A company wants to strengthen logon security on shared workstations in a lab. Currently users log in with a username and password. Management asks IT to add a second authentication factor that verifies 'something you are.' Which additional authentication method should IT deploy to meet this requirement?