# data[].attributes.body
Common social engineering attacks include phishing, pretexting, and baiting. Protection involves robust security protocols, regular employee training, and email filtering. Emerging trends include AI-driven impersonation and deepfake technology. To stay ahead, organizations must continuously update security measures, conduct simulated exercises, and promote vigilance with their education and awareness campaigns.

# data[].attributes.body
Organizations can effectively leverage multi-factor identification to enhance security by implementing different strategies such as using adaptive and secure authentication to monitor and regulate. Some of the best practices organizations should implement would be choosing the right combinations of factors such as passwords, two-step verifications and even biometrics.

There is a high risk of having a data breach and this is an ethical concern because biometrics, like a fingerprint, cannot be changed. There are also privacy concerns with facial recognition and surveillance can track people anywhere.

# data[].attributes.attachment_link.readable_text
What are the pros and cons of biometrics in today's digital age?

In 2020, biometric authentication and verification is integral to the modern technology landscape and is widespread in more ways than modern users of it fully understand. As we discuss in our blog post " Biometrics - A complete guide, " most people use biometric verification in their everyday lives in some capacity: at the airport to get whisked through long security lines, at their doctor's office to ensure confidentiality of medical records, or simply unlocking their phones to respond to a notification.

Most common biometric devices and their verification applications today require physiological biometrics, like face recognition and thumbprints to unlock their services... but they're not the only key. There's a wide range of other biometric uses that are 'physical' (like iris or palm shape) as well as a growing acceptance of behavioral biometrics. For example, the way that you navigated to this page on the internet, how you click on it, whether it's on a smart phone or laptop, to even the web browser you use are increasingly being used by businesses and governments alike to create a biometric profile of users to be used for identification and tracking purposes.

While biometric data and authentication are being ramped up and adopted across all aspects of modern life, questions arise on the safety and privacy from the users/consumers who are supplying biometric inputs to businesses and governments, and the purposes for utilization. Why does a business need to know what browser I use? What happens if my biometric data is compromised? I can always change a password, but can I change my fingerprint?
In the next sections, we'll cover both the advantages and disadvantages of biometric authentication. Download a new executive brief on biometrics, fairness, and inclusion by Steve Ritter, CTO at Mitek
Biometric authentication refresher

Biometrics are the measurement and analysis of an individual's physiological or behavioral traits (Biology + Metrics = Biometrics).

Experts break down multi-factor authentication of a person's identity by technology into three parts: knowledge (something the user and only the user knows), possession (something the user and only the user has), and inherence (something the user and only the user is). Biometrics falls into the possession and inherence parameters - when a device or service uses biometrics for identity verification, the purpose is to verify that a user is who they say they are by comparing their biometric input with the biometric data that's been previously stored - something a user is and has.

There are two main categories of inputs for biometrics: physiological and behavioral. Main physiological biometrics utilized in today's tech include a person's fingerprints, hand geometry, face shape, or eye pattern. Main behavioral biometrics include a person's web behavior and internet cookies, IP addresses, voice recognition, or how someone is likely to act - both online or in the real-world. Physiological and behavioral traits can be stored as inputs that are converted into data and stored to unlock in future uses as well as create unique user profiles.

Biometric data is stored and processed with database servers, encrypted tokens, or physical tokens. More secure devices will use on-device (or on-premises) storage of biometric templates, which ensures identity authentication occurs without any sensitive biometric information being sent over the internet to a different server or location.

Biometric authentication and its uses in modern-day tech and digital applications has a number of advantages:

1. High security and assurance - Biometric identification provides the answers to "something a person has and is" and helps verify identity

2. User Experience - Convenient and fast

3. Non-transferrable - Everyone has access to a unique set of biometrics

4. Spoof-proof - Biometrics are hard to fake or steal

High security and assurance
Biometrics provide increased levels of assurance to providers that a person is real by verifying a tangible, real-world trait as both something the user has and something the user is. Most user's passwords and PINs and personal identifying information have likely been compromised with a data breach, meaning, billions of accounts can be accessed by fraudsters who retain the answers to traditional authentication methods. Introducing biometric authentication into the process adds in a road-block for fraudsters that only a real, authorized user can circumnavigate - though a fraudster may know a person uses their dog's name and some lucky numbers for most of their online accounts, they can't use their fingerprint to unlock an account if they can't provide it on the spot. Additionally, biometrics can only be provided by living, breathing people - at this point in time, a robot would have a hard-time passing an iris scan.
User experience is convenient and fast
While the internal processes for biometric authentication is technical, from a user's point of view it's incredibly easy and quick. Placing a finger on a scanner and unlocking an account in seconds is faster than typing out a long password that has multiple special characters. In addition, forgetting a password is a common mistake of most users. The chances of you forgetting your own biometrics? Never!
Non-transferable
Biometric authentication requires its input is present upon authorization. You can't transfer or share a physical biometric digitally - the only way to utilize most biometric authentication systems is with a physical application.
Near spoof-proof
Biometrics like face patterns, fingerprints, iris scanning, and others are near-impossible to replicate with current technology. There's a one in 64 billion chance that your fingerprint will match up exactly with someone else's[1]. Said a different way, you have a better chance winning the lottery than having the same fingerprint as a hacker trying to get into your account that's secured by biometrics.

