Data center

A data center is a facility used to house computer systems and associated components, such as telecommunications and storage systems. It generally includes redundant or backup power supplies, redundant data communications connections, environmental controls (air conditioning, fire suppression, etc.), and special security devices

History

Data centers have their roots in the huge computer rooms of the early ages of the computing industry. Early computer systems were complex to operate and maintain, and needed a special environment to keep working. A lot of cables were necessary to connect all the parts. Also, old computers required a lot of power, and had to be cooled to avoid overheating. Security was important; computers were expensive, and were often used for military purposes. For this reason, engineering practices were developed since the start of the computing industry. Basic design guidelines for controlling access to the computer room were devised. Elements such as standard racks to mount equipment, elevated floors, and cable trays (installed overhead or under the elevated floor) were introduced in this early age, and have modernized relatively little compared to the computer systems themselves.

During the boom of the microcomputer industry, and especially during the 1980s, computers started to be deployed everywhere, in many cases with little or no care about operating requirements. However, as IT operations started to grow in complexity, companies grew aware of the need to control IT resources. With the advent of client-server computing, during the decade of 1990, microcomputers (now called "servers") started to find their places on the old computer rooms. The availability of inexpensive networking equipment, coupled with new standards for network cabling, made it possible to use a hierarchical design which put the servers in a specific room inside the company. The use of the term "data center", as applied to specially design computer rooms, started to gain popular recognition about this time.

The boom of data centers came during the dot-com bubble. Companies needed fast Internet connectivity and non-stop operation to deploy systems and establish a presence on the Internet. Installing such equipment was not viable for many smaller companies. Many companies started building very large facilities, called "internet data centers", or IDCs, which provide businesses with a range of solutions for systems deployment and operation. New technologies and practices were designed to handle the scale and the operational requirements of such large scale operations. These practices eventually migrated towards the private data centers, and were largely adopted because of their practical results.

As of 2007, data center design, construction, and operation is a well-known discipline. Standard documents from accredited professional groups, such as the Telecommunications Industry Association, specify the requirements for data center design. Well-known operational metrics for data center availability can be used to evaluate the business impact of a disruption. There is still a lot of development being done in operation practice, and also in environmentally-friendly data center design.

Requirements for modern data centers

Racks of telecommunications equipment in part of a data center.

IT operations are a crucial aspect of most organizational operations. One of the main concerns is business continuity; companies rely on its informations systems to run its operations. If a system becomes unavailable, company operations may be impaired or stopped completely. It is necessary to provide a reliable infrastructure for IT operations, in order to minimize any chance of disruption. Information security is also a concern, and for this reason a data center has to offer a secure environment which minimizes the chances of a security breach. A data center must therefore keep high standards for assuring the integrity and functionality of its hosted computer environment.

Data center classification

The TIA-942:Data Center Standards Overview describes the requirements for the data center infrastructure. Four tiers The simplest is a Tier 1 data center, which is basically a computer room, following basic guidelines for the installation of computer systems. The most stringent level is a Tier 4 data center, which is designed to host mission critical computer systems, with fully redundant subsystems and compartmentalized security zones controlled by biometric access controls methods.

Physical layout

A typical server "cage", commonly seen in colocation.

A data center can occupy one room of a building, one or more floors, or an entire building. Most of the equipment is often in the form of servers racked up into 19 inch rack cabinets, which are usually placed in single rows forming corridors between them. This allows people access to the front and rear of each cabinet. Servers differ greatly in size from 1U servers to huge storage silos which occupy many tiles on the floor. Some equipment such as mainframe computers and storage devices are often as big as the racks themselves, and are placed alongside them.

The physical environment of the data center is usually under strict control:

• Air conditioning is used to keep the room cool; it may also be used for humidity control. Generally, temperature is kept around 20-22 degrees Celsius (about 68-72 degrees Fahrenheit). The primary goal of data center air conditioning systems is to keep the server components at the board level within the manufacturer's specified temperature/humidity range. This is crucial since electronic equipment in a confined space generates much excess heat, and tends to malfunction if not adequately cooled. Air conditioning systems also help keep humidity within acceptable parameters. The humidity parameters are kept between 35% and 65% Relative Humidity. Too much humidity and water may begin to condense on internal components; too little and static electricity may damage components. ASHRAE recommends a temperature range of 20-25 °C and humidity range of 40 - 60% as optimal for data center conditions.^{[citation needed]}
• Backup power is catered for via one or more uninterruptible power supplies and/or diesel generators.
• To prevent single points of failure, all elements of the electrical systems, including backup system, are typically fully duplicated, and critical servers are connected to both the "A-side" and "B-side" power feeds. This arrangement is often made to achieve N+1 Redundancy in the systems. Static switches are sometimes used to ensure instantaneous switchover from one supply to the other in the event of a power failure.
• Data centers typically have raised flooring made up of 60 cm (2 ft) removable square tiles. These provide a plenum for air to circulate below the floor, as part of the air conditioning system, as well as providing space for power cabling. Data cabling is typically routed through overhead cable trays in modern data centers. Smaller/less expensive data centers without raised flooring may use anti-static tiles for a flooring surface.
• Data centers often have elaborate fire prevention and fire extinguishing systems. Modern data centers tend to have two kinds of fire alarm systems; a first system designed to spot the slightest sign of particles being given off by hot components, so a potential fire can be investigated and extinguished locally before it takes hold (sometimes, just by turning smoldering equipment off), and a second system designed to take full-scale action if the fire takes hold. Fire prevention and detection systems are also typically zoned, and high-quality fire-doors and other physical fire-breaks used, so that even if a fire does break out it can be contained and extinguished within a small part of the facility.
• Using conventional water sprinkler systems on operational electrical equipment can do just as much damage as a fire. Originally Halon gas, a halogenated organic compound that chemically stops combustion, was used to extinguish flames. However, the use of Halon has been banned by the Montreal Protocol because of the danger Halon poses the ozone layer. Unlike fire extinguishing agents that displace oxygen, Halon did not pose a great risk to people caught in the data center when it was discharged. More environmentally-friendly alternatives include Argonite and FM-200, and even systems based on mists of tiny particles of ultra-pure water. There are also systems available which can control the gas mixture of the air so as to lower the oxygen content below the level at which combustion can take place but still high enough to support human life (similar to very high altitudes).
• Physical security also plays a large role with data centers. Physical access to the site is usually restricted to selected personnel. Video camera surveillance and permanent security guards are almost always present if the data center is large or contains sensitive information on any of the systems within.

Network infrastructure

An example of "rack mounted" servers.

Communications in data centers today are most often based on networks running the IP protocol suite. Data centers contain a set of routers and switches that transport traffic between the servers and to the outside world. Redundancy of the Internet connection is often provided by using two or more upstream service providers (see Multihoming).

Some of the servers at the data center are used for running the basic Internet and intranet services needed by internal users in the organization: e-mail servers, proxy servers, DNS servers, etc.

Network security elements are also usually deployed: firewalls, VPN gateways, Intrusion detection systems, etc. Also common are monitoring systems for the network and some of the applications. Additional off site monitoring systems are also typical, in case of a failure of communications inside the data center.

