Glendale - city secured by fingerprint biometric

The City of Glendale, nestled at the foot of the Verdugo Mountains in Los Angeles County, is anything but futuristic. The third-largest city in L.A. County is locally recognized for its history, natural beauty, and commercial accomplishments. But Glendale may soon earn a reputation for being at the forefront of technology. The city has replaced its employees' password protection system with fingerprint scanners that use biometrics, once considered a space-age technology.

Biometrics, the analysis of physical features such as eye, face, and finger characteristics, might seem an extreme form of access control for city employees, but the driving factor was efficiency. Both the city's IT department and its approximately 2,000 employees had struggled to maintain up-to-date and secure password protection.

"We struggled, users struggled, and independent auditors were pressing us to change our passwords at more frequent intervals," says Scott Harmon, assistant director of information services with the City of Glendale.

However, the more stringent the IT department made the password policy, the more difficult it was for users to comply. Glendale employees were already having difficulty remembering passwords changed every 90 days. Auditors were now recommending password changes every 60 days. Required to create new eight-digit alphanumeric passwords four times a year, users often scribbled their passwords on Post-it notes, inside a desk drawer, or on a piece of paper tucked away at their desks, which compromised the security of the city's data.

In an effort to ease the burden, the IT department synched a single password to multiple applications. "Users could have a single password for NT, NetWare, and the PC screensaver," says Harmon. But Windows itself wasn't synched, and the effort proved to be no more than a Band-Aid.

"Users still overloaded the help desk," he says, noting that 90 to 95 percent of all users failed to change their passwords at the end of the 90-day period and got locked out of their computers and applications. The only way to sign in was to call the help desk, which is manned by two full-time staffers and a part-time technician. It took approximately five minutes for a help desk technician to reset each user's passwords for Microsoft Outlook, Windows NT, and NetWare.

Scott Harmon had dreamed of better password security for the City of Glendale. The assistant director of information services thought it was beyond his tight IT budget, until he read an article in an industry trade journal that made him do a double take. "Fingerprint systems were available for a few hundred dollars per PC. I thought they ran about $500 to $1,000 per device," he says.

Steve Richmond, Glendale's IT security analyst, began researching vendors and products. About a year ago, Richmond ultimately selected the U.are.U Pro Fingerprint Security System from Digital Persona Inc., which met the city's criteria: it's easy to use, requires only an available USB port, and lists for $150 per device. The unit works with any Pentium-class PC running Windows 2000, NT, Me, 98, or 95 (version 4.0.95.0 B).

"We heard good things about Digital Persona," says Harmon. The company had the highest market share for this type of solution, according to industry research at the time, he added.

U.are.U Pro consists of both hardware and software. The fingerprint sensor, which is smaller and flatter than a PC mouse, reads fingerprints at any angle, even upside down, according to the vendor. The sensor's cable plugs into a USB port.

In less than half a day, Richmond and Harmon had half a dozen fingerprint sensors and the Pro Workstation Software operating in the IT department. It takes about five minutes for a technician to set up a sensor on a PC, says Harmon. First, the technician installs the software on the PC, which replaces the logon screen with a U.are.U screen. New users then register one or more fingerprints, on one hand or both. The sensor requires four images of a finger to create a unique biometric signature. The technician must reboot the PC for each application he registers--in Glendale's case four times, for Outlook, Windows NT, NetWare, and the screensaver. Both the user and the PC administrator must register with each PC.

During a month of testing, the IT staff tried to dupe the sensors. They tried running a photocopy of a fingerprint over the sensor, as well as a latex imprint of a fingerprint. "The sensor couldn't be fooled," Harmon says. Even when Harmon accidentally took off a few layers of skin on the fingers of both hands when he acid-washed his pool, the sensor still recognized his biometric signature.

Encouraged by the testing, IT ran another pilot of U.are.U Pro in the police department, and soon rolled out fingerprint sensors to all 200 machines in the division. "Security is the police department's number-one concern. They don't want anyone wandering through the department to be able to access a PC," says Harmon. He reports that all the feedback from the police department has been positive.

To date, the City of Glendale has purchased and installed about 320 fingerprint sensors in five departments--IT, police, finance, redevelopment, and management services.

Thanks to the fingerprint sensors, the help desk no longer receives complaints about forgotten or lost passwords. This has freed up a half day for a full-time technician--a savings of about $20,000 a year. Given that the city invested about $45,000 in the fingerprint security solution, it can expect payback in about 24 months. What the city can't put a price tag on is the benefits of enhanced security and better protection of the city's data.

Replacing all passwords
Using the One Touch Password feature of U.are.U Pro allows administrators to replace all the passwords on each PC. At the City of Glendale, one fingerprint scan gets users into Windows NT, NetWare, Microsoft Outlook, and the PC screensaver.

The plan is to replace every city employee's PC's authentication routine with biometrics. Each division is responsible for purchasing its own copies of the product.

In the future, the IT department hopes it can afford the $1,499 U.are.U Pro Server Software that enables centralized administration and installation. Harmon also may buy sensor-integrated keyboards, and is waiting for some test units to arrive. "It will be cleaner. Users won't have to have another device on the desktop," he says.

For IT staff, replacing passwords with the fingerprint technology is a dream come true. "We have tighter security, it's easy for the user, and we have a satisfied audience," Harmon says.

Only one glitch
The City of Glendale uses PCs from Dell Computer Corp., primarily Dimension 4100s but also 8100s, and has a mix of operating systems, including Windows 98, 2000, and NT, and even a few Windows 95 machines.