Despite increased security, efficiency, and convenience, biometric authentication and its uses in modern-day tech and digital applications also has disadvantages:

1. Costs - Significant investment needed in biometrics for security

2. Data breaches - Biometric databases can still be hacked

3. Tracking and data - Biometric devices like facial recognition systems can limit privacy for users

4. Bias - Machine learning and algorithms must be very advanced to minimize biometric demographic bias

5. False positives and inaccuracy - False rejects and false accepts can still occur preventing select users from accessing systems

Costs
It's no surprise that a more advanced security system would require significant investments and costs to implement. In a 2018 survey by Spiceworks, 67 percent of IT professionals cite cost as" the biggest reason for not adopting biometric authentication." Transitioning to a biometrics authentication wouldn't be the only thing a company would have to pay for, with 47% of the surveyed stating a need to upgrade current systems in order to support a shift to biometric authentication on their devices[2].
Data breaches
Businesses and governments that collect and store users' personal data are under constant threat from hackers. Because biometric data is irreplaceable, organizations need to treat sensitive biometric data with increased security and caution - something that's expensive and technically difficult in order to stay ahead of fraud advancements. If a password or pin is compromised, there's always the possibility of changing it. The same can't be said for a person's physiological or behavioral biometrics.
Tracking and data
As the world increases its use of biometric authentication systems like facial recognition technology and other biometric security measures, privacy of users needs to be taken into consideration. When biometrics are converted into data and stored, particularly in places or countries that have large surveillance measures, a user runs the risk of leaving a permanent digital record that can be potentially tracked by nefarious actors. In many instances, organizations and governments have used facial recognition software to track and identify people with scary accuracy that significantly inhibits privacy[3]. As surveillance increases, biometric data can become a permanent digital tag that can be used to track someone, both with and without their knowledge.
Bias
Minimizing demographic bias in biometrics while verifying applicants' identities during digital onboarding is a challenge for providers. Poor implementation of technology or deliberate misuse can result in discrimination and exclusion. Without a proven, document-centric identity proofing solution, cross-demographic performance can be unreliable and limit customer access to essentials like credit and the expanding range of digital services.
False positives and inaccuracy
Most common biometric authentication methods rely on partial information to authenticate a user's identity. For example, a mobile biometric device will scan an entire fingerprint during the enrollment phase, and convert it into data. However, future biometric authentication of the fingerprint will only use parts of the prints to verify identity so it's faster and quicker. In 2018, a research team from New York University created an Artificial Intelligence platform that was able to fraudulently crack fingerprint authentication at a success rate of 20% by matching similarities of partial prints to the full biometric data[4].
Sources

1. How Fingerprinting Works: https://science.howstuffworks.com/fingerprinting1.htm

2. More Organizations Are Adopting Biometrics for Security-But Barriers Still Remain: https://businessinsights.bitdefender.com/more-organizations-are-adopting-biometrics-for-security-but-barriers-still-remain

3. The Secretive Company That Might End Privacy as We Know It: www.nytimes.com › technology › clearview-privacy-facial-recognition

4. Machine Learning Masters the Fingerprint to Fool Biometric Systems: https://engineering.nyu.edu/news/machine-learning-masters-fingerprint-fool-biometric-systems

# data[].attributes.attachment_link.title
Advantages and disadvantages of biometrics | Mitek

# data[].attributes.attachment_link.description
In 2020, biometric authentication and verification is integral to the modern technology landscape and is widespread in more ways than modern users of it fully understand.

# data[].attributes.body
This is a Ted Talk that explores what social engineering, how it's done, and how to avoid it happening to you.

# data[].attributes.attachment_link.title
Social Engineering- The art of hacking humans | Prasad Sawant | TEDxElproIntlSchool

# data[].attributes.body
Jai Vijayan discusses that "deepfake-enabled phishing, business email compromise (BEC), and promotional scams are already happening". The article also discusses that through the continued education of these threats, employees can become more aware in preparation for attacks that come their way.

# data[].attributes.attachment_link.readable_text
Malicious campaigns involving the use of deepfake technologies are a lot closer than many might assume. Furthermore, mitigation and detection of them are hard.

No Longer a Hypothetical Threat

"From hypothetical and proof-of-concept threats, [deepfake-enabled attacks] have moved to the stage where non-mature criminals are capable of using such technologies," says Vladimir Kropotov, security researcher with Trend Micro and the main author of a report on the topic that the security vendor released this week.

'We already see how deepfakes are integrated into attacks against financial institutions, scams, and attempts to impersonate politicians," he says, adding that what's scary is that many of these attacks use identities of real people - often scraped from content they post on social media networks.

One of the main takeaways from Trend Micro's study is the ready availability of tools, images, and videos for generating deepfakes. The security vendor found, for example, that multiple forums, including GitHub, offer source code for developing deepfakes to anyone who wants it. Similarly, enough high-quality images and videos of ordinary individuals and public figures are available for bad actors to be able to create millions of fake identities or to impersonate politicians, business leaders, and other famous personalities.