Applications

Multiple racks of servers, and how a data center commonly looks.

The main purpose of a data center is running the applications that handle the core business and operational data of the organization. Such systems may be proprietary and developed internally by the organization, or bought from enterprise software vendors. Such common applications are ERP and CRM systems.

Often these applications will be composed of multiple hosts, each running a single component. Common components of such applications are databases, file servers, application servers, middleware and various others.

Data centers are also used for off site backups. Companies may subscribe to backup services provided by a data center. This is often used in conjunction with backup tapes. Backups can be taken of servers locally on to tapes., however tapes stored on site pose a security threat and are also susceptible to fire and flooding. Larger companies may also send their backups off site for added security. This can be done by backing up to a data center. Encrypted backups can be sent over the internet to data center where they can be stored securely.

Security-as-a-Service

Security-as-a-Service refers to the practice of delivering traditional security applications as an Internet-based service, on-demand, to consumers and businesses.

Security-as-a-Service is analogous to the conventional Software-as-a-Service model, whereby security applications are delivered as a service using the Internet as the delivery mechanism. In the consumer market, the most common of these are the “anti-“ suite, including anti-virus, anti-spam and anti-spyware.

In the enterprise market, Security-as-a-Service refers to the delivery of second-tier infrastructure components, such as log management and asset tracking, in a service-oriented fashion, also leveraging the Internet as the delivery and access mechanism.

History

The term ‘Security-as-a-Service’ was first used in the consumer market in the year 2001. McAfee filed a controversial patent for delivering security software as a service over the Web in August 2001.

In the enterprise market, security services vendor Vigilar introduced the first enterprise security-as-a-service solution with the introduction of its ATLAS solution in June 2007.

Vendors in the SMB market who deliver “Security-as-a-Service solutions include McAfee, Watchfire, and Jamcracker. In the enterprise market, vendors who provide security-as-a-service solutions include ISS, Panda Software, Qualys, and Vigilar.

Why Security-as-a-Service

Certain aspects of security are uniquely designed to be optimized for delivery as a Web-based service. These include:

• offerings that require constant updating to combat new threats, such as anti-virus and anti-spyware software for consumers
• offerings that require a high level of expertise, often not found in-house, and which can be conducted remotely. These include ongoing maintenance, scanning, patch management and troubleshooting of security devices.
• offerings that manage time and resource-intensive tasks, which may be cheaper to outsource and offshore, delivering results and findings via a Web-based solution. These include tasks such as log management, asset management and authentication management.

Key Characteristics

Security-as-a-Service applications are generally priced on a per-user basis on the consumer side, and a per-device basis on the enterprise side. Pricing may also depend on bandwidth and storage requirements. SaaS costs to the buyer and revenue streams to the vendor are therefore lower initially than traditional software license fees, but are also recurring, and therefore viewed as more predictable, much like maintenance fees for licensed software. In addition, because the functionality is delivered as a service, rather than a device or piece of software, fees fall under operating expenses, rather than capital expenditures, for most customers.

Security-as-a-Service vs. Managed Security Services

Unlike previous generations of Managed Security Services, security-as-a-service does not require the customer to give up complete control over their security posture. Instead, internal administrators can control their security policies, upgrade systems, etc. via a web-based interface. Internal administrators maintain control of their security policies and can change them without calling an outsourced provider, but at the same time gain useful information regarding a devices status and history (uptime, current and past patch levels, outstanding support issues) and other device-centric information on demand via a web interface.

Anti-theft system

An anti-theft system is any device or method used to prevent or deter the unauthorized appropriation of items considered valuable. Theft is one of the most common and oldest criminal behaviours. Where the ownership of a physical possession can be altered without the rightful owner's consent, theft prevention has been introduced to assert the ownership whenever the rightful owner is physically present. Anti-theft systems have been around since individuals began stealing other people's property and have evolved accordingly to thwart increasingly complex methods of theft. From the invention of the first lock and key to the introduction of RFID tags and biometric identification, anti-theft systems have evolved to match the introduction of new inventions to society and the resulting theft of them by others.

Theft: Motive and Opportunity

Under normal circumstances, theft is prevented simply through the application and social acceptance of property law. Ownership is often indicated by means of visual marking (license plates, name tags). When clear owner identification is not possible and when there is a lack of social observance, people may be inclined to take possession of items to their own benefit at the expense of the original owner. Motive and opportunity are two enabling factors for theft. Given that motives for theft are varied and complex and are generally speaking not within the control of the victim, most methods of theft prevention rely on reducing opportunities for theft.

Motives for actively preventing theft

Items may require an anti-theft system for a variety of reasons, which may occur in combination depending on the type of item and its use:

• the item is expensive and/or has sentimental value (prestigious car, family heirloom, birthday gift, war medals, coin collection)
• the item is difficult/impossible to replace if lost (produced in low numbers, antiques, unique works of art)
• the item is easy to steal (retail/supermarket products, office stationery)
• the item may be left unattended in an unsafe environment (laptops in a library, cars in a carpark)
• inappropriate use of the item may cause considerable damage or may enable further unauthorized acts (theft of car keys, stolen building access keys, identity theft)
• the item is desirable to others (jewelry, mobile phones, rare collectibles, auto parts, industrial designs)

Use of Theft Prevention

Equally varied are the methods developed for theft prevention. Anti-theft systems have evolved to counter new theft techniques as they have appeared in society. The choice for a particular anti-theft system is dependent on several factors:

Financial Cost

In addition to the initial acquisition cost of an item, the cost of replacement or recovery from its theft is usually considered when considering the cost of installing an anti-theft system. This cost estimation usually determines the maximum cost of the anti-theft system and the need to secure it. Expensive items will generally be secured with higher-cost anti-theft systems, while low-cost items will generally be secured at low cost. Insurance companies will often mandate a minimum type of anti-theft system as part of the conditions for insurance.

Threshold for Theft

Anti-theft systems are designed to raise the difficulty of theft to an infeasible (but not necessarily impossible) level. The kind of system implemented often depends on the acceptable threshold for theft. For example, keeping money in an inside shirt pocket raises the difficulty of theft above that necessary if the pocket were on a backpack, since unauthorized access is made sufficiently more difficult. Methods of theft evolve to decrease the difficulty of theft, increased by newer anti-theft systems. Because of evolution on both sides and the social aspect of theft, the threshold for theft is very dynamic and heavily dependent on the environment. Doors in quiet suburban neighbourhoods are often left unlocked, as the perceived thresholds for theft are very high.

Ease of Use

Security is often compromised through the lax application of theft-prevention practices and human nature in general. The ideal anti-theft device requires no additional effort while using the secured item, without reducing the level of security. In practice, users of security systems may intentionally reduce the effectiveness of an anti-theft system to increase its usability (see passwords). For example, home security systems will often be enabled and disabled using easy-to-remember codes such as "1111" or "123", instead of more secure combinations.

