"Within 30 seconds, we had identified probably 80% of people's passwords," says Fowler, whose group immediately asked employees to create strong passwords that adhered to the security requirements. A few days later, the team ran the password cracker again: This time, they cracked 70%.

"We couldn't get [employees] to maintain strong passwords, and those that did forgot them, so the help desk would have to reset them," says Fowler. Telesis decided to secure network and application access with a biometric system that eliminated the need for user IDs and passwords, opting for the DigitalPersona fingerprint system from DigitalPersona Inc. in Redwood City, Calif.

The use of biometrics—the mathematical analysis of characteristics such as fingerprints, veins in irises and retinas, and voice patterns—as a way to authenticate users' identities has been a topic of discussion for years. Early commercial success stories have largely come from applying biometrics to projects with provable returns on investment: time and attendance, password reduction and reset, and physical access control. Though biometric work remains primarily in the pilot stages, the events of 9/11 pushed emerging commercial products to center stage—a spot some say they weren't ready to claim. Vendor focus shifted from the private sector toward the huge contracts many expected would be awarded in the public sector, say observers.

The attacks on 9/11 "brought focus to what was going on in biometrics, and [vendors] switched gears. Where previously they were thinking about [biometrics] for enterprise access, they decided government contracts were the next gold mine and jumped on that," says C. Maxine Most, president of Acuity Market Intelligence in Boulder, Colo.

That has been the case for Telesis, which has rolled out fingerprint-based network and systems access technology in its headquarters and credit-union branches. Once Telesis has thoroughly tested the system, the company will deploy it in the offices of Business Partners LLC, its business loan services partner. Users no longer need to remember IDs and passwords because DigitalPersona authenticates enrolled personnel via fingerprint scanners, tying the fingerprints to 256-character passwords that it randomly generates every 45 days.

Fowler says Telesis looked at a single sign-on application but was uncomfortable with the idea that one authentication would provide access to the network and all connected applications. With the current deployment, employees touch their scanners to gain access to each application they use, including homegrown and third-party Web-based applications.

The system is already integrated with Microsoft Corp.'s Active Directory for network access, and fingerprint profiles are encrypted and stored directly in Active Directory, relieving worries Telesis had that they might be stored as images that could be compromised. Telesis' IT department is reviewing applications that require ID and password sign-ons and creating profiles for them in the DigitalPersona server.

During the deployment's testing phase, Fowler's team encountered a few issues related to mobile workers. For corporate travelers, the company considered equipping laptops with scanners, but most Telesis executives don't carry their laptops unless giving presentations; they prefer to use hotel business centers or Internet cafes to access the corporate intranet. When they do that, they use static but difficult-to-crack passwords.

Another segment of Telesis' mobile population—"roaming" tellers—are another concern, says Fowler. He wants to be able to lock down all workstations so that the Ctrl-Alt-Delete function won't bring up the user ID and password log-in option, but then roamers wouldn't be able to use the teller workstations they need.

Although Fowler says it's difficult to quantify ROI, Telesis is pleased with the streamlined network access, reduced password-reset requests and the improved security ratings audits have found since it adopted DigitalPersona.

Security or Convenience?

The kind of biometric application Telesis is piloting—user authentication for access to computer systems—hasn't thus far seen the adoption rates that many had expected, according to Gartner Inc. analyst Clare Hirst. She adds that she doesn't expect to see many more such deployments before 2010.

"We hear a lot about biometrics, but the reality is that most of the projects are still in pilot stages," Hirst says. The most mature applications of biometric technology are in systems that control physical access to facilities and keep records of time and attendance, she says. "With time and attendance, companies can use finger-, hand- or facial-recognition technology; get rid of access cards and mechanical punch-in [devices]; and it's not a security issue—it's to save money," Hirst says.