Demand for deepfake services and people with expertise on the topic is also growing in underground forums. Trend Micro found ads from criminals searching for these skills to carry out cryptocurrency scams and fraud targeting individual financial accounts.

"Actors can already impersonate and steal the identities of politicians, C-level executives, and celebrities," Trend Micro said in its report. "This could significantly increase the success rate of certain attacks such as financial schemes, short-lived disinformation campaigns, public opinion manipulation, and extortion."

A Plethora of Risks

There's a growing risk also of stolen or recreated identities belonging to ordinary people being used to defraud the impersonated victims, or to conduct malicious activities under their identities.

In many discussion groups, Trend Micro found users actively discussing ways to use deepfakes to bypass banking and other account verification controls - especially those involving video and face-to-face verification methods.

For example, criminals could use a victim's identity and use a deepfake video of them to open bank accounts, which could later be used for money laundering activities. They can similarly hijack accounts, impersonate top-level executives at organizations to initiate fraudulent money transfer or plant fake evidence to extort individuals, Trend Micro said.

Devices like Amazon's Alexa and the iPhone, which use voice or face recognition, could soon be on the list of target devices for deepfake-based attacks, the security vendor noted.

Few Mitigations for Deepfake Attacks & Detection Is Hard

Generally speaking, these types of attacks can be effective, because no technological fixes are available yet to address the challenge, McElroy says.

"Given the rising use and sophistication in creating deepfakes, I see this as one of the biggest threats to organizations from a fraud and scam perspective moving forward," he warns.

"Organizations can consider low-tech methods to break the cycle. This can include using a challenge and passphrase amongst executives when wiring money out of an organization or having a two-step and verified approval process," he says.

Gil Dabah, co-founder and CEO of Piaano, also recommends strict access control as a mitigating measure. No user should have access to big chunks of personal data and organizations need to set rate limits as well as anomaly detection, he says.

"Even systems like business intelligence, which require big data analysis, should access only masked data," Dabah notes, adding that no sensitive personal data should be kept in plaintext and data such as PII should be tokenized and protected.

To detect manipulated content, organizations need fingerprints or signatures that prove something is unchanged, he adds.

"Even better is to take micro-fingerprints over portions of the content and be able to identify what's changed and what hasn't," he says. "That's very valuable when an image has been edited, but even more so when someone is trying to hide an image from detection."

Three Broad Threat Categories

Steinberg says deepfake threats fall into three broad categories. The first is disinformation campaigns mostly involving edits to legitimate content to change the meaning. As an example, Steinberg points to nation-state actors using fake news images and videos on social media or inserting someone into a photo that wasn't present originally - something that is often used for things like implied product endorsements or revenge porn.

Another category involves subtle changes to images, logos, and other content to bypass automated detection tools such as those used to detect knockoff product logos, images used in phishing campaigns or even tools for detecting child pornography.

The third category involves synthetic or composite deepfakes that are derived from a collection of originals to create something completely new, Steinberg says.

"We started seeing this with audio a few years back, using computer synthesized speech to defeat voiceprints in financial services call centers," he says. "Video is now being used for things like a modern version of business email compromise or to damage a reputation by having someone 'say' something they never said."

# data[].attributes.attachment_link.title
Reshaping the Threat Landscape: Deepfake Cyberattacks Are Here

# data[].attributes.attachment_link.description
It's time to dispel notions of deepfakes as an emergent threat. All the pieces for widespread attacks are in place and readily available to cybercriminals, even unsophisticated ones.

# data[].attributes.body
https://youtu.be/ZPG3XQhZVII?si=uSrtSsDJDwjqgCfk

# data[].attributes.attachment_link.title
How secure is Biometric Authentication Technology and Biometric Data? | Biometric Security

# data[].attributes.body
Information Security and Cyber Security share the goal of safeguarding data, but while the former focuses on protecting data in all forms, the latter specifically defends digital information and systems. Emerging threats include ransomware, IoT vulnerabilities, AI-driven attacks, and supply chain compromises. To prepare, organizations conduct assessments, train employees, and employ advanced technologies. Balancing security with productivity involves implementing access controls, user-friendly solutions, training, and monitoring mechanisms to ensure efficient operations without compromising security.

# data[].attributes.body
Tyler Healy discusses that "AI can also be misappropriated to create even more sophisticated attack vectors" and that while AI may be a friend in cyber security, it can also pose to be a foe..

# data[].attributes.attachment_link.title
Cybersecurity trends and the evolution of the CISO in 2024

# data[].attributes.attachment_link.description
Emerging technologies, new attack vectors and even geopolitical crises shape the day-to-day evolution of the chief information security officer’s job.

# data[].attributes.body
This is a video made by a data security company that explains the differences between information and cyber security, as well as ways to ensure the security of your data.

# data[].attributes.attachment_link.title
Information security vs cybersecurity: What is the difference?