<\/p>\n
By Chris Burt<\/p>\n
Many companies in the biometric, digital identity, and cybersecurity<\/a> space have shared predictions for 2020 with\u00a0Biometric Update<\/em>, touching on many of the key themes of the past year, and reflecting the wealth of opportunity, as well as the anxieties at play in the industry. Those predictions most closely thematically related to biometrics and our top news stories are collected below.<\/strong><\/p>\n Biometrics market growth<\/strong><\/p>\n \u201cThe global market for mobile biometrics is forecast to grow at an impressive 31.14 percent CAGR, adding $28.45 billion per year in incremental growth between 2018 and 2023, despite the CAGR decelerating by 22 percent in the period,\u201d points out Robert Prigge, CEO of\u00a0Jumio<\/a>.<\/strong><\/p>\n \u201cThe growth forecasts in the latest set of\u00a0market analyst reports<\/a>\u00a0that indicate widespread adoption of biometrics technology: 22 percent for mobile biometrics, 22 percent for 3D sensors, and 19 percent for healthcare biometrics Facial authentication is impacting the physical security market, cloud-based subscription services are becoming more popular for security, and the Pentagon is expected to remain a source of opportunity for companies offering advanced authentication technologies. Although we are still in the early stages of biometric-based identity proofing and authentication, its development will serve as a viable solution for the growing fraud epidemic.\u201d<\/p>\n This optimism extends to facial recognition for Vanessa Pegueros, chief trust and security officer at\u00a0OneLogin<\/a>.<\/p>\n \u201cWith the convenience of what the iPhone has brought to the masses with facial recognition, end users will continue to expect similar offerings from most if not all applications in 2020,\u201d Pegueros predicts. \u201cAlthough facial recognition has its flaws, the convenience outweighs the concerns for users.\u201d<\/strong><\/p>\n Oliver Smith of\u00a0Shufti Pro<\/a>\u00a0notes that a recent Spiceworks poll shows 90 percent of businesses will use biometrics by 2020, and predicts multimodal biometric systems will reach the mainstream in the year ahead.<\/p>\n \u201cAs the threat of digital fraud and phishing scams increase, biometric technology itself continues to evolve to match growing security needs. In order to mitigate frauds, scams, and hacks, there is a pronounced need for more robust biometric authentication systems,\u201d he says. <\/strong><\/p>\n \u201cAlthough unimodal biometric systems provide a good security layer, security measures are often found to be susceptible to fraud and theft.<\/strong> This has given rise to multimodal biometric systems that utilize at least two or more biometric modalities to verify the identity of the user.\u201d<\/p>\n The password, however, will make it to the end of the year, and perhaps beyond.<\/p>\n \u201c2020 will see biometrics continue to tread water as a secondary authentication factor, with the base authentication mechanism continuing to be the password,\u201d\u00a0<\/strong>Enzoic<\/a>\u00a0CTO Mike Wilson writes in an email. \u201cIt will not make any real headway into meaningfully displacing passwords or passcodes as the primary means of authentication. At the end of 2020, if your Face ID fails to recognize you for the umpteenth time, you\u2019ll still be entering in a passcode to unlock your phone.\u201d<\/p>\n New cybersecurity threats<\/strong><\/p>\n BioCatch<\/a>\u00a0CEO Chief Cyber Officer Uri Rivner says among predicts in a\u00a0blog post<\/a>\u00a0that selfie biometric data will be a money-maker on the dark web.<\/p>\n \u201cThere\u2019s already a vibrant dark web trade in personalized biometric data, and that will continue to grow in 2020. More websites and applications are turning to selfie-based verification and more online account opening flows are moving from obsolete controls, such as Knowledge Based Authentication, to more modern controls, like selfie-document matching,\u201d Rivner explains. \u201cSome criminals will focus on collecting data from open sources and social media. Others will target \u2013 and already have targeted \u2013 users in phishing campaigns designed to steal not just static credentials, but also selfies and videos of the user\u2019s face. Another threat is that advanced malware capabilities, which are currently in the hands of state sponsored actors and other high-end players, will find their way to criminal hands and be used to break into mobile device authentication.\u201d<\/p>\n Corey Nachreiner, CTO at\u00a0WatchGuard Technologies<\/a>\u00a0predicts multi-factor authentication will finally reach general adoption among enterprises in the coming year.<\/p>\n \u201cThe ease of use both for the end user and the IT administrator managing these MFA tools will finally enable organizations of all sizes to recognize the security benefits of additional authentication factors,\u201d he says. \u201cThat\u2019s why we believe enterprise-wide MFA will become a de facto standard among all midsized companies next year.\u201d<\/strong><\/p>\n Changing demographics will drive adoption of AI in the finance industry, Labhesh Patel, Jumio CTO and chief scientist predicts.