Methods of Theft Prevention

There are a number of general categories of anti-theft systems:

Sequestering of valuable items

A very common method of preventing theft is the placement of valuables in a safe location. The definition of safe depends on the minimum threshold for theft as determined by the owner. Desk stationery is often considered secured if placed in an unlocked drawer away from view, while expensive jewelry might be placed in a safe behind a picture in a home.

Raising the awareness of theft

Another common method is the alerting of other individuals to the act of theft. This is commonly seen in department stores, where security systems at exits alert store employees of the removal of unpaid items. Older car alarms also fall into this category; newer systems also prevent the car from starting.

Preventing Removal of items

Yet another method is the attachment of items to a larger immobile object, usually furniture or walls.

Disabling the stolen item

Items with specific functionality can often be disabled to prevent the use of the item if it should be stolen. The anti-theft system can require disabling on every use, or enabling when the item needs to be secured. Disabling the anti-theft system is usually done by requiring identification of the owner at some stage of use. Identification can occur through physical or other means (physical keys, numerical codes, complex passwords, biometric identification). A passive immobilizer makes car theft almost impossible because the vehicle cannot be started without a computer chip that is found within the ignition key. This can work even retrospectively: as a stolen credit card can easily be invalidated with a phone call to the issuing bank, the motivation to steal one is reduced.

Security Tags

Security tags are devices that are attached to products to prevent shop-lifting. Often used in conjunction with an Electronic article surveillance system.

Tracking Software

Electronic items such as laptops, cell phones and even gadgets such as iPods now have software that enable them to "phone home" with information regarding their whereabouts and other information that can aid law enforcement to track the devices down.

Software Assurance

Software Assurance (SwA) is: “the level of confidence that software is free from vulnerabilities, either intentionally designed into the software or accidentally inserted at anytime during its lifecycle, and that the software functions in the intended manner.”

— Source: Committee on National Security Systems (CNSS) Instruction No. 4009, “National Information Assurance Glossary”, Revised 2006 — http://www.cnss.gov/instructions.html-

Alternate definitions:

[1] From the Department of Homeland Security (DHS), Software Assurance (SwA) addresses:

• Trustworthiness - No exploitable vulnerabilities exist, either maliciously or unintentionally inserted;
• Predictable Execution - Justifiable confidence that software, when executed, functions as intended;
• Conformance - Planned and systematic set of multi-disciplinary activities that ensure software processes and products conform to requirements, standards/ procedures.

Contributing SwA disciplines, articulated in Bodies of Knowledge and Core Competencies: Software Engineering, Systems Engineering, Information Systems Security Engineering, Information Assurance, Test and Evaluation, Safety, Security, Project Management, and Software Acquisition.

- Source: DHS Build Security In web portal, https://buildsecurityin.us-cert.gov/portal

[2] From the Department of Defense (DoD), Software Assurance (SwA) relates to "the level of confidence that software functions as intended and is free of vulnerabilities, either intentionally or unintentionally designed or inserted as part of the software."

- Source: DoD Software Assurance Initiative, 13 September 2005 - https://acc.dau.mil/CommunityBrowser.aspx?id=25749

[3] From the National Institute of Standards and Technology (NIST), Software Assurance (SwA) is "the planned and systematic set of activities that ensures that software processes and products conform to requirements, standards, and procedures to help achieve:

• Trustworthiness - No exploitable vulnerabilities exist, either of malicious or unintentional origin, and
• Predictable Execution - Justifiable confidence that software, when executed, functions as intended."

- Source: NIST SAMATE project http://samate.nist.gov/

[4] From the National Aeronautics and Space Administration (NASA), Software Assurance - "Planned and systematic set of activities that ensures that software processes and products conform to requirements, standards, and procedures. It includes the disciplines of Quality Assurance, Quality Engineering, Verification and Validation, Nonconformance Reporting and Corrective Action, Safety Assurance, and Security Assurance and their application during a software life cycle." The NASA Software Assurance Standard also states: "The application of these disciplines during a software development life cycle is called Software Assurance."

- Source: NASA-STD-2201-93 "Software Assurance Standard", 10 November 1992 - http://satc.gsfc.nasa.gov/assure/assurepage.html

[5] From the Object Management Group (OMG), Software Assurance (SwA) is “justifiable trustworthiness in meeting established business and security objectives.”

- Source: OMG Software Assurance (SwA) Special Interest Group (SIG) http://adm.omg.org/SoftwareAssurance.pdf and http://swa.omg.org/docs/softwareassurance.v3.pdf

[6] From Webopedia, "Software Quality Assurance, abbreviated as SQA, and also called software assurance, it is a level of confidence that software is free from vulnerabilities, either intentionally designed into the software or inserted at anytime during its lifecycle, and that the software functions in the intended manner."

- Source: Webopedia on-line encyclopedia - http://www.webopedia.com/TERM/S/Software_Quality_Assurance.html

[7] As indicated in the Webopedia definition, the term "software assurance" has been used as a shorthand for Software Quality Assurance (SQA) when not necessarily considering security or trustworthiness. SQA is defined in the Handbook of Software Quality Assurance as: "the set of systematic activities providing evidence of the ability of the software process to produce a software product that is fit to use." - Source: G. Gordon Schulmeyer and James I. McManus, Handbook of Software Quality Assurance, 3rd Edition (Prentice Hall PRT, 1998)

- - - - - - -

Software Assurance is a strategic initiative of the U.S. Department of Homeland Security (DHS) to promote integrity, security, and reliability in software. The SwA Program is based upon the National Strategy to Secure Cyberspace - Action/Recommendation 2-14: “DHS will facilitate a national public-private effort to promulgate best practices and methodologies that promote integrity, security, and reliability in software code development, including processes and procedures that diminish the possibilities of erroneous code, malicious code, or trap doors that could be introduced during development.” - https://buildsecurityin.us-cert.gov/portal

Software Assurance Metrics and Tool Evaluation (SAMATE) is a NIST project that supports the DHS Software Assurance Program in the identification, enhancement and development of software assurance tools. NIST is leading in (A) testing software evaluation tools, (B) measuring the effectiveness of tools, and (C) identifying gaps in tools and methods. - http://samate.nist.gov/

OMG Software Assurance (SwA) Special Interest Group (SIG), http://swa.omg.org, works with Platform and Domain Task Forces and other software industry entities and groups external to the OMG, to coordinate the establishment of a common framework for analysis and exchange of information related to software trustworthiness by facilitating the development of a specification for a Software Assurance Framework that will:

• Establish a common framework of software properties that can be used to represent any/all classes of software so software suppliers and acquirers can represent their claims and arguments(respectively), along with the corresponding evidence, employing automated tools (to address scale)
• Verify that products have sufficiently satisfied these characteristics in advance of product acquisition, so that system engineers/integrators can use these products to build (compose) larger assured systems with them
• Enable industry to improve visibility into the current status of software assurance during development of its software
• Enable industry to develop automated tools that support the common framework.

