GSEC · Question #46
An attacker gained physical access to an internal computer to access company proprietary data. The facility is protected by a fingerprint biometric system that records both failed and successful…
The correct answer is B. Try to lower the False Accept Rate (FAR). The attacker entered without triggering a failure log, indicating the biometric system falsely accepted an unauthorized person - a False Accept Rate (FAR) problem that requires tightening the acceptance threshold.
Question
An attacker gained physical access to an internal computer to access company proprietary data. The facility is protected by a fingerprint biometric system that records both failed and successful entry attempts. No failures were logged during the time periods of the recent breach. The account used when the attacker entered the facility shortly before each incident belongs to an employee who was out of the area. With respect to the biometric entry system, which of the following actions will help mitigate unauthorized physical access to the facility?
Options
- ATry raising the Crossover Error Rate (CER)
- BTry to lower the False Accept Rate (FAR)
- CTry setting the Equal Error Rate (EER) to zero
- DTry to set a lower False Reject Rate (FRR)
How the community answered
(52 responses)- A8% (4)
- B71% (37)
- C6% (3)
- D15% (8)
Why each option
The attacker entered without triggering a failure log, indicating the biometric system falsely accepted an unauthorized person - a False Accept Rate (FAR) problem that requires tightening the acceptance threshold.
Raising the Crossover Error Rate means accepting a worse balance between FAR and FRR, which would make the system less accurate overall and could increase the rate of false accepts.
The scenario describes a False Accept event where the biometric system granted access to an unauthorized individual with no failed attempts logged, meaning the system incorrectly verified the attacker as a legitimate user. Lowering the FAR makes the biometric matching threshold stricter, reducing the probability that an unauthorized person's biometric sample will be mistakenly accepted as a valid match.
The Equal Error Rate is a measurement point where FAR equals FRR, not a configurable value; it cannot be set to zero because eliminating both false accepts and false rejects simultaneously is technically impossible.
Lowering the False Reject Rate makes the system more permissive in granting access, which increases false accepts and directly worsens the problem described in the scenario.
Concept tested: Biometric False Accept Rate and physical access control hardening
Source: https://csrc.nist.gov/glossary/term/false_acceptance_rate
Topics
Community Discussion
No community discussion yet for this question.