Call Center Security 101- Security Needs in Your Call Center

00:00Hi, guys. Tom Laird here. You've heard me break down contact center technology on the podcast time and time again. Now, it's time for me to help you with your challenges. As your contact center technology advisor through our new company, Expivia Digital, I can help you with things like CCaaS selection, any type of AI implementation, and nice studio and integration services. It's the same honest advice you hear on the geek applied specifically to your operation. Visit ExpiviaDigital.com to get started. That's ExpiviaDigital.com. This is advice from a call center geek, a weekly podcast with a focus on all things call center. We'll cover it all from call center operations, hiring, culture, technology, and education. We're here to give you actionable items to improve the quality of yours and your customer's experience. This is an evolving industry with creative minds and ambitious people like this guy. Not only is his passion call center operations, but he's our host.

00:54He's the CEO of Expivia Interaction Marketing Group and the call center geek himself, Hi everybody, welcome back to another episode of Advice from a Call Center Geek. The Call Center and Contact Center podcast where we try to give you actionable items that you can take back to your call center, improve the overall quality, improve the age and experience and hopefully the whole reason that we're here is to improve the actual customer experience. My name is Tom Laird, I am the CEO of Expivia Interaction Marketing. We are a 500 seat call center outsourcer located here in Chile, Northwestern Pennsylvania. The holidays are slowly fading, maybe quicker for some, but they seem like a distant relic right now and now we're kind of in the dog days of at least here in the northeast, kind of the winter. Not much snow, but dang, it's cold. So anyway, what we wanted to discuss today in a pretty packed episode, and this could be one of our longer episodes as well, is security in your call center.

02:02Huge topic, a lot of questions that come about of what I need to do, what are the minimums that I need from a security aspect. I get a lot of offshore guys calling me and asking me and I'm like, guys, you're nowhere near where you need to be from a security standpoint to get any kind of USA customers. So for anyone who is nearshore or offshore, obviously here in the states, I think that this will be a pretty good episode. We're going to frame the discussion around PCI compliance, which is the credit card industry's data security platform or set of rules that you could say that you have to have to be the minimum for dealing with credit cards. So I think if we frame it around that discussion, any type of credit cards, if you're using, If you're housing, if you're storing, if you have customers that you're seeing customer data, I would even say, it's really important that you have certain security metrics and profiles set up in your call center here, especially going into 2020.

03:02To make sure that you're not only your organization is safe, but your associates are safe, and I think almost most importantly to your customers are safe. You don't want to have a breach or you don't want to have anybody go rogue. So all these things that you can kind of put into place can help secure your contact center. So again, I could talk this this discussion could go on and people have, you know, week long seminars just on PCI compliant. So I'm just going to try to frame it again around PCI frame around the call center security, so not an overall security plan. I'm going to talk at a pretty high level here. I'm not going to dig too far into the to the weeds or we'd be here forever. But I'm going to frame it around really kind of four or five, I guess topics one is physical security, digital security, fraud protection, on-call, or real-time production security that you need when it comes to recording calls, those types of things.

03:54And then some of the policies and procedures that you really need to put in place, because really when it boils down PCI, it's documenting a ton of stuff, right? It's having specific policies and procedures, and it's great to have those, but you gotta follow through on those as well. So, all right, let's dig into this, right? So the first thing I think is going to be, let's start with the easiest, I think most self-explanatory and that's the physical security that you need in your call center. So you need to have your doors locked into the call center floor. So whether that is swipe or a pneumatic keypad or biometric locks, however that is, only the people that need to be on that specific floor should be on that floor. So if you have a big call center, say 50,000 square feet or 40,000 square feet and you're broken down by either different clients if you're BPO or just specific types of service that you're offering. If you're not doing and you don't need to be over here then then you shouldn't be over there. You should only be in kind of your area making sure that your reps are where they are. One way to do that is every rep needs to have a name badge. Right now that name badge needs to be picture ID number kind of the programs or what they're working on so that you know we have a color-coded kind of what room you should be in. So if you you have a red and a green you shouldn't be in a room that's good that's color coded yellow that kind of thing when it comes to cameras we have cameras everywhere you know I firmly believe that that it protects the organization and also protects associates as well to have those cameras and your supervision especially you know maybe at times when there's not a lot of management here make sure that you have a specific policy and a lot of people don't do this and it can bite you you have a policy one for filming your associates recording them and two, that you have a policy for recording them.

05:38A lot of you guys have a policy that says, yes, you can be monitored and your calls can be recorded. But even being recorded in a hallway or on the call center floor, make sure that they understand that because I've seen people get bit when they have an issue with an associate. They have it on recording but they didn't have any permission for that. So check your state for that as well. When it comes to your DMARC room, so the room that has all your switches, has all the kind of the wires that go out to your call center floor, your DMARC room should be locked at all times. I think that's pretty obvious. Only specific IT or management should have access to it that's probably different than your server room, which has probably a ton of security, making sure that that is locked. Only certain people have access to it.

06:25People argue with me about this all the time and I don't understand why because you You can't be PCI compliant if you're allowing cell phones on your call center floor. So again, don't say that you're PCI compliant. You could do all of this, but if you have somebody that's having wearable technology and you're having cell phones on your call center floor and any type of digital technology, you're not. And in fact, I would say that's one of the most important things you can do today from a security aspect. Make sure that you have set places that your associates can go use their cell phone. But again, you guys know my policy and my stance on it, it's seen or heard in our call center. If a cell phone is seen or heard, then it's a suspension. And then depending on your organization, I think background checks are important.