- - - - - - -

Software Security Assurance Publicly Available Resource: The Software Assurance Forum has provided a collaborative venue for stakeholders to share and advance techniques and technologies relevant to software security. The state-of-the-art report (SOAR) on "Software Security Assurance" (published by the Information Assurance Technology Analysis Center) is a free, publicly available resource at http://iac.dtic.mil/iatac/download/security.pdf which represents an output of collaborative efforts of organizations and individuals in the SwA Forum and Working Groups. The SOAR provides an overview of the current state of the environment in which software must operate and surveys current and emerging activities and organizations involved in promoting various aspects of software security assurance. The report also describes the variety of techniques and technologies in use in government, industry, and academia for specifying, acquiring, producing, assessing, and deploying software that can, with a justifiable degree of confidence, be said to be secure. The report also presents observations about noteworthy trends in software security assurance as a discipline.

Biometrics

At Walt Disney World, biometric measurements are taken from the fingers of guests to ensure that the person's ticket is used by the same person from day to day

For the use of statistics in biology, see Biostatistics.

Biometrics (ancient Greek: bios ="life", metron ="measure") is the study of methods for uniquely recognizing humans based upon one or more intrinsic physical or behavioral traits.

Some researchers , have coined the term behaviometrics for behavioral biometrics such as typing rhythm or mouse gestures where the analysis can be done continuously without interrupting or interfering with user activities.

Overview

Biospecies are used to identify the identity of an input sample when compared to a template, used in cases to identify or specific objects by certain characteristics.

• possession-based: using one specific "token" such as a security tag or a card
• knowledge-based :the use of a code or password.

Standard validation systems often use multiple inputs of samples for sufficient validation, such as particular characteristics of the sample. This intends to enhance security as multiple different samples are required such as security tags and codes and sample dimensions.

Common Human biometric characteristics

Classification of some biometric traits

Biometric characteristics can be divided in two main classes, as represented in figure on the right:

• physiological are related to the shape of the body. The oldest traits, that have been used for more than 100 years, are fingerprints. Other examples are face recognition, hand geometry and iris recognition.
• behavioral are related to the behavior of a person. The first characteristic to be used, still widely used today, is the signature. More modern approaches are the study of keystroke dynamics and of voice.

Strictly speaking, voice is also a physiological trait because every person has a different pitch, but voice recognition is mainly based on the study of the way a person speaks, commonly classified as behavioral.

Other biometric strategies are being developed such as those based on gait (way of walking), retina, hand veins, ear recognition, facial thermogram, DNA, odor and palm prints.

Comparison of various biometric technologies

It is possible to understand if a human characteristic can be used for biometrics in terms of the following parameters:

• Universality describes how commonly a biometric is found individually.
• Uniqueness is how well the biometric separates individually from another.
• Permanence measures how well a biometric resists aging.
• Collectability ease of acquisition for measurement.
• Performance accuracy, speed, and robustness of technology used.
• Acceptability degree of approval of a technology.
• Circumvention ease of use of a substitute.

The following table shows a comparison of existing biometric systems in terms of those parameters:

Comparison of various biometric technologies, according to A. K. Jain (H=High, M=Medium, L=Low)

Biometrics:	Universality	Uniqueness	Permanence	Collectability	Performance	Acceptability	Circumvention*
Face	H	L	M	H	L	H	L
Fingerprint	M	H	H	M	H	M	H
Hand geometry	M	M	M	H	M	M	M
Keystrokes	L	L	L	M	L	M	M
Hand veins	M	M	M	M	M	M	H
Iris	H	H	H	M	H	L	H
Retinal scan	H	H	M	L	H	L	H
Signature	L	L	L	H	L	H	L
Voice	M	L	L	M	L	H	L
facial thermograph	H	H	L	H	M	H	H
Odor	H	H	H	L	L	M	L
DNA	H	H	H	L	H	L	L
Gait	M	L	L	H	L	H	M
Ear recognition	M	M	H	M	M	H	M

* - circumventability listed with reversed colors because low is desirable here instead of high

A. K. Jain ranks each biometric based on the categories as being either low, medium, or high. A low ranking indicates poor performance in the evaluation criterion whereas a high ranking indicates a very good performance.

Biometric systems

The basic block diagram of a biometric system

The diagram on right shows a simple block diagram of a biometric system. When such a system is networked together with telecommunications technology, biometric systems become telebiometric systems. The main operations a system can perform are enrollment and test. During the enrollment, biometric information from an individual is stored. During the test, biometric information is detected and compared with the stored information. Note that it is crucial that storage and retrieval of such systems themselves be secure if the biometric system is be robust. The first block (sensor) is the interface between the real world and our system; it has to acquire all the necessary data. Most of the times it is an image acquisition system, but it can change according to the characteristics desired. The second block performs all the necessary pre-processing: it has to remove artifacts from the sensor, to enhance the input (e.g. removing background noise), to use some kind of normalisation, etc. In the third block features needed are extracted. This step is an important step as the correct features need to be extracted and the optimal way. A vector of numbers or an image with particular properties is used to create a template. A template is a synthesis of all the characteristics extracted from the source, in the optimal size to allow for adequate identifiability.

If enrollment is being performed the template is simply stored somewhere (on a card or within a database or both). If a matching phase is being performed, the obtained template is passed to a matcher that compares it with other existing templates, estimating the distance between them using any algorithm (e.g. Hamming distance). The matching programme will analyse the template with the input. This will then be output for any specified use or purpose (e.g. entrance in a restricted area).

Functions

A biometric system can provide the following two functions :

• Verification does the template match the input sample? A pre-stored template is matched against a sample directly, e.g a card or known database entry.
• Identification what is the input sample? identifying from all the templates which one is the closest match to the input sample.

Performance measurement

• false accept rate (FAR) or false match rate (FMR): the probability that the system incorrectly declares a successful match between the input pattern and a non-matching pattern in the database. It measures the percent of invalid matches. These systems are critical since they are commonly used to forbid certain actions by disallowed people.
• false reject rate (FRR) or false non-match rate (FNMR): the probability that the system incorrectly declares failure of match between the input pattern and the matching template in the database. It measures the percent of valid inputs being rejected.
• receiver (or relative) operating characteristic (ROC): In general, the matching algorithm performs a decision using some parameters (e.g. a threshold). In biometric systems the FAR and FRR can typically be traded off against each other by changing those parameters. The ROC plot is obtained by graphing the values of FAR and FRR, changing the variables implicitly. A common variation is the Detection error trade-off (DET), which is obtained using normal deviate scales on both axes. This more linear graph illuminates the differences for higher performances (rarer errors).
• equal error rate (EER): the rate at which both accept and reject errors are equal. ROC or DET plotting is used because how FAR and FRR can be changed, is shown clearly. When quick comparison of two systems is required, the ERR is commonly used. Obtained from the ROC plot by taking the point where FAR and FRR have the same value. The lower the EER, the more accurate the system is considered to be.
• failure to enroll rate (FTE or FER): the percentage of data input is considered invalid and fails to input into the system. Failure to enroll happens when the data obtained by the sensor are considered invalid or of poor quality.
• failure to capture rate (FTC): Within automatic systems, the probability that the system fails to detect a biometric characteristic when presented correctly.
• template capacity: the maximum number of sets of data which can be input in to the system.

