TORRANCE, Calif. -- A bit of social engineering assessment by a visiting auditor was all it took to convince management at Honda Federal Credit Union to take up fingerprint authentication.
And the help desk couldn't be happier.
Honda FCU (www.hondafcu.org) is using biometrics--in the form of fingerprint authentication--to provide access to about 30 different Web sites and applications used by the 130 or so fulltime staffers at the 53,000-member CU's eight locations in California, Ohio, South Carolina and Alabama.
Since deploying it about a year and a half ago, calls to the four-person help desk for password resets have dropped from about 20 a day to almost none, said Bill D'Camp, IT manager at the $463 million CU.
And the NCUA is pleased, too, D'Camp said, since it's a sharp improvement from the situation an outside auditor found a few months earlier.
"We did a social engineering engagement and found that people were writing down passwords and keeping them in, ahem, secure places such as under their keyboards and in desk drawers," D'Camp said.
"So we decided we needed to do something to make it easier for everyone to get to their applications and Web sites without running the risk of compromising the security of log-ins and passwords," he said.
A range of solutions were considered, including smart cards, but the decision was made to go with something the staffers couldn't leave at home or in their cars--their fingerprints.
In addition to providing secure log-ins without lost, forgotten or plain view passwords, after the user presses his or her finger to the reader, the DigitalPersona system shows a list of authorized applications and Web sites, allowing for much quicker access than having to clear authentication for each individual use, D'Camp said.
While the base technology is not particularly new, fingerprint authentication is really getting legs now that major PC manufacturers are incorporating it into millions of consumer laptops, according to Jim Fulton, vice president of marketing at DigitalPersona (www.digitalpersona.com) in Redwood City, Calif.
"Even six months ago, this technology was slightly out on the edge for people who aren't techies or looking for niche technology," Fulton said. "Now it's absolutely moving into the mainstream."
DigitalPersona has been in business for about 10 years and now has an installed base of more than 90 million users worldwide, Fulton said. Its client list has grown to more than 900, including Honda FCU and Advantis, Mountain America, Travis, Telesis and Allegiance CUs.
D'Camp said the initial deployment included the biggest challenge so far, integrating the authentication application with the CU's Symitar core processing system. He said his project leader accomplished that by working with DigitalPersona support and colleagues from other credit unions, including Mountain America, to create a customized template.
D'Camp said he also now regularly gets updates from DigitalPersona, for software upgrades and security patches. For instance, the biometric software was not compatible with Internet Explorer 7 when that new browser came out, requiring updates to bring that back in line.
"But, so far, every time we've had to do something like this, it's improved performance," the IT manager said. "Generally we see a faster response time to putting your finger on the reader and seeing the menu pop up on the screen."
Despite the international boom in consumer adoption, D'Camp said he doesn't see the technology going to the teller line anytime soon at Honda FCU.
"We have members who see our staffers using it and telling us, 'You're not going to get me using that thing,'" he said. "I guess they see it as some kind of privacy issue, to them.
"But we are looking at using a solution from MagTek that allows the member to do PIN verification at the teller line just by swiping a debit or ATM card," D'Camp said.
"We think members will accept that better than using their fingerprints. I think there are still some challenges ahead for that," he said.
Internal acceptance also isn't universal. There are still a couple holdouts "entering passwords by hand" at Honda FCU, D'Camp said, "and they're the people who still call for password resets."
--mrapport@sc.rr.com
