ISO/IEC 27553-1
ISO/IEC 27553-1:2022 — Information security, cybersecurity and privacy protection — Security and privacy requirements for authentication using biometrics on mobile devices — Part 1: local modes
(first edition)
Abstract
ISO/IEC 27553 part 1 "provides high-level security and privacy requirements and recommendations for authentication using biometrics on mobile devices, including security and privacy requirements and recommendations for functional components and for communication. [The standard] is applicable to the cases that the biometric data and derived biometric data do not leave the device, i.e. local modes.”
[Source: ISO/IEC 27553-1:2022]
Introduction
This multi-part standard provides high-level requirements for biometric authentication on mobile devices, including functional components and communications.
Biometrics are increasingly used for user authentication on mobile devices. They are easier to use and harder to steal or fake than conventional passwords and tokens. However, proliferating devices and approaches are fragmenting the market, hence standardization offers advantages for users and manufacturers.
Scope
Biometric authentication on mobile devices.
Part 1 applies where the user of a mobile ICT device such as a smartphone or tablet PC biometrically authenticates directly to the device such as when logging on to unlock the device, access stored data and run mobile apps.
Although the outcome of biometric authentication may be used elsewhere (e.g. in cloud or corporate server apps), this standard specifically concerns risks to and protection of the biometrics on the device itself (e.g. fingerprints).
The standard references ISO/IEC 24745:2022 “Biometric information protection”.
Structure
Main sections:
5: Security challenges
6: System description
7: Information assets
8: Threat analysis
9 :Security requirements and recommendations
10: Privacy considerations
Annex A: Implementation example
Annex B: Security issues related to communication between agents and servers for authentication using biometric on mobile devices
Annex C: An example of authentication assurance and assurance levels
Status
The current first edition was published in 2022.
Commentary
As a generic standard, part 1 addresses commonplace information risks that typically arise in relation to biometrics on mobiles.
In practice, we should manage (identify, evaluate, treat and monitor) the actual information and privacy risks in real-world situations, including any that are not explicitly identified and accurately described in this standard.
That is context-dependent - for instance, the information risks relating to my biometrics on my cellphone are broadly similar but not entirely the same as, say, the king’s or yours, not least because the impacts of any incidents would probably be materially different.
Aside from the security and privacy implications arising, there may also be different assurance requirements relating to biometric authentication. The consequences of someone accessing my smartphone without authorisation are rather different in the case of the president's.