24 October 2005

Oracle rolls out biometric access controls

SA Mathieson

Oracle, the world’s second-largest software firm, has extended its use of biometrics to control access to buildings and rooms, following a successful deployment at its top-security data centre in Austin.

Shirley Ann Stern, senior principal security programme manager for the firm, told the Biometrics 2005 conference in Westminster that the Texan data centre used palm geometry for access, with iris scans added at times of heightened alert. Enrolment for the biometrics can be taken at five locations, including Oracle’s head-office near San Francisco.

"This has been extremely successful,” said Stern.“But it’s boring to talk about. The challenges were very minimal.” She added that everyone wishing to enter the building, including Oracle employees, has to undergo a background check, and this puts specific privacy concerns about biometrics into perspective. Furthermore, Oracle’s overall privacy policy was “well-written”, which also helps to reduce concerns.

"We don’t have to ‘balance security and privacy’,” she said. “We optimize them.”

Stern said that biometrics were just one part of the building’s security, which provides managed software services for several large organisations, as well as sensitive internal data including software development. The building has one way in, and what Ms Stern described as “embassy-grade physical security,” including blast-proof windows and round-the-clock armed guards.

The firm has since extended biometric access controls to other US data centres, and to conference rooms in its offices at Reston in Virginia, near Washington DC. These are often used for meetings with security-conscious government organisations — the “three-letter agencies”.

However, she said that her boss Todd Barton, Oracle’s vice-president for information security, has reservations about the use of biometrics, including accuracy and the cost and management of hardware. “But his biggest point was: 'what happens if the data is compromised?'” she said. Barton’s worry is that — unlike passwords — a biometric measurement could not be replaced. “There is also the personal aspect – ‘this is something personal I am losing’. I think that point needs a little bit more work,” she said.

© SA Mathieson 2005.

Back to news index