Page 185 - Automated Fingerprint Identification Systems (AFIS)

170 AUTOMATED FINGERPRINT IDENTIFICATION SYSTEMS

the data integrity remains intact. It will also audit for any questionable use and
may terminate the agreement within a short time.
Beyond the technological issues, what are the management issues that chal-
lenge interoperability? There are several, including foreign access to a data-
base, amount of transaction time for foreign inquiries, usage agreements,
indemnifications, security, firewalls, etc. All of these issues can be resolved with
time, money, and political drive. The following sections discuss some of these
management issues.

8.4.1 SECURITY

Whenever remote access to a database is considered, a primary concern is the
security of the information system and databases. As long as the system is a
closed system, or one in which access beyond the network is severely restricted,
security is manageable. Providing access to outside interests presents additional
threats, which come from access to the infrastructure as well as access to the
information.
Just as with any network, expansion into foreign environments heightens the
need for “defense in depth.” The host agency must not only continue to ensure
its own system integrity, but must also ensure the integrity of participating agen-
cies and personnel.
In the ATM example above, the security of the system is maintained by the
participating financial institutions. The identity of the card holder is confirmed
with the use of the debit card and the associated personal identification number
(PIN). However, since these transactions can be compromised, the financial
institutions limit the risk per transaction by limiting the amount of money that
can be electronically withdrawn.
While the equipment and technology of the host agency may be standard-
ized and commercial off the shelf (COTS), the participating agency may have
customized hardware and software, and/or special protocols that need to be
reconfigured to be compatible with the host agency. Many related issues may
then arise, such as who will pay for the hardware and/or software changes nec-
essary to allow access to the host agency. Additional firewalls and anti-virus soft-
ware may have to be installed; new user codes and passwords have to be assigned
to the new personnel; training and audits are needed, etc. The cost can be sig-
nificant for each party. How can these expenses be justified in times of finan-
cial belt-tightening?
In addition to the issue of security of the network is the security of the infor-
mation. Will the information be used for the intended purpose? Will the data
be safeguarded in the same spirit as at the host agency? What are the oppor-
tunities for misuse or abuse? A recent article on data sharing of a government