be considered highly available, the organization must protect them from disruptions not only due to security threats such as denial of service attacks, but also due to power outages, hardware failures, and system upgrades.

PLURALITY VOTING RANK FUSION METHOD

The plurality voting method is a positional method for rank aggregation which takes into account information about individuals' preference orderings. However, this method does not take into account a matcher's entire preference ordering, instead uses only information about each voter's most preferred alternative. This method is good for combining a small number of specialized matchers. In this method, the consensus ranking is obtained by sorting the identities according to their number of position in the top position. The algorithm is adopted from Abaza and Ross.

 Algorithm 1:             Plurality voting

o    Get three ranking lists from different biometric classifiers.

The highest rank method is good for combining a small number of specialized matchers and hence can be effectively used for a multimodal biometric system where the individual matchers perform well. In this method, the consensus ranking is obtained by sorting the identities according to their highest rank.

The steps in Algorithm 2 show the procedure of employing highest rank fusion method in a multimodal biometric system.

Algorithm 2: Highest rank

o    Get the ranking lists from different biometric classifiers.

o    For all ranking lists 

FUSION AFTER MATCHING BIOMETRICS

There are a number of challenges in this area, requiring further investigation. The first one is rooted in the choice of a fusion method, most appropriate for the application domain. The decision is often made ad-hoc, or based on non-essential constraints such as availability of the fusion module, low cost, etc, instead of being made based on actual fit of the application area and the method.

Arguably, one of the critical components of the multimodal biometric system development is an information fusion module. It is also a component which is most versatile in the form of input data (processed or unprocessed), types of features (geometric, signal, appearance-based, etc), and decision making process (adaptive, intelligent, fuzzy, learning-based, heuristic-based) it can utilize. Needless to say, the initial choice of biometric—physical, behavioral, soft, or social would both be an input to the information fusion process and dictate some of the choices to be made.

A general rule in theory assumes that the integration of data at an early stage of processing leads to systems which might be more accurate than those where the integration is introduced at later stages. Unfortunately, in practice, fusion at sensor level is hard to achieve, due to the different natures of the biometric traits, which might be hardly compatible (e.g., fingerprint and face). Moreover, most commercial biometric systems do not provide access to the feature sets vanishing the feasibility of a fusion at feature level. Fusions at matching level and at decision level do not require the creation of new databases or matching modules (the ones which constitute the mono modal subsystems are employed).

The rank level fusion approach is used in biometric identification systems when the individual matcher’s output is a ranking of the “candidates” in the template database sorted in a decreasing order of match scores (or, an increasing order of distance score in appropriate cases). The system is expected to assign a higher rank to a template that is more similar to the query. Plurality voting method, highest rank method, Borda count method, logistic regression method, Bayesian method and quality based method are reported in the literature to perform rank level fusion in multi biometric system. All of these biometric rank fusion approaches.

FUSION BEFORE MATCHING BIOMETRICS

Fusion in this category integrates evidences before matching or comparison of data samples against the user sample occurs. According to Kokar et al., “By combining low level features it is possible to achieve a more abstract or a more precise representation of the world”. Thus, biometric sources at the earlier stage contain much more information than after processing.

However, the extra costs of storing raw data and additional complexity in developing matching methods do not make this approach quite practical.

Fusion after-matching methods consolidate information obtained after individual biometric matching or comparison is done. Most multimodal biometric systems have been using these fusion methods as the information needed for fusion is easily available compared to fusion before matching methods. The matching scores, the ranking list (sorted order) based on matching scores or the individual biometric decision (Yes/No) can be used for fusion in this category.

Information fusion techniques applied in multimodal biometrics area are discussed. Usually, the information originated from different sources in a multimodal biometric system can be combined in senor level, feature extraction level, match score level, rank level, and decision level. Among all of the fusion methods, senor fusion and feature extraction level fusion considered as the stage for combining raw data or the actual biometric data. Match score, rank and decision level fusion methods combine processed data or data obtained through some experimentations. There is also another novel fusion method which is becoming highly popular: the fuzzy fusion.

BIOMETRIC INFORMATION FUSION

Information fusion can be defined as “an information process that associates, correlates and combines data and information from single or multiple sensors or sources to achieve refined estimates of parameters, characteristics, events and behaviors”. A good information fusion method allows the impact of less reliable sources be lowered compared to reliable ones. A number of disparate research areas including robotics, image processing, pattern recognition, information retrieval etc. utilize and describe information fusion in their context. Thus, information fusion established itself as an independent research area over the last decade for its impact on a vast number of disparate research areas. For example, the concept of data and feature fusion initially occurred in multi-sensor processing. In fact, information fusion was for a long time used in engineering and signal processing fields, as well as in decision-making and expert systems. By now, several other research fields found its application useful. Besides the more classical data fusion approaches in robotics, image processing and pattern recognition, the information retrieval community has been known to combine multiple information sources. The basic building block of an information fusion system which fuses source information at the early stage of the system?

BIOMETRIC INFORMATION FUSION

Due to some problems associated with the unimodal biometric data, such as small variation over the population, large intra-variability over time, absence of biometric sample in portion of a population etc., the use of multimodal biometrics is a first choice solution. The main objective of a multimodal biometric system is to improve the recognition performance of the system and to make the system robust over the limitations associated with unimodal biometric systems. Over the years, several approaches have been proposed and developed for multimodal biometric authentication system with different biometric traits and with different fusion mechanisms.

Multimodal biometric systems use multiple sources of biometric information, whereas information fusion is essential for analysis, indexing and retrieval of such information . There are numbers of fusion techniques for any particular information. Choosing appropriate fusion techniques for any specific information depends on the necessity of the application and the performance of the fusion techniques proven by previous research. There is a consensus in biometric literature that all various levels of multimodal biometric information fall into two broad categories: before matching and after matching fusion. Fusion before matching category contains sensor level fusion and feature level fusion, while fusion after matching contains match score level fusion, rank level fusion and decision level fusion. A novel fusion mechanism has been established recently in BT Lab is based on fuzzy logic fusion, and hence named a fuzzy biometric fusion. Fuzzy biometric fusion can be employed either in the initial stage, i.e. before matching occurred or in the latter stage, i. e. after matching occurred.