GSEC practice question 9 of 35

An attacker gained physical access to an internal computer to access company proprietary dat a. The facility is protected by a fingerprint biometric…

Choose your answer, then check it against the explanation.

Domain Security Policy

An attacker gained physical access to an internal computer to access company proprietary dat a. The facility is protected by a fingerprint biometric system that records both failed and successful entry attempts. No failures were logged during the time periods of the recent breach. The account used when the attacker entered the facility shortly before each incident belongs to an employee who was out of the area. With respect to the biometric entry system, which of the following actions will help mitigate unauthorized physical access to the facility?

Answer options

Correct Answer:

Explanation

The scenario describes a Type II error, where an unauthorized individual was incorrectly authenticated by the biometric system. This is known as a False Accept. To mitigate this specific vulnerability, the system's matching threshold must be made more stringent. Lowering the False Accept Rate (FAR) directly addresses this by reducing the probability that an imposter is accepted as a legitimate user. This adjustment makes the system more secure against unauthorized access, although it may consequently increase the False Reject Rate (FRR), potentially inconveniencing valid users.

Why Incorrect

A. Try raising the Crossover Error Rate (CER): Raising the CER indicates a less accurate system overall, which is counterproductive to enhancing security.

C. Try setting the Equal Error Rate (EER) to zero: The EER (or CER) is a point where FAR equals FRR. Setting it to zero implies a perfect, error-free system, which is practically unattainable.

D. Try to set a lower False Reject Rate (FRR): Lowering the FRR makes the system more lenient and increases the likelihood of a false acceptance, exacerbating the problem described.

---

References

1. Jain

A. K.

Ross

& Prabhakar

S. (2004). An introduction to biometric recognition. IEEE Transactions on Circuits and Systems for Video Technology

14(1)

4-20. In Section III.A

"Biometric System Errors

" the paper defines the False Acceptance Rate (FAR) as "the probability that the system incorrectly declares a successful match between the input pattern and a nonmatching template in the database" (p. 8). The scenario is a direct example of this error. DOI: https://doi.org/10.1109/TCSVT.2003.818349

2. National Institute of Standards and Technology (NIST). (2011). NIST Special Publication 800-76-2: Biometric Data Specification for Personal Identity Verification. In Section 1.5

"Conformance

" the document defines False Accept Rate (FAR) and False Reject Rate (FRR) as key performance metrics. The trade-off is explained

where decreasing one (e.g.

FAR for higher security) typically increases the other.

3. Woodward

J. D.

Orlans

N. M.

& Higgins

P. T. (2003). Biometrics. McGraw-Hill/Osborne. In Chapter 3

"Leading Biometric Technologies

" the relationship between FAR and FRR is detailed

explaining that system administrators must tune the sensitivity threshold to balance security (low FAR) and convenience (low FRR). The scenario requires prioritizing security by lowering the FAR.

4. Grother

& Ngan

M. (2014). NIST Interagency Report 8004: Face Recognition Vendor Test (FRVT) Performance of Face Recognition Algorithms. Section 2.1

"Error Rates

" defines the False Match Rate (FMR)

equivalent to FAR

and the False Non-Match Rate (FNMR)

equivalent to FRR

as fundamental error metrics for biometric systems. It discusses how thresholds are set to achieve a desired low FMR for high-security applications.

Question 9 of 35

Keep practicing

Take the free GSEC practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test