When the city's IT department installed the U.are.U Pro fingerprint sensors on its client PCs, it encountered only one glitch--the fingerprint system interferes with the sleep mode on the Windows 95 machines, preventing a machine from coming out of sleep mode. Harmon alerted the vendor to the problem but wasn't able to get a satisfactory resolution. "We just decided not to install it on these devices," he says, which are few in number.

The only other issue for IT is having to inform users to periodically clean off their sensor with Scotch tape, the same way you'd remove lint from your clothes. Users touch the sensor an average of two to 15 times per day.

When the City of Glendale, California, replaced password protection on more than 300 PCs with fingerprint recognition, it got great feedback from city employees. The IT department believed it had made the right decision. It still does. However, toting around a fingerprint sensor is a bit clumsy for mobile workers.

"This is an issue we're trying to figure out," says Scott Harmon, assistant director of information services for the City of Glendale.

Like many organizations, the City of Glendale, which has about 2,000 employees, has some workers who take work out of the office on a laptop. The city has between 50 and 100 Inspiron and Latitude laptops from Dell Computer Corp. And it plans to install PCs in police cruisers, raising the issue of log-on security for a device likely to be used by multiple officers.

"If you have your PC docked at work and then take it home, you either have to take the fingerprint sensor home with you or you have to have another sensor at home," says Harmon. The City of Glendale uses the U.are.U Pro Fingerprint Security System from Digital Persona, which sells additional sensors for about $100 each.

Perhaps more complicated is having to register multiple users for a single machine, as is required for the police cruisers. Registering officers who work three different shifts is awkward, says Harmon.

Administrators can opt to use both fingerprints and passwords with U.are.U, but the City of Glendale doesn't use the option. It wouldn't make sense, says Harmon, when objective of using biometrics is ease-of-use, improved security, and less administration.

The solution? "Finding a laptop vendor that offers a machine with a sensor-integrated keyboard," says Harmon.

City records are no less of a target for hackers than business information. That's why the City of Glendale, with about 2,000 employees in 16 divisions, is beefing up its Internet security and logon procedures. "We don't want our financial servers accessible from the Web site or outside the country," says Scott Harmon, assistant director of information services for the City of Glendale.

The City of Glendale's network is connected to its ISP, Los Nettos, via two T1 circuits. Today the city only has a single firewall protecting its internal network; any employee in any division with access to an Internet server can allow Internet traffic into the LAN or WAN. Harmon says the city wants incoming traffic to stay in a DMZ--a neutral zone for Internet servers that allows Internet traffic out of the city's network but not onto it. That's why the city is installing a second firewall, Check Point Firewall-1, to create a DMZ. "Our strategy is to have all of our Internet servers inside the DMZ," says Harmon, thus minimizing the risk that critical information will be exposed to the public. Traffic entering from the Internet will have to pass through the firewall, which connects to a subnet in the DMZ, where the Internet servers are located. The subnet connects to a second firewall, which then connects to the corporate LAN.

Protecting information on the city's intranet is equally important. Once employees log onto the Novell NetWare LAN, they can access the intranet and the information on it, such as e-mail, permits, PeopleSoft Financial Management, and a library catalog system.

Glendale already took a technological leap earlier this year when it began replacing its password logon system with the U.are.U Pro Fingerprint Security System from Digital Persona. The fingerprint authentication provides the city with better security than traditional password security did.

Today, more than 300 employees use biometric identification to get onto their computers, the network, and Microsoft Outlook. "Ultimately, we'd like to replace all passwords with the fingerprint security," says Harmon.

Police, fire, and building inspection workers are among the City of Glendale employees who will soon benefit from wireless LAN technology, which will give them access to city resources while out on the job.

Scott Harmon, assistant director of information services for the city, says his department is currently evaluating wireless LAN units from Alvarion Ltd., an Israel-based company formed in August 2001 from the merger of Breezecom Ltd. and Floware Wireless Systems Ltd.

The city is also looking at BreezeNet Pro.11 Outdoor, a wireless networking product line for bridging campuses, buildings, or remote sites in harsh radio environments. The city ultimately plans to build its own wireless LAN that will span most of the city's 30 square miles.

"We'll locate antennas on a priority basis for the needs of police, fire, building inspectors, and city executives," says Harmon. A single antenna, which costs about $5,000, covers one square mile.

While doing their jobs off-site, between 300 and 500 of the city's approximately 2,000 workers would like to access to the city's data and to submit reports remotely, neither of which they can do now. Making additional information available to employees on the road could be beneficial as well. Firefighters, for example, could receive weather data, while building inspectors could search a database for reports on building code violations or get permit information while at a construction site.

For about a year now, building inspectors have had access to city data via AT&T Wireless's Cellular Digital Packet Data network using Compaq iPaq Pocket PCs. How much the inspectors use the network determines the monthly service fee. However, data retrieval is limited because the network operates at a paltry 9,600 bps. The wireless LAN technology under evaluation operates at 1 Mbps or greater.

Given the importance of security and the range of devices that employees will use in the field, Harmon and IT security experts are trying to figure out how to extend their PC-based fingerprint security system to the mobile units. Over 300 city employees currently use the U.are.U Fingerprint Security System from Digital Persona Inc., which has a sensor that plugs into a USB port. For mobile workers, however, carrying a fingerprint sensor is clumsy. "We're still trying to figure this one out," says Harmon.