How to protect computers that store biometric data from malware

Biometrics are meant to supply a more secure and a lot easier way of safeguarding sensitive information. Using your fingerprint, your face, or your voice to indication into an account or retrieve personalized facts is considered a far better and safer option than trying to juggle an array of passwords. Biometry-based authentication is being used to accessibility authorities and professional workplaces, industrial automation units, company computers, private laptops, and cellular telephones.

But what about the computer systems that gather, process, and retail store biometric data? Are they protected, and if not, how do you far better protect individuals techniques? A analyze produced Wednesday by Kaspersky describes how malware has influenced servers and workstations with biometric details and features advice on how to safeguard people pcs.

SEE: Specific report: A profitable technique for cybersecurity (free PDF) (TechRepublic) 

Wanting at the first nine months of 2019, Kaspersky ICS CERT industry experts investigated cybertheats which qualified personal computers utilized to gather, method, and retailer biometric facts. Particularly, the computers analyzed ended up types that ran Kaspersky protection products so the enterprise could fully look at them.

Just for the 3rd quarter, some 37% of the pcs bundled in the analyze were being strike by at the very least one malware infection, all of which were being blocked by Kaspersky software program. Specially, 5.4% of the threats detected and blocked ended up fashionable remote-obtain Trojans, 5.1% were malware applied in phishing assaults, 1.9% ended up ransomware, and 1.5% were being Trojan bankers (Figure A).

Figure A

The internet popped up as the best resource for the malware assaults, accounting for 14.4% of the infections analyzed and blocked by Kaspersky. These sorts of attacks incorporated threats observed on destructive and phishing websites as very well as net-based mostly e mail providers.

Next, detachable media was the perpetrator in 8% of the attacks identified, most often utilised to distribute worms. Soon after hitting a computer, worms can obtain spy ware, remote entry Trojans, and ransomware.

Electronic mail threats rated third, accounting for 6.1% of the attacks in this situation. In most instances, these were being the normal phishing email messages with phony messages about the shipping of items and services or the payment of invoices. The messages contained one-way links to destructive web-sites or hooked up Microsoft Office paperwork with malicious code.

“Our investigate reveals that the current situation with biometric facts protection is critical and needs to be introduced to the consideration of business and government regulators, the group of information security professionals, and the normal community,” Kirill Kruglov, senior security specialist at Kaspersky ICS CERT, reported in a press launch. “Even though we believe our buyers are cautious, we will need to emphasize that an infection induced by the malware we detected and prevented could have negatively affected the integrity and confidentiality of biometric processing programs. This is specifically the scenario for databases the place biometric details is stored, if these devices had been not protected.”

To assist organizations superior protected the pcs that tackle biometric knowledge, Kaspersky delivers the subsequent recommendations:

1) Minimize the exposure of biometric systems to the online and internet-linked threats. Ideally, these types of devices should really be section of an air-gapped infrastructure, which signifies no link (wired or wi-fi) to the world-wide-web and no connection to any other units that connect to the internet. Cybersecurity really should be of the maximum priority when new methods like this are built and implemented.

2) Guarantee that the optimum-amount of cybersecurity requirements are used to the biometric methods. This recommendation contains the next steps:

• Thoroughly teach the operating personnel on how to resist potential cyberattacks.
• Make sure that all important cybersecurity controls are in area.
• Enlist a devoted group of remarkably-skilled protection professionals to keep keep track of of infrastructure security.
• Often perform safety audits to determine and reduce probable vulnerabilities.
• Guarantee that latest strategic and tactical danger intelligence is frequently provided to the cybersecurity crew.

Cybersecurity Insider E-newsletter

Reinforce your organization’s IT protection defenses by preserving abreast of the newest cybersecurity information, remedies, and greatest procedures.
Delivered Tuesdays and Thursdays

Sign up now

Also see