{'fraction_non_alphanumeric': 0.01860802319961334, 'fraction_numerical': 0.004108264862252296, 'mean_word_length': 5.4071207430340555, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Password Pitfalls and Dynamic Biometrics: Toward a Multi-Layer User Authentication Approach for Electronic Business

ABSTRACT With the increased awareness of the dangers of cyber-terrorism and identity fraud, the security of information systems has been propelled to the forefront as organizations strive to implement greater access control. Access control for information systems is founded upon reliable user authentication, and the predominant form of authentication remains the username-password combination. There are several vulnerabilities associated with an over-reliance upon this method of authentication, stemming from weaknesses in both the user construction of passwords and single-layer authentication techniques. The growing number of Internet business transactions highlights the need for a more secure method of user authentication that is cost-effective as well as practical. A multi-layer user authentication scheme is proposed as a solution, incorporating the use of dynamic biometric data selection and a timestamp to guard against reuse of intercepted authentication bit streams. INTRODUCTION Computer-based information systems are becoming increasingly vital to the success of many businesses. As organizations move to adapt to the digital era, the quantity of confidential and sensitive data stored in electronic form on computers continues to increase at a blinding pace. The growing trend in customer relationship management and the need to offer personalization through customized information further adds to the wealth of data contained in these information systems. Since the compromise of the sensitive data stored in information systems can be disastrous for an organization, the security of these systems is of utmost concern. The terrorist attacks of September 11, 2001 have served to propel security issues to the forefront, causing information systems managers to reanalyze their current methods of security and access control. In spite of these recent efforts, information system security remains surprisingly weak. The overwhelming majority of information system hacks and intrusions go unreported due to concerns over negative publicity, yet the few that are reported give a remarkably clear indication that hacking and cyber-terrorism are on the rise, annually causing considerable damage to organizations. At the core of this surge in information systems security breaches is a fundamental flaw in the access control methods employed by most firms. The flaw lies in the over-reliance upon passwords as the primary, and in many cases the only, means of user authentication. Given that "practically every penetration of a computer system, at some stage, relies on the ability to compromise a password," (Zviran & Haga, 1999, pp. 164) it seems rather surprising that passwords continue to form the basis of user authentication methods. In the password-based scheme, users of the information system are required to enter a username-password combination. The username establishes the identity of an individual as a valid user, and the password serves to confirm that identity and provide access to authorized resources (Proctor et al., 2002). Passwords are inherently weak security constructs due to the ability of hackers to guess them through brute-force methods enabled by the processing power of today's computers. Despite their knowledge of the vulnerability posed by password-based user authentication systems, information systems managers continue to rely heavily upon single authentication using password-based access control because of its low implementation cost and end-user convenience. In the case of Internet web sites that require user authentication to provide personalized information or sensitive data, there does not appear to be a cost-effective alternative to the use of the username-password pair for access control. While major corporations have the financial ability to augment the security of their intranets and extranets through the use of smart cards and token devices, it is impractical and far too costly for business-to-consumer web sites to deploy this same technology. …