Secured Contacts

Call centers were traditionally created in large warehouse environments, with
rows of agents dealing with customer queries via the telephone. This environment
was fairly easy to secure. The agents, systems and information were contained
within an enclosed physical location and traditional TDM-based telephony
networks were largely proprietary and difficult to compromise. Enabled by new
technologies and greater consumer demand, call centers have since evolved into
fully functional, multi-channel centers.

They are also becoming more distributed. For instance, Internet protocol (IP)
technology removes the need for agents to be confined to a single physical
location and enables systems and skills from around the organization to be
connected to the customer from any location.

However, greater access to information through multiple channels of
communication carries risks as well.

Convergence

The findings of Datacraft/Dimension Data's Global Contact Center
Benchmarking Report 2007, reveal that more than 60% of contact centers have
already introduced IP-based or hybrid IP PBX/ ACDs. In Asia Pacific, 67% of
organizations surveyed also ranked the adoption of Session Initiation Protocol
(SIP) in their plans versus 50% in North America. SIP allows the easy inclusion
of data to interactions. Examples of data relevant to contact centers could be
customer details, credit status, pricing, delivery status, etc.

IP technology allows contact centers to integrate previously disparate
systems to enhance customer experience and reduce response times. All customer
interactions via telephone, email, or web can now be accessed by the agent via a
single IP interface, providing a unified view of a particular customer
regardless the channels used. This enables agents to access customer information
faster, and ensures that the interactions are managed seamlessly by the most
appropriate agent.

However, this unification of systems and information also means that any
single security breach can have greater and far-reaching consequences.

Regulation and Legislation

Information processed by contact centers is heavily regulated and bound by
legislation. Personal information is governed by the Data Protection Act;
financial information may be bound by the Financial Services Industry
regulators; and credit card transactions are subject to Payment Card Industry (PCI)
regulations in the country. Sensitive information must therefore be secured
against exposure to third parties and its distribution should be fully audited.
Do not call (DNC) registers are expected to be introduced in countries like
China and Australia. Telecommunication Regulatory Authority of India had also
announced the same and penalties in 2007.

Multiple Interaction Channels

Most organizations have implemented multiple customer interaction channels.
According to the Datacraft report, voice remains the predominant channel in
contact centers, with respondents reporting that telephone and interactive voice
response account for 73% of total traffic.

However, new communication channels such as email and web are rapidly being
adopted as organizations understand the benefits of enhancing the information
they present to their customers. Participants in the study report that one in
ten interactions is now handled via emails. This is the second highest volume
channel, following agent-assisted telephone.

As the primary interaction channel for contact centers, organizations need to
ensure the security of voice. Traditional telephony networks are inherently
secure, being based on proprietary systems connected via private networks.
IP-based telephony, however, is based on well-publicized standards and
protocols, which make it more vulnerable to abuse and compromise. IP networks
are also highly interconnected, thus providing greater reach to customers,
suppliers and partners, but simultaneously open up potential access channels for
criminals and unscrupulous third parties. IP-based PBXs, voicemail and voice
recording systems-all common in contact center environments-are vulnerable to
attacks unless properly protected. This can lead to loss of service or privacy
violations. The IP voice communication itself is vulnerable to eavesdropping or
other tampering that compromises the privacy and/or integrity of the
communication.

Email is the most common route by which viruses are distributed, and contact
centers need to ensure that viruses are not received from or sent to the
customer during email exchanges. This could lead to business outages and
clean-up costs, or brand damage and potential litigation if the contact center
is responsible for infecting the customer. Contact centers also need to ensure
that they do not distribute sensitive, libelous or defamatory content to
customers and that the privacy of email communications is maintained. Web
content can also be a source of malicious code, and measures should be taken to
ensure that a contact center's web servers are not compromised or used as a host
for such content.

