Study. uk . com
  1. Home
  2. All questions
  3. Question 45

CISSP study material · question 45 of 500

A bank is adding face recognition as an authentication factor. Testing shows the algorithm performs worse for one demographic group, so the vendor offers to lower the match threshold for that group so acceptance rates even out. Under NIST SP 800-63B-4, how should the bank respond to the offer?

  1. Reject it; the acceptance threshold must stay fixed, and the false match rate must be at most one in 10,000 for every demographic group.
  2. Reject it; any biometric whose false non-match rate exceeds five percent is barred outright from serving as an authentication factor.
  3. Accept it; the accuracy requirement constrains only the false non-match rate, which lowering the threshold for that group improves.
  4. Accept it; per-group tuning is permitted so long as the false match rate averaged across all groups stays at or below one in 10,000.
Show the answer

Answer: A. Reject it; the acceptance threshold must stay fixed, and the false match rate must be at most one in 10,000 for every demographic group.

The one-in-10,000 false match rate applies per demographic group and the threshold must remain fixed, so retuning it group by group to equalise acceptance is prohibited.

Source: NIST SP 800-63B Rev. 4 (NIST) — SP 800-63B-4 > Biometrics > Biometric Accuracy

Challenge yourself on this topic → Study as cards