<\/p>\n \u201cCustomer experience and fraud detection will go hand in hand in the finance industry, especially as Millennials are 2.5 times more likely than Baby Boomers and 1.5 times more likely than Gen Xers to switch banks. Machine Learning and AI will serve a dual function in financial services and banking. Not only will AI help speed up and improve the verification and accuracy of new customer onboarding, it will also provide a reliable means of continued identity authentication for each subsequent customer login in order to thwart sophisticated attacks.\u201d<\/strong><\/p>\n He sees dramatic improvements in fraud prevention based on the change.<\/p>\n With adoption comes the potential for dangerous complacence, however, according to\u00a0CyberArk Labs<\/a>\u00a0Group Research Manager Lavi Lazarovitz.<\/p>\n \u201cAustralia\u2019s Digital Transformation Agency (DTA) recently announced that it will integrate biometric authentication with its myGov citizen services. As biometric authentication becomes increasingly popular, we\u2019ll begin to see a level of unfounded complacency when it comes to security,\u201d he says.<\/p>\n \u201cWhile it\u2019s true that biometric authentication is more secure than traditional, key-based authentication methods, attackers typically aren\u2019t after fingerprints, facial data or retinal scans,\u201d Lazarovitz adds. \u201cToday, they want the access that lies behind secure authentication methods. So, while biometric authentication is a very good way to authenticate a user to a device, organisations must be aware that every time that happens, that biometric data must be encrypted and the assets behind the authentication are secure.<\/p>\n <\/p>\n Even more importantly, the network authentication token that\u2019s generated must be protected. That token, if compromised by attackers, can allow them to blaze a trail across the network, potentially gaining administrative access and privileged credentials to accomplish their goals \u2013 all while masquerading as a legitimate, authenticated employee.\u201d<\/p>\n The changing cybersecurity landscape will also impact the industry\u2019s makeup, according to Enzoic\u2019s Wilson, with acquisitions of startups increasing.<\/p>\n \u201cFor years, the security ecosystem has been viewed as a top area for startup innovation but in 2020, expect the tide to turn,\u201d he observes. \u201cFearful of a data breach resulting from a third-party vulnerability, many organizations are implementing rigorous security requirements for their vendors and the average startup will find compliance onerous at best. As this trend continues, we\u2019ll see many small enterprise security companies be acquired, fold, or pivot to a different industry.\u201d<\/p>\n Synthetic identity is also a threat for the year ahead identified by many insiders.<\/p>\n \u201cReports of synthetic identity fraud, one of the most challenging fraud types to spot, will continue to grow and companies (especially those in financial services) will increasingly employ identity corroboration\/orchestration hubs to thwart this,\u201d says\u00a0Acuant<\/a>\u2019s President and CEO, Yossi Zekri. \u201cOrganizations will also seek robust biometric screening that cannot be easily fooled by deep fakes and image spoofing.\u201d<\/strong><\/p>\n Mitek<\/a>\u00a0VP and GM of Corporate Development Sanjay Gupta likewise predicts deepfakes and synthetic identities will present a new wave of identity fraud, requiring companies to invest in more sophisticated customer verification technologies.<\/p>\n Deepfake attacks and responses evolve<\/strong><\/p>\n \u201cWhile an attacker can use deepfake techniques to convincingly emulate the likeness of an individual, it still difficult to digitally impersonate ones voice without fairly obvious imperfections,\u201d according to Robert Capps, VP of Market Innovation for\u00a0NuData Security<\/a>, a Mastercard company.<\/p>\n \u201cDeepfake audio or video cannot currently be rendered in real time, without an attacker having a large volume of computing resources and a lot of high-quality audio and video source material to train computer machine learning algorithms. While Deepfakes can be convincing to other humans, they are unable to pass physical or passive biometric verification, so coupling strong liveness detection, along with the collection of passive and physical biometric signals to verify a user\u2019s identity, largely mitigate the current risks presented in banking transactions.\u201d<\/p>\n The roots of deepfake technology are murky, but show how even rudimentary attempts can fool people in high-stakes situations.<\/strong><\/p>\n \u201cIn 2013 while working for the NCA I witnessed first-hand just how compelling deepfake technology can be when a virtual 10-year-old Filipino girl, \u2018Sweetie\u2019, created by a Dutch NGO was used to identify thousands of child sex abusers worldwide,\u201d recounts\u00a0Callsign<\/a>\u00a0Chief Security Officer Ian Cruxton, former director of the UK\u2019s National Crime Agency.<\/p>\n \u201cOn this occasion it was used by those with good intentions to identify and prosecute serious sex offenders, but it is no surprise that the opportunities presented by deepfake has now attracted the interest of those who would commit crime and in particular fraud. In many ways, this is a response from the fraudsters to the steps taken by businesses to thwart more traditional phishing and spear phishing attacks.\u201d<\/p>\n