Performance

The following table shows the state of art of some biometric systems:

State of art of biometric recognition systems

Biometrics	EER	FAR	FRR	Subjects	Comment	Reference
Face	n.a.	1 %	10 %	37437	Varied lighting, indoor/outdoor	FRVT (2002)[4]
Fingerprint	n.a.	1 %	0.1 %	25000	US Government operational data	FpVTE (2003)[5]
Fingerprint	2 %	2 %	2 %	100	Rotation and exaggerated skin distortion	FVC (2004)[6]
Hand geometry	1 %	2 %	0.1 %	129	With rings and improper placement	(2005)[7]
Iris	<>	0.94 %	0.99 %	1224	Indoor environment	ITIRT (2005)[8]
Iris	0.01 %	0.0001 %	0.2 %	132	Best conditions	NIST (2005)[9]
Keystrokes	1.8 %	7 %	0.1 %	15	During 6 months period	(2005)[10]
Voice	6 %	2 %	10 %	310	Text independent, multilingual	NIST (2004)[11]

One simple but artificial way to judge a system is by EER, but not all the authors provided it. Moreover, there are two particular values of FAR and FRR to show how one parameter can change depending on the other. For fingerprint there are two different results, the one from 2003 is older but it was performed on a huge set of people, while in 2004 much less people were involved but stricter conditions have been applied. For iris, both references belong to the same year, but one was performed on more people, the other one is the result of a competition between several universities so, even if the sample is much smaller, it could reflect better the state of art of the field.

Issues and concerns

As with many interesting and powerful developments of technology, there are concerns about biometrics. The biggest concern is the fact that once a fingerprint or other biometric source has been compromised it is compromised for life, because users can never change their fingerprints. A theoretical example is a debit card with a personal Identification Number (PIN) or a biometric. Some argue that if a person's biometric data is stolen it might allow someone else to access personal information or financial accounts, in which case the damage could be irreversible. However, this argument ignores a key operational factor intrinsic to all biometrics-based security solutions: biometric solutions are based on matching, at the point of transaction, the information obtained by the scan of a "live" biometric sample to a pre-stored, static "match template" created when the user originally enrolled in the security system. Most of the commercially available biometric systems address the issues of ensuring that the static enrollment sample has not been tampered with (for example, by using hash codes and encryption), so the problem is effectively limited to cases where the scanned "live" biometric data is hacked. Even then, most competently designed solutions contain anti-hacking routines. For example, the scanned "live" image is virtually never the same from scan to scan owing to the inherent plasticity of biometrics; so, ironically, a "replay" attack using the stored biometric is easily detected because it is too perfect a match.

The television program Mythbusters attempted to break into a commercial security door equipped with biometric authentication as well as a personal laptop so equipped. While the laptop's system proved more difficult to bypass, the advanced commercial security door with "live" sensing was fooled with a printed scan of a fingerprint after it had been licked. Assuming the tested security door is representative of the current typical state of biometric authentication, that it was so easily bypassed suggests biometrics may not yet be reliable as a strong form of authentication.

Marketing of biometric products

Despite confirmed cases of defeating commercially available biometric scanners, many companies marketing biometric products (especially consumer-level products such as readers built into keyboards) still claim the products as replacements, rather than supplements, for passwords. Furthermore, regulations regarding advertising and manufacturing of biometric products are (as of 2006) largely non-existent. Given the low security, consumer-level products are most likely to be bought and used by most people, leading to the risk of large-scale economic and social problems associated with biometric identity theft.^{[citation needed]}

Sociological concerns

As technology advances, and time goes on, more and more private companies and public utilities will use biometrics for safe, accurate identification. However, these advances will raise many concerns throughout society, where many may not be educated on the methods. Here are some examples of concerns society has with biometrics:

• Physical - Some believe this technology can cause physical harm to an individual using the methods, or that instruments used are unsanitary. For example, there are concerns that retina scanners might not always be clean.

• Personal Information - There are concerns whether our personal information taken through biometric methods can be misused, tampered with, or sold, e.g. by criminals stealing, rearranging or copying the biometric data. Also, the data obtained using biometrics can be used in unauthorized ways without the individual's consent.

Danger to owners of secured items

When thieves cannot get access to secure properties, there is a chance that the thieves will stalk and assault the property owner to gain access. If the item is secured with a biometric device, the damage to the owner could be irreversible, and potentially cost more than the secured property. In 2005, Malaysian car thieves cut off the finger of a Mercedes-Benz S-Class owner when attempting to steal the car.

Uses and initiatives

Brazil

Since the beginning of the 20th century, Brazilian citizens have user ID cards. The decision by the Brazilian government to adopt fingerprint-based biometrics was spearheaded by Dr. Felix Pacheco at Rio de Janeiro, at that time capital of the Federative Republic. Dr. Pacheco was a friend of Dr. Juan Vucetich, who invented one of the most complete tenprint classification systems in existence. The Vucetich system was adopted not only in Brazil, but also by most of the other South American countries. The oldest and most traditional ID Institute in Brazil (Instituto de Identificação Félix Pacheco) was integrated at DETRAN (Brazilian equivalent to DMV) into the civil and criminal AFIS system in 1999.

Each state in Brazil is allowed to print its own ID card, but the layout and data are the same for all of them. The ID cards printed in Rio de Janeiro are fully digitized using a 2D bar code with information which can be matched against its owner off-line. The 2D bar code encodes a color photo, a signature, two fingerprints, and other citizen data. This technology was developed in 2000 in order to enhance the safety of the Brazilian ID cards.

By the end of 2005, the Brazilian government started the development of its new passport. The new documents started to be released by the beginning of 2007, at Brasilia-DC. The new passport included several security features, like Laser perforation, UV hidden symbols, security layer over variable data and etc.. Brazilian citizens will have their signature, photo, and 10 rolled fingerprints collected during passport requests. All of the data is planned to be stored in ICAO E-passport standard. This allows for contactless electronic reading of the passport content and Citizens ID verification since fingerprint templates and token facial images will be available for automatic recognition.

United States

The United States government has become a strong advocate of biometrics with the increase in security concerns in recent years, since September 11, 2001. Starting in 2005, US passports with facial (image-based) biometric data were scheduled to be produced. Privacy activists in many countries have criticized the technology's use for the potential harm to civil liberties, privacy, and the risk of identity theft. Currently, there is some apprehension in the United States (and the European Union) that the information can be "skimmed" and identify people's citizenship remotely for criminal intent, such as kidnapping. There also are technical difficulties currently delaying biometric integration into passports in the United States, the United Kingdom, and the rest of the EU. These difficulties include compatibility of reading devices, information formatting, and nature of content (e.g. the US currently expect to use only image data, whereas the EU intends to use fingerprint and image data in their passport RFID biometric chip(s)).

The speech made by President Bush on May 15, 2006, live from the Oval Office, was very clear: from now on, anyone willing to go legally in the United States in order to work there will be card-indexed and will have to communicate his fingerprints while entering the country. Many foreigners will have to subject themselves to these procedures, formerly only imposed to criminals and to spies, not to immigrants and visitors, and even less to citizens.

