Biometric presentation attacks

What the clause says

An estimation system that uses biometrics should resist presentation attacks. The framework points to the ISO/IEC 30107 series for the detection framework and the vocabulary.

What it supplies to a comparison

The attack test is the security evidence behind an estimation claim. A comparison that omits it tests convenience, not assurance.

Evidence to keep

• The attack instruments and the acceptance rate for each.
• The attack potential the laboratory was working to.

What the evidence looks like

For 8.2.1, the first artefact is The attack instruments and the acceptance rate for each.. The second is The attack potential the laboratory was working to.. If 8.2.1 has no first artefact, the practice is unproven at 8.2.1, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. Which presentation attacks were tried, and which succeeded?
2. Was the attack potential stated before the test?

How it connects to the draft

Biometric presentation attacks belongs to 8 security objectives, and it gives the analysis one fixed point: The attack test is the security evidence behind an estimation claim. A comparison that omits it tests convenience, not assurance. A comparison that cannot place a result against 8.2.1 is measuring something the framework has not defined, and the report should say so.

In the register, 8.2.1 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.