Slow Acceptance For BiometricsSlow Acceptance For Biometrics

Biometrics also interests the U.S. Department of Defense. The department's Biometrics Management Office is testing iris-scanning technology for access control at the Pentagon Athletic Club. The project is voluntary and involves capturing information from a club member's identification card and iris, says Maj. Steve Ferrell, executive officer at the Biometrics Fusion Center, the testing and evaluation center for the office. The process to put a club member into the biometric authentication system takes about two minutes, Ferrell says, and the goal is to eventually eliminate ID cards.

While military personnel may be used to tough security checkpoints, others find biometrics more of an adjustment. St. Vincent Hospitals and Health Care Center has rolled out a fingerprint-reader system in its facilities with up to 3,000 staff and physicians. The deployment has been largely successful, information security manager Bruce Peck says. Doctors and employees use a fingerprint reader from AuthenTec and software from SAFlink and CA to log on to PCs for access to everything from E-mail to medical records. In the past, each application required its own user name and password to gain access.

Peck says the system has made it easier for busy doctors to access applications. It also has increased security and helped the health-care provider comply with new security regulations governing medical records. "It started as a single-sign-on initiative, and it's definitely raised the security to access applications," he says.

Not everybody's a fan. "The nursing staff is tough. They don't like change," Peck says. On a typical hospital floor, nurses use PCs placed on mobile carts, which are connected to a wireless network. The computers, which nurses roll from room to room, are used to access patient records. Peck says most nurses still use passwords to log on and off. "They believe it's faster for them to use user names and passwords than the fingerprint scanner," he says. "It's not. That's just their perception."

The fingerprint scanners are effective about 80% of the time, and problems are mostly the result of dry hands. "We have a real dry-hand problem here because doctors and nurses are scrubbing and disinfecting their hands constantly throughout the day," Peck says.

The Los Angeles County Employees Retirement Association also turned to fingerprint scanners to increase security and reduce the cost of managing passwords, says director of technology services James Pu. The association manages retirement, disability, and death benefits for tens of thousands of county employees. "It's a fact that hackers have plenty of tools to easily crack passwords," he says. Plus, employees had to store multiple passwords. The association's employees, like workers at many large companies, started storing their passwords by writing them down. "That's not the best way to secure systems," Pu says.

The organization turned to Novell's Nsure system to provide centralized identity management via a single log on for all its critical applications, such as member services. Employees gain access to the apps via a fingerprint scan instead of passwords. Pu says the cost of managing passwords has gone down, while security has gone up. That's important because the association handles people's retirement money, and security is a top priority, Pu says. The system's implementation went smoothly, he says, except for a handful of employees whose fingerprints are "very faint."

Companies that successfully deploy biometrics may discover that there are other uses for the technology. Such systems can become an integral part of the business process. The L.A. Firemen's Credit Union is exploring whether it can use its biometric system to develop a way for employees to electronically sign documents and improve workflow. "The first pilot will be employee time sheets," Kings says.

Still, St. Vincent's Peck says it will take time before biometrics is widely used, even though he's happy with his deployment. "The costs are just too high for general acceptance. You've got to spend $100 just for each device," he says.

In the meantime, Peck has a plan for those change-resistant nurses. "We're going to eliminate those user names and passwords," he says. "They'll have to use the scanner."