"A key part of that system [for verifying documents and work eligibility of aliens] should be a new identification card for every legal foreign worker. This card should use biometric technology, such as digital fingerprints, to make it tamper-proof." President George W Bush (Addresses on Immigration Reform, May 15, 2006)

The US Department of Defense (DoD) Common Access Card, is an ID card issued to all US Service personnel and contractors on US Military sites. This card contains biometric data and digitized photographs. It also has laser-etched photographs and holograms to add security and reduce the risk of falsification. There have been over 10 million of these cards issued.

According to Jim Wayman, director of the National Biometric Test Center at San Jose State University, Walt Disney World is the nation's largest single commercial application of biometrics.However, the US Visit program will very soon surpass Walt Disney World for biometrics deployment.

Germany

The biometrics market in Germany will experience enormous growth until 2009. “The market size will increase from approximately 12 million € (2004) to 377 million €” (2009). “The federal government will be a major contributor to this development” . In particular, the biometric procedures of fingerprint and facial recognition can profit from the government project . In May 2005 the German Upper House of Parliament approved the implementation of the ePass, a passport issued to all German citizens which contain biometric technology. The ePass has been in circulation since November 2005, and contains a chip that initially will hold a digital photo of the holder's face. “Starting in March 2007, fingerprints also will be stored on the chips – one from each hand” . “A third biometric identifier – iris scans – could be added at a later stage” . An increase in the prevalence of biometric technology in Germany is an effort to not only keep citizens safe within German borders but also to comply with the current US deadline for visa-waiver countries to introduce biometric passports . In addition to producing biometric passports for German citizens, the German government has put in place new requirements for visitors for apply for visas within the country. “Only applicants for long-term visas, which allow more than three months' residence, will be affected by the planned biometric registration program. The new work visas will also include fingerprinting, iris scanning, and digital photos” .

Germany is also one of the first countries to implement biometric technology at the Olympic Games to protect German athletes. “The Olympic Games is always a diplomatically tense affair and previous events have been rocked by terrorist attacks - most notably when Germany last held the Games in Munich in 1972 and 11 Israeli athletes were killed” .

Biometric technology was first used at the Olympic Summer Games in Athens, Greece in 2004. “On registering with the scheme, accredited visitors will receive an ID card containing their fingerprint biometrics data that will enable them to access the 'German House'. Accredited visitors will include athletes, coaching staff, team management and members of the media” .

Australia

Visitors intending to visit Australia may soon have to submit to biometric authentication as part of the Smartgate system, linking individuals to their visas and passports. Biometric data are already collected from some visa applicants by Immigration. Other applications include authentication of gym users etc.

Israel

Biometrics have been used extensively in Israel for several years. ^{[citation needed]}

The border crossing points from Israel to the Gaza Strip and West Bank are controlled by gates through which authorised Palestinians may pass. Thousands of Palestinians (upwards of 90,000) pass through the turnstiles every day to work in Israel, and each of them has an ID card which has been issued by the Israeli Military at the registration centres. At peak periods more than 15,000 people an hour pass through the gates. The ID card is a smartcard with stored biometrics of fingerprints, facial geometry and hand geometry. In addition there is a photograph printed on the card and a digital version stored on the smartcard chip. ^{[citation needed]}

Tel Aviv Ben Gurion Airport has a frequent flyer's fast check-in system which is based on the use of a smartcard which holds information relating to the holders hand geometry and fingerprints. For a traveller to pass through the fast path using the smartcard system takes less than 10 seconds. ^{[citation needed]}

The Immigration Police at Tel Aviv Airport use a system of registration for foreign workers that utilises fingerprint, photograph and facial geometry which is stored against the Passport details of the individual. There is a mobile version of this which allows the police to check on an individual's credentials at any time. ^{[citation needed]}

Iraq

Biometrics are being used extensively in Iraq to catalogue as many Iraqis as possible providing Iraqis with a verifiable identification card, immune to forgery. During account creation, the collected biometrics information is logged into a central database which then allows a user profile to be created. Even if an Iraqi has lost their ID card, their identification can be found and verified by using their unique biometric information. Additional information can also be added to each account record, such as individual personal history. This can help American forces determine whether someone has been causing trouble in the past. One major system in use in Iraq is called BISA. This system uses a smartcard and a users biometrics (fingerpint, iris, and face photos) to ensure they are authorized access to a base or facility.

Japan

Several banks in Japan have adopted palm vein authentication technology on their ATMs. This technology which was developed by Fujitsu, among other companies, proved to have low false rejection rate (around 0.01%) and a very low false acceptance rate (less than 0.00008%).

Magnetic stripe card

A magnetic stripe card is a type of card capable of storing data by modifying the magnetism of tiny iron-based magnetic particles on a band of magnetic material on the card. The magnetic stripe, sometimes called a magstripe, is read by physical contact and swiping past a reading head. Magnetic stripe cards are commonly used in credit cards, identity cards, transportation tickets, an RFID tag, a transponder device and/or a microchip mostly used for business premises access control or electronic payment.

A number of International Organization for Standardization standards, ISO 7810, ISO 7811, ISO 7812, ISO 7813, and ISO 4909, define the physical properties of the card, including size, flexibility, location of the magstripe, and magnetic characteristics. They also provide the standards for financial cards, including the allocation of card number ranges to different card issuing institutions.

The magnetic stripe

The process of attaching a magnetic stripe to a plastic card was invented by IBM under a contract with the US government for a security system. Forrest Parry, an IBM Engineer, had the idea of securing a piece of magnetic tape, the predominant storage medium at the time, to a plastic card base. He became frustrated because every adhesive he tried produced unacceptable results. The tape strip either warped or its characteristics were affected by the adhesive making it technically unusable. After a frustrating day in the laboratory, trying to get the right adhesive, he came home with several pieces of magnetic tape and several plastic cards. As he walked in the door at home, his wife was ironing and watching TV. She immediately saw the frustration on his face and asked what was wrong. He explained the source of his frustration: inability to get the tape to "stick" to the plastic in a way that would work. She said, "Here, let me try the iron." She did and the problem was solved. The heat of the iron was just high enough to bond the tape to the card.

There were a number of steps required to convert the magnetic striped media into an industry acceptable device. These steps included: 1) Creating the international standards for stripe record content, including which information, in what format, and using which defining codes. 2) Field testing the proposed device and standards for market acceptance. 3) Developing the manufacturing steps need to mass produce the large number of cards required. 4) Adding stripe issue and acceptance capabilities to available equipment. These steps were initially managed by Jerome Svigals of the Advanced Systems Division of IBM, Los Gatos, California from 1966 to 1975.

