Setting Up Biometric Usage Logging in ControlUp

Instructions for setting up a system to log biometric usage on endpoints were asked about in a Slack conversation with employees from ControlUp. The goal is to have a storage period of 7 years. Different suggestions were made, including using an API and PowerBI, as well as involving an account manager in the process. The data is associated with the user identity and compliance standards vary by country.

Read the entire ‘Setting Up Biometric Usage Logging in ControlUp.’ thread below:

Question for anyone – I have a request from our compliance team to log all instances of biometric usage on our endpoints. Their idea is to gather the log from the local device from when biometrics are first enabled, which the logic there is that if they enable it, they consent to that data being stored locally on the device.

Either way, their requirement is we keep that data for 7 years… so wondering if anyone has any neat ideas for how we can gather those logs and keep them in an external location (because our current entitlement in ControlUp is 30 days).

We do leverage Sentinel to monitor endpoints too, but that’s only 6 months so I want to see what magic we could do in ControlUp.

We have a data team that is connecting to our CU tenant via an API and they keep the data

Leveraging PowerBI or something similar?

If you’re able to share

You could do it via PowerBI we have done that before we got the new tool

We have other tools that I unfortunately can’t share names – sorry 😐 rules

But you can check out the API documentation

It has everything that you need to get started with ApI

Or you can reach out to your CU account manager and he or she can also advice on some methods or tools

Sweet – understandable on the rules 😉

I’ll read up on the API docs and see what we all have available.

I would be interested to learn more about the volume of "that data". The way I read it above, collection starts after consent by the user, and each time biometrics are used (e.g. windows hello face/finger print), that particular event is stored and not deleted until 7 years later at least?

Some additional questions:

• Would this mean that "nobody" would be able to delete individual user biometric events?

• Would it come with additional requirements for the vendor, e.g. specific auditing rules and processes

• Is it driven by any known compliance standard, either country or industry?

• Would the data be associated with the user identity? Or is it device centric?

Just to clarify: we currently have no plans to offer a "7 year data retention" option, but since we’re working on implementing a new data storage platform, I think it’s important to keep an open mind and understand customer use cases.

Cc @member

@member I would like to learn more about your use case, would you be able to engage your Account team at ControlUp and ask them to arrange something with all of us.

The driver behind it is we intend to enable the feature for all devices rather than having an official opt-in by each individual user. Our idea was that if they set it up, they consent to it being stored on the device.

We were playing with potentially creating an alert for the specific Windows event (1010), which appears to only show when fingerprint or facial recognition is enabled on the device. In theory this would be 1 log per user/per device, or more if they enable both features.

It looks like its grabbing the info we want (Local time/UTC, Employee ID, and source being the physical endpoint).

We know there are no 7-year plans, so exporting that specific information is our next step. I’m extremely novice at API calls, so I’ve tasked a few team members to help do a proof of concept.

Answers to questions:

• Would this mean that "nobody" would be able to delete individual user biometric events? The goal would be immutable data for event logging.

• Would it come with additional requirements for the vendor, e.g. specific auditing rules and processes? I don’t have an immediate answer for this but am asking around.

• Is it driven by any known compliance standard, either country or industry? My understanding is they are treating that information as personnel files, where some states require organizations to keep that information for 3 to 7 years.

• Would the data be associated with the user identity? Or is it device centric? Data would be associated with the user identity mostly.

Continue reading and comment on the thread ‘Setting Up Biometric Usage Logging in ControlUp’.  Not a member? Join Here!