CIBC uses biometrics to secure sites

CIBC needed to make its processing plants as secure as possible without alienating the employees that worked there at the same time.

Cards, passwords and PIN numbers can easily be lost, stolen or leant out. So CIBC decided to implement biometrics technology to control physical access to its 10 processing plants across the country.

“Because the risk factor is fairly significant at these facilities, we do need to ensure that just entitled employees are permitted entry into our centres,” said Art Molasy, a security engineering specialist at CIBC in Toronto.

Retina or iris scanning technology seemed too obtrusive and was sure to instil fear in employees, Molasy said. Fingerprint biometrics seemed to be the least objectionable format.

Mytec Gateway, fingerprint biometrics technology by Mytec Technologies Inc. in Toronto, offered a way to secure access while at the same time addressing employee concerns about privacy.

The technology differs from the fingerprint methods used by law enforcement and offers employees more privacy because the pattern stored doesn’t resemble a fingerprint, said engineering and new product development director Terry Milkie of Mytec. Because no recognizable fingerprint pattern is stored, it doesn’t matter if the pattern is lost or stolen.

The law enforcement technique uses what are called minutiae points, end points in your fingerprint ridge that come to an end and don’t join anything else, to identify fingerprints. Mytec technology uses the whole fingerprint pattern – shape, contour and texture – to identify fingerprints.

If someone cuts or scratches their finger, more minutiae points are created, making identification through the matching of minutiae points difficult. Because a lot more data is used in Mytec’s method, cuts and scratches don’t make as much of a difference when making a match, Milkie said.

“We believe it’s more accurate. We believe it has built in redundancy – it’s more robust because we don’t care if you’ve cut your finger. It’s important that the pattern looks a little bit different, but because we have so much data, it doesn’t matter,” Milkie said.

The information gathered by a finger scan when an employee slides their finger across a reader is encrypted and stored in a pattern called a bioscrypt.

Employees carry their own bioscrypt around with them in a token that can be personalized in the form of a wrist watch or ring.

When an employees enters a secured facility, he or she scans a finger in a reader which compares the information gathered with the template that the employee carries. If there’s a match, a password is sent to the system, and the door is opened.

This method makes integration with existing security systems easier, said Christopher Paul, the financial services director of Chubb Security Systems in Mississauga, Ont., one of the systems integrators that CIBC used.

When the centralized system receives the password, it checks to see if the employee is entering on the right day and at the right time and then makes a decision whether or not to open the door.

“So we haven’t given the decision making process to the reader itself. We maintain that within the system so the system has full control and audit capabilities and time-date parameters which can help make decisions,” Paul said.

If an employee loses his or her token, a new token with a new password is made.

CIBC takes other precautions as well. When implementing its security system, it hired different integrators to implement different aspects of the system so that no one person or company knows where all the alarm and video cables are, said Paul, whose company helped integrate the alarm system in three of the processing plants.

Employees are also observed either directly or through a video system from the moment they enter the parking lot, in case someone forces an employee to open a door at gun point.

It’s also possible to enroll in the finger scanning system using two different fingers – one a normal operating finger, the other, a duress finger, Milkie said. Using the duress finger, a finger other than the one normally used to open a door, sends a signal that something is wrong – someone is forcing the employee to open the door, for example. The system can be programmed to open the door if the duress finger is used, but at the same time set off an alarm.

CIBC first tried the system in a pilot format in its Toronto centre and hopes to finish implementing the biometrics technology in all of its plants by the end of September.

“We do have a greater degree of security in our centres,” Molasy said.