In most magnetic stripe cards, the magnetic stripe is contained in a plastic-like film. The magnetic stripe is located 0.223 inches (5.66 mm) from the edge of the card, and is 0.375 inches (9.52 mm) wide. The magnetic stripe contains three tracks, each 0.110 inches (2.79 mm) wide. Tracks one and three are typically recorded at 210 bits per inch (8.27 bits per mm), while track two typically has a recording density of 75 bits per inch (2.95 bits per mm). Each track can either contain 7-bit alphanumeric characters, or 5-bit numeric characters. Track 1 standards were created by the airlines industry (IATA). Track 2 standards were created by the banking industry (ABA). Track 3 standards were created by the Thrift-Savings industry.

Magstripes following these specifications can typically be read by most point-of-sale hardware, which are simply generic general-purpose computers that can be programmed to perform specific tasks. Examples of cards adhering to these standards include ATM cards, bank cards (credit and debit cards including VISA and MasterCard), gift cards, loyalty cards, driver's licenses, telephone calling cards, membership cards, electronic benefit transfer cards (e.g. food stamps), and nearly any application in which value or secure information is not stored on the card itself. Many video game and amusement centers now use debit card systems based on magnetic stripe cards. An Example of one of these is ECS by Embed International.

Counterexamples of cards which intentionally ignore these standards include hotel keycards, most subway and bus cards, and some national prepaid calling cards (such as for the country of Cyprus) in which the balance is stored and maintained directly on the stripe and not retrieved from a remote database.

Magnetic stripe coercivity

Magstripes come in two main varieties: high-coercivity (HiC) at 4000 Oe and low-coercivity (LoC) at 300 Oe but it is not infrequent to have intermediate values at 2750 Oe. High-coercivity magstripes are harder to erase, and therefore are appropriate for cards that are frequently used or that need to have a long life. Low-coercivity magstripes require a lower amount of magnetic energy to record, and hence the card writers are much cheaper than machines which are capable of recording high-coercivity magstripes. A card reader can read either type of magstripe, and a high-coercivity card writer may write both high and low-coercivity cards (most have two settings, but writing a LoC card in HiC may sometimes work), while a low-coercivity card writer may write only low-coercivity cards.

In practical terms, usually low coercivity magnetic stripes are a light brown color, and high coercivity stripes are nearly black; exceptions include a proprietary silver-colored formulation on transparent American Express cards. High coercivity stripes are resistant to damage from most magnets likely to be owned by consumers. Low coercivity stripes are easily damaged by even a brief contact with a magnetic purse strap or fastener. Because of this, virtually all bank cards today are encoded on high coercivity stripes despite a slightly higher per-unit cost.

Magnetic stripe cards are used in very high volumes in the mass transit sector, replacing paper based tickets with either a directly applied magnetic slurry or hot foil stripe. Slurry applied stripes are generally less expensive to produce and are less resilient but are suitable for cards meant to be disposed after a few uses.

Financial cards

There are up to three tracks on magnetic cards used for financial transactions, known as tracks 1, 2, and 3. Track 3 is virtually unused by the major worldwide networks such as VISA, and usually isn't even physically present on the card by virtue of a narrower magnetic stripe. Point-of-sale card readers almost always read track 1, or track 2, and sometimes both, in case one track is unreadable. The minimum cardholder account information needed to complete a transaction is present on both tracks. Track 1 has a higher bit density (210 bits per inch vs. 75), is the only track that may contain alphabetic text, and hence is the only track that contains the cardholder's name.

The information on track 1 on financial cards is contained in several formats: A, which is reserved for proprietary use of the card issuer, B, which is described below, C-M, which are reserved for use by ANSI Subcommittee X3B10 and N-Z, which are available for use by individual card issuers:

Track one, Format B:

• Start sentinel — one character (generally '%')
• Format code="B" — one character (alpha only)
• Primary account number — up to 19 characters
• Field Separator — one character (generally '^')
• Name — two to 26 characters
• Field Separator — one character (generally '^')
• Expiration date — four characters
• Service code — three characters
• Discretionary data — may include Pin Verification Key Indicator (PVKI, 1 character), Pin Verification Value (PVV, 4 characters), Card Verification Value or Card Verification Code (CVV or CVK, 3 characters)
• End sentinel — one character (generally '?')
• Longitudinal redundancy check (LRC) — one character

LRC is a form of computed check character.

The format for track 2 was developed by the banking industry (ABA). This track is written with a 5-bit scheme (4 data bits + 1 parity), which allows for sixteen possible characters, which are the numbers 0-9, plus the six characters : ; < = > ? . The selection of six punctuation symbols may seem odd, but in fact the sixteen codes simply map to the ASCII range 0x30 through 0x3f, which defines ten digit characters plus those six symbols. The data format is as follows:

• Start sentinel — one character (generally ';')
• Primary account number — up to 19 chars
• Separator — one char (generally '=')
• Expiration date — four characters
• Service code — three characters
• Discretionary data — as in track one
• End sentinel — one character (generally '?')
• LRC — one character

Note: It is possible for these strips to be completely erased if brought close to high strength Neodymium magnets

Driver's Licenses (USA)

The data stored on magnetic stripes on American driver's licenses is specified by the American Association of Motor Vehicle Administrators (AAMVA).

The following data is stored on track 1:

• Start Sentinel - one character (generally '%')
• State or Province - two characters
• City - unknown length
• Field Separator - one character (generally '^')
• Last Name - unknown length
• Field Separator - one character (generally '$')
• First Name - unknown length
• Field Separator - one character (generally '$')
• Middle Name - unknown length
• Field Separator - one character (generally '^')
• Address - unknown length
• Field Separator - one character (generally '^')
• Unknown (spaces on mine) - unknown length
• End Sentinel - one character (generally '?')

The following data is stored on track 2:

• ISO Issuer Identifier Number (IIN)
• Drivers License / Identification Number
• Field Separator — generally '='
• Expiration Date
• Birth date (YYYYMMDD)
• DL/ID# overflow

The following data is stored on track 3:

• Template V#
• Security V#
• Postal Code
• Class
• Restrictions
• Endorsements
• Sex
• Height
• Weight
• Hair Color
• Eye Color
• ID#
• Reserved Space
• Error Correction
• Security

Other card types

Smart cards are a newer generation of card containing an integrated circuit chip. The card may have metal contacts connecting the card physically to the reader, while contactless cards use a magnetic field or radio frequency (RFID) for proximity reading.

'Hybrid' smart cards include a magnetic stripe in addition to the chip — this is most commonly found in a payment card, so that the cards are also compatible with payment terminals that do not include a smart card reader.

Physical security

Physical security describes measures that prevent or deter attackers from accessing a facility, resource, or information stored on physical media. It can be as simple as a locked door or as elaborate as multiple layers of armed guardposts.

Elements and design

Spikes atop a barrier wall

The field of security engineering has identified three elements to physical security:

• obstacles, to frustrate trivial attackers and delay serious ones;
• alarms, security lighting, security guard patrols or closed-circuit television cameras, to make it likely that attacks will be noticed; and
• security response, to repel, catch or frustrate attackers when an attack is detected.

In a well designed system, these features must complement each other. There are four layers of physical security:

• Environmental design
• Mechanical and electronic access control
• Intrusion detection
• Video monitoring

The initial layer of security for a campus, building, office, or physical space uses environmental design to deter threats. Some of the most common examples are also the most basic - barbed wire, warning signs and fencing, concrete bollards, metal barriers, vehicle height-restrictors, site lighting and trenches.

