ding his whole day patrolling passwords now. He's looking at bigger security issues," Sherwood says. "We spent about $170,000 on the system, and we figure we'll recoup all of our investment in two years." Analysts support Sherwood's numbers, citing that calls about forgotten and changing passwords are a major drain on most help desks. They say it shouldn't come as a surprise, because the average user has to remember four to eight different strings of characters, and is supposed to change them every 30 to 60 days. Just getting employees not to use their own names, nicknames or birthdays as their passwords is a major IS headache. "I'm a security expert, and my passwords are decent but even they could be better," says Abner Germanow, a research manager for IDC in Framingham, Mass. "It's pretty easy to walk down the hall in any corporation and see someone who has his password on a post-it note, or he's got it in his wallet." And that's just where Farrokh Shahamiri, an acting management analyst for Oceanside, kept his password before he started using a fingerprint scanner six months ago. "Before, I had one password to get into the network and a couple of others for different applications. I never forgot them because I always kept a copy of them in my wallet," he says. An issue of privacy While biometrics offers tighter security than passwords, industry watchers warn that the technology poses its own set of threats (see Face-off on the issue of biometrics and privacy). "The ugly truth is if you're storing people's fingerprints in a database, that database is searchable," DataQuest's Reynolds says. "Say you have a large company and somebody steals the CEO's cigar box. They find a fingerprint and compare it to what's in the database. Or say the police come asking for a copy of someone's fingerprint. That all amounts to an unlawful search." And that is bound to make some users uneasy or even unwilling to hand over their fingerprints. Grant Evans...
