What is the difference between FAR and FRR, and which should I optimize for a high-security facility?

FAR (False Accept Rate) is the probability that an impostor is incorrectly granted access; FRR (False Reject Rate) is the probability that a legitimate user is incorrectly denied. They are inversely related — tightening the match threshold reduces FAR but increases FRR. For a high-security facility (data center, evidence room, pharmaceutical vault), optimize FAR down to 1-in-100,000 or lower, accepting a higher FRR of 0.5–1%. Provide an attended fallback lane to handle legitimate rejections without creating a security bypass. For low-security convenience applications (gym check-in), a 1-in-10,000 FAR with very low FRR is acceptable.

Can someone defeat a fingerprint reader with a lifted latent print?

Optical sensors without liveness detection can be defeated by a high-quality silicone or gelatin replica made from a lifted latent print — this is a well-documented attack. Capacitive sensors are harder to spoof because a silicone fake lacks the correct dielectric properties. Multispectral imaging sensors that capture subsurface dermal features are the most robust against artifact attacks. Always specify ISO/IEC 30107-3 compliant Presentation Attack Detection (PAD) for any high-assurance deployment, and verify PAD performance with an independent test report rather than relying on vendor marketing claims.

How many people can a centralized iris recognition system reliably scale to?

Iris recognition is the most scalable single-biometric modality due to its extremely low inherent FAR (theoretically 1-in-1.2 million per the Daugman model). IDENT (the DHS biometric system) operates with hundreds of millions of enrolled irises using 1:N identification. For physical access control, a centralized iris system can practically scale to 500,000+ enrolled users while maintaining a database-level FAR well below 0.001% per transaction, provided the iris capture hardware produces sufficient IrisCodes quality (Hamming distance threshold typically set at 0.32). Index structures (KD-trees, LSH) are used to avoid exhaustive linear search at large N.

Is OSDP required for biometric readers, and what does it actually secure compared to Wiegand?

OSDP v2 (IEC 60839-11-5) is not universally mandated but is required by DoD Directive 8100.02 and recommended by SIA and ASSA ABLOY for all secure access control deployments. Wiegand transmits a binary card number in clear text with no authentication — any device on the wire can intercept or replay the credential number. OSDP v2 Secure Channel uses AES-128 encryption and CMAC authentication between the controller and the reader, preventing eavesdropping, replay attacks, and reader substitution. For biometric readers where match results (and potentially templates) travel on the wire, OSDP is essential. Specify OSDP v2 with Secure Channel Mode in every RFP for biometric reader procurement.

What enrollment failure rate should I plan for, and how do I handle users who cannot enroll?

Plan for a Failure to Enroll (FTE) rate of 1–3% in a general workforce for fingerprint, and 0.5–1% for iris. FTE is higher in populations with manual labor (worn fingerprints), certain medical conditions, or very elderly users. Facial recognition FTE is generally below 0.5% but has documented differential performance across demographic groups. Mitigation: enroll multiple fingers (minimum two per FIPS 201-3), enroll both irises, and have a clearly documented exception process (escorted access, PIN-only at attended stations) that does not create an exploitable bypass. Never let FTE accommodation lower the effective security level below the minimum required for the space.

Engineering·10 min read·April 1, 2025

🔒 Biometric Access Control: Fingerprint, Iris, and Facial Recognition for Security Engineers

A deep technical guide to biometric access control systems — how fingerprint, iris, and facial recognition technologies work, their performance metrics, standards, and how to select and integrate them into enterprise security infrastructure.

📖Access Control Systems Handbook (Full Access)

View →

What Biometric Access Control Actually Does

Biometric access control replaces or supplements possession-based credentials (cards, fobs) and knowledge-based credentials (PINs) with something the user is — a physiological or behavioral characteristic that is unique, persistent, and extremely difficult to share or duplicate. For physical security engineers, the practical goal is reducing credential fraud while maintaining throughput at controlled entry points.

Topics covered

biometric access controlfingerprint readeriris recognitionfacial recognition securityFAR FRR biometricsFIPS 201PIV cardmultimodal biometricsliveness detectionbiometric templateANSI INCITS 378biometric enrollmentphysical access control biometrics