Information Security Basics

In fingerprint-based biometric authentication, the threshold on the matching score required to accept a user as genuine is made stricter (higher). Which change generally occurs?

  1. ABoth the false acceptance rate (FAR) and the false rejection rate (FRR) fall
  2. BThe false acceptance rate (FAR) rises and the false rejection rate (FRR) falls
  3. CThe false acceptance rate (FAR) falls and the false rejection rate (FRR) rises
Show answer and explanation

Answer: C. The false acceptance rate (FAR) falls and the false rejection rate (FRR) rises

Biometric authentication expresses how well the captured features match the enrolled features as a score and accepts the user as genuine if the score is at or above a threshold. The false acceptance rate (FAR) is the rate at which impostors are wrongly accepted, and the false rejection rate (FRR) is the rate at which genuine users are wrongly rejected. Making the threshold stricter makes it harder for impostors to pass, so FAR falls, but genuine users whose score is lower than usual, because of finger placement or dry skin for example, are rejected more often, so FRR rises. FAR and FRR thus trade off: moving the threshold lowers one and raises the other. The threshold is set to keep FAR low in security-critical uses and FRR low where convenience matters. The value at which FAR and FRR are equal (the equal error rate, EER) is used as a guide for comparing systems.

  • A. Moving the threshold alone cannot lower both at once. Lowering both requires improving the sensor or the matching method itself.
  • B. This is what happens when the threshold is relaxed.
  • C. Correct. A stricter threshold makes it harder for impostors to pass, but genuine users are also rejected more often.
Practice this topic Back to topic

Related calculators

Books on Information Security Basics Ad

As an Amazon Associate I earn from qualifying purchases.

More Information Security Basics questions

  1. A face recognition device can be set to one of three thresholds, A, B and C, with a false acceptance rate (FAR) and false rejection rate (FRR) of 1% and 0.5% for A, 0.1% and 2% for B, and 0.01% and 8% for C. For controlling entry to a laboratory, the requirement is a FAR of 0.1% or less, and within that, legitimate users should be rejected as rarely as possible. Which threshold should be chosen?
  2. Which statement correctly describes single sign-on (SSO)?
  3. Which practice follows the principle of least privilege?
  4. A company with thousands of employees manages permissions with role-based access control (RBAC). Which statement describes the idea of RBAC?
  5. Among the types of malware, which statement correctly describes a worm?