A Proactive Plan

Effective security cannot be achieved by implementing technology alone. It
relies heavily on managing a complex environment that also takes people and
processes into account. Many security systems fail because technology is seen as
the be-all and end-all of the security solution. But without policy and
well-trained, reliable operators, technology alone will fail to protect the
organization from security breaches.

To create secure contact center environments, we advise organizations to
focus on the following areas in particular: managing people, managing access and
managing information.

Managing People

Many contact centers have implemented quality management software suites
comprising voice recording at the basic level. Trainers use these recordings to
coach and evaluate the performance of contact center agents. In some countries,
voice recording is required as a part of industry compliance. By adding the
screen recording module, all key strokes and on-screen activity of the agents
can also be captured. Screen recordings can help validate process efficiency,
process compliance as well as setting alerts in the event of suspicious
activities performed by contact center staff from their desktops.

Technology should be installed at the internet gateway alongside firewalls
and intrusion etection/prevention devices to filter e-mail and web traffic and
prevent malicious code from entering the network. Software should also be
installed on agents' desktops to prevent infection which may be caused by data
being physically transported into the contact center and installed on the
desktop. This software includes antivirus, personal firewalls, host-based
intrusion detection/prevention, etc.

The desktop can be further locked down by deploying policy enforcement
software that will reset desktops to a standard configuration or 'gold build'
should it be altered in any way.

Apart from implementing IT systems, it is imperative that contact center
employees are effectively screened and their backgrounds are checked before they
are hired.

Moreover, a robust security policy should be created, documented and
communicated to all employees. The policy should define security roles and
responsibilities, access privileges, escalation paths and incident response
processes and the policy should be communicated to all staff, and compliance
monitored. Procedures should be defined for the processing and storage of
customer information and an acceptable use policy defined for the network.
Proper provisioning and de-provisioning of users is also critical to ensure that
correct levels of system, application and data access are granted for new
employees. This access needs to be revoked immediately once the employee has
left the organization.

Managing Access

Access to the contact center needs to be carefully controlled, with clear
demarcation lines drawn between internal systems (e.g. customer records) and
publicly available systems (e.g. the company's website).

IP-based Contact

Perimeter security is the cornerstone of access security and ensures that
the systems internal to the contact center are protected from unauthorized
external access. Firewalls and intrusion detection/prevention technology are
essential as the first line of defence and access control is also essential to
control network and information access for employees and agents

Additionaly, there are several strategies that contact centers can implement
to identify and classify an agent and the device they are using, and control
access to the system:

• User ID and password: Hardware tokens or smart cards; Software tokens;
  Biometric identification; Network Admission Control.
• Managing Information: Protecting the contact center from information
  leakages is always a top priority for organizations and we would recommend an
  approach that combines Information Leak Prevention (ILP) software and
  encryption. ILP software technology is used to control how information is used
  on the desktop and if/how it is allowed to be distributed beyond the desktop.
  In this way, sensitive data can be prevented from being copied to portable
  media devices such as CDs/DVDs, memory sticks and PDAs, etc, or reproduced in
  other ways such as printing, cutting and pasting or screen scraping.

ILP technology prevents sensitive information from ending up in the hands of
criminals, thereby reducing the growing risk of identity theft. The software
provides the necessary controls and also monitors user behavior at the desktop
and alerts or takes action against violations of the organization's corporate
policy. Access management and encryption are the most effective ways to achieve
security for this stationary data. Access management enables access only to
those authorized to view the data and encryption renders the information useless
to anyone who manages to break into the system. Encryption should also be used
on agent desktops in a virtual contact center.

The contact center industry has transformed dramatically over the last
decade. Contact centers form the heart of the organization today, and are often
the primary or only point of contact with the customer. New opportunities,
however, also result in a new set of security challenges. Although technology
plays a role, a secure contact center effectively implies the need for ongoing
monitoring of people and processes.

Nagi Kasinadhuni

The author is GM, Converged Communications Solutions.

vadmail@cybermedia.co.in