Electronic access control

The next layer is mechanical and includes gates, doors, and locks. Key control of the locks becomes a problem with large user populations and any user turnover. Keys quickly become unmanageable forcing the adoption of electronic access control. Electronic access control easily manages large user populations, controlling for user lifecycles times, dates, and individual access points. For example a user's access rights could allow access from 0700 to 1900 Monday through Friday and expires in 90 days.

The third layer is intrusion detection systems or alarms. Intrusion detection monitors for attacks. It is less a preventative measure and more of a response measure. Although some would argue that it is a deterrent. Intrusion detection has a high incidence of false alarms. In many jurisdictions, law enforcement will not respond to alarms from intrusion detection systems.

Closed-circuit television sign

The last layer is video monitoring systems. Like intrusion detection, these are not much of a deterrent. Video monitoring systems are more useful for incident verification and historical analysis. For instance, if alarms are being generated and there is a camera in place, the camera could be viewed to verify the alarms. In instances when an attack has already occurred and a camera is in place at the point of attack, the recorded video can be reviewed. Although the term closed-circuit television (CCTV) is common, it is quickly becoming outdated as more video systems lose the closed circuit for signal transmission and are instead transmitting on computer networks. Advances in information technology are transforming video monitoring into video analysis. For instance, once an image is digitized it can become data that sophisticated algorithms can act upon. As the speed and accuracy of automated analysis increases, the video system could move from a monitoring system to an intrusion detection system or access control system. It is not a stretch to imagine a video camera inputting data to a processor that outputs to a door lock. Instead of using some kind of key, whether mechanical or electrical, a person's visage is the key.

Private factory guard

Intertwined in these four layers are people. Guards have a role in all layers, in the first as patrols and at checkpoints. In the second to administer electronic access control. In the third to respond to alarms. And in the fourth to monitor and analyze video. Users obviously have a role also by questioning and reporting suspicious people. Aiding in identifying people as known versus unknown are identification systems. Often photo ID badges are used and are frequently coupled to the electronic access control system. Visitors are often required to wear a visitor badge.

For example, the response force must be able to arrive on site in less time than it is expected that the attacker will require to breach the barriers; and

• persuading them that the likely costs of attack exceed the value of making the attack.

For example, ATMs (cash dispensers) are protected, not by making them invulnerable, but by spoiling the money inside when they are attacked. Attackers quickly learned that it was futile to steal or break into an ATM if all they got was worthless money covered in dye.

Conversely, safes are rated in terms of the time in minutes which a skilled, well equipped safe-breaker is expected to require to open the safe. These ratings are developed by highly skilled safe breakers employed by insurance agencies, such as Underwriters Laboratories. In a properly designed system, either the time between inspections by a patrolling guard should be less than that time, or an alarm response force should be able to reach it in less than that time.

Hiding the resources, or hiding the fact that resources are valuable, is also often a good idea as it will reduce the exposure to opponents and will cause further delays during an attack, but should not be relied upon as a principal means of ensuring security (see security through obscurity and inside job).

Door security

Door security relates to prevention of door-related burglaries. Such break-ins take place in various forms, and in a number of locations; ranging from front, back and side doors to garage doors.

Common Residential Door Types

The following are the types of doors typically used in residential applications: solid wood door, panel doors (hollow and solid core), metal skinned wood-edged doors and metal edge-wrapped doors. Typically, door frames are solid wood. Residential doors also frequently contain windows.

Security Weakness of Common Residential Door Types

Security tests by Consumer Reports Magazine in the 1990s found that many residential doors fail or delaminate when force is applied to them. Solid wood doors withstood more force than the very common metal skinned wood-edged doors used in newer construction. A broad range door manufacturer, Premdor (now Masonite) once stated in one of its 1990s brochures entitled "Premdor Entry Systems" page 6 that "The results of tests were overwhelming, Steel edged doors outperform wood-edged doors by a ratio of 7 to 1 When you consider the practically two-thirds of all illegal entries were made through doors... One hit of 100 lb strike force broke the wood-edged stile and opened the door. To actually open the steel-edged door required 7 strikes of 100 lb pressure." Most door manufactures offer a number of different types of doors with varying levels of strength.

Consumer Reports Magazine also reported in its test results that door frames often split with little force applied and lower quality deadbolts simply failed when force was applied to the door.

The Chula Vista Residential Burglary Reduction Project which studied over 1,000 incidents; "We also learned what prevention techniques seemed to have little effect on whether a burglary would be successful. Methods found to have relatively low effectiveness included: sliding glass door braces, such as wooden dowels, as opposed to sliding door channel or pin locks; deadbolts installed in the front door only; and outdoor lights on dusk-to-dawn timers... burglars typically ransacked or vandalized at least 25% of the homes they burglarized..." The Chula Vista Residential Burglary Reduction Project - Summary

Burglary Tactics

The Chula Vista Residential Burglary Reduction Project there were the following findings: "From victim interviews, we learned that in 87% of the break-ins that occurred when intruders defeated locked doors with tools such as screwdrivers or crowbars, the burglars targeted "the one door that had no deadbolt lock."... not one burglar attempted to break a double-pane window during the course of successful or attempted burglary." The Chula Vista Residential Burglary Reduction Project - Summary

Door security devices

• Alarms

• Deadbolts - many manufacturers make deadbolts that are resistant to impact failure, picking and lock bumping^{[citation needed]}. However, most deadbolts are not pick-resistant^{[citation needed]}. Consumer Reports Magazine's testing showed that many manufacturers make deadbolts that break apart and otherwise fail when force is applied to the door.

• Door strike reinforcers - general there are two products: frame reinforces (one, metal strips installed vertically on or behind the door frame and two, strike pocket reinforcers whereby 3" screws are often provided to tie the deadbolt pocket beyond the thin door frame material, and directly to the stud or other wall).

• Deadbolt / door / frame reinforcements - various products are made to prevent delamination and or splitting of the door frame - metal wraps can be placed under the deadbolt and wrap the door edge to prevent delamination and heavy duty products that place plates on either side the door and/or frame which are tied together with screws or bolts prevent delamination.

• Door Chains - allows the doors to be opened slightly.

• Secondary, internal locks - sliding bolts, hooks and specialty latches, or more accurately, metal blocks or bars mounted internally.

• Door viewers - small fish-eye lenses that allow residents to view outside.

• Door Windows - There are three common methods to add security to windows in or beside doors - one, security films (coatings applied to the glass in windows to reinforce it), two, security bars and grates, and three breakage resistant plexiglas, lexan and other glass replacement products.

• Hinge screws - longer 3" screws, and specialized screws that prevent the door from being simply pushed in after removing the hinge pins.

• Sliding door /patio door locks - there are numerous specialized products to prevent sliding doors from being defeated easily.

• Visibility - Most police departments recommend shrubs be cleared from near doorways to reduce the chance of a burglar being hidden from public view.