07:12That can have a little controversy with it as well, but just making sure that there's people that maybe you don't want that have committed fraud or committed robbery or or even identity theft, things like that that you probably should check if you're working in the call center environment with a lot of that stuff. All right, the next aspect gets a little nerdy, right? And that's kind of the digital security and what you need to have kind of set up on your computers. Although, the other thing is, let me go back real quick on the physical security and this kind of branches over into the digital is your computer should be locked down, right? So there should only be certain websites that your reps can go to. They shouldn't be able to get any type of internal email, right? People argue about that. But internal email can be virus, you know, and you're setting yourself up for a lot of security issues with that.

08:06And secondly, make sure that your USB drives, if you have any type of access points on the computer that those are locked down as well. So nobody can put a USB drive in and download or take information out. So that's a really important piece. And that's kind of the bridge, I guess, to this next piece, which is kind of the digital security aspect. So number one, which I think is really important, is that you have enterprise virus protection on each computer. So you can have an overall, like on your firewall, right? That's great, but every single computer should have its own. We use Sophos, right? And, you know, basically we have a screen that's set up, and any time that an update doesn't get run, and that's another topic that we're gonna get touched here in a second, a specific update on a virus protection or if it senses that there is a virus or if something's coming in it blocks it, takes it away, goes to our server, we have a report that then kind of sends an email out and we can make sure that we either have to lock that computer down or or see what happened. So enterprise really good virus protection will save you, pay for it, don't go cheap, don't get anything free, pay for it and it will benefit you and it will save you so much time and money. Obviously, you need specific firewall protections. I am not nerdy enough. I'm pretty nerdy, but when it comes to that stuff, you know, we have our IT guys that deal with that, but from our firewall, they're blocking a lot of the internet stuff, right, that comes in. We're blocking specific websites and things through our firewall as well, so that's one of the protections that we have. Here's something that I bet you, most of you are doing that is such a security issue and we were doing it for a while we fixed it over the last couple years a single sign-on for each rep so you probably have to your telephony platform you have everyone username and password to your CRM username and password but how do you actually log in when you turn the computer on and you get that window screen right for most of you are you using one login for everybody and if you are that's a huge security issue It's a big pain in the rear but you got to get to the point where you're using you know individual sign-ons for each of the computers and that gets hard when you get a ton of people right I get it you know 500 600 people but you can do some things programmatically so we have done that within contact so we've kind of married married the logins right so our in contact login is the. same as the computer login when that password expires that password expires on both systems. So that's important. We have a help desk and again if you're a smaller call center you're not going to have a help desk, right? But you have to have something that you're documenting issues that are happening in your ticketing system. So if you have to give something to your IT, that can be an email, that can be whatever form. I like Slack as well. Like if you're small you can use Slack and just have an IT kind of channel that you can kind of put that stuff into but I'm not going to get deep into this but when it comes to your helpdesk ticketing that goes into your change management as well so it's really important that any type of changes and this is from a PCI standpoint any changes that you make programmatically so new versions of your software new implementations of integrations all that stuff needs to be documented whether it's an Excel spreadsheet or whether you're using kind of an enterprise system like we are, it needs to be, you know, a really regimented process so that you know what happened and you can look back if something goes wrong.

11:43The other big important thing with this is update management, right? So making sure that all of your systems have all the Windows updates that they need when they need. I bet you a lot of you don't, right? And if you go and you do a Windows update, it's going to take a while. I would suggest is that tonight, it's Friday, if you guys are listening to this or over the weekend, if you have a lower headcount, a lot of you don't, but at a certain time you have to run Windows updates on all your computers. So again, we have a system and there's systems out there that just kind of shoot them all out and they update them as they go, as new updates come, but for most of you smaller guys, make sure that you're staying up on your Windows updates. The other thing that I would highly suggest that you really need to be PCI is to get a third party involved from a penetration testing standpoint.

12:34So quarterly, we have security metrics that tries to actually penetrate our firewall and get into our platform and get into our network. They do that once a month and then we see what IP addresses we have open, make sure that everything is where it's supposed to be and that we're secure from an outside standpoint of people trying to get into our network. You need some help if you don't have that from a PCI standpoint, but you really want to get into looking at a third party to help you kind of guide you, at least if you don't if you say, listen, I can't be I can't afford which I probably shouldn't be in business if you can't afford to be PCI compliant, but if you say, hey, we're really small, we don't really deal with too many credit cards, we do deal with customer data. What can we do to be more secure?

13:24a third party in there and kind of have some of these protocols helpfully set up for you. Let's talk about on call security. So when I mean on call, what are some of the policies and procedures you should be doing when a rep is actually on the phone, right? [QA coverage remark omitted] But you should also make sure that one, either you are on the recording, right? You're only taking the last four digits of the credit card number of any account information or social security number if you can't and I know a lot of you can't and we have programs too that we can't then we mask and make sure that you understand the masking piece in most telephony platforms in contact Five9 Genesys all of them have that piece where literally the rep can either press a button and it goes away or there's actually software that can kind of tell and kind of mask on your own as the call is happening.

14:22So that software is there. If you're dealing with a lot of credit card information and you're not masking, all of those either social security numbers or credit card numbers are on your servers, you're opening yourself up for a ton of pain. So I would tell you two things. One, make sure that you're masking. And two, any type of credit card or customer data, get it off your system as much as you possibly can. So any type of purging that you can do to get credit card information, customer data off of your servers, if you can, and I get if it's a CRM and you have to keep your customer data there, but if you're doing any type of other processing, make sure that you're limiting as much as you possibly can. And I know for some of those, that's kind of in the back of your mind, but it'll bite you, right?

15:03It'll bite you. So make sure that you're kind of staying on with that. The other thing is you want to try to process credit card payments at the time, right? You don't want to wait and batch them until later. That's a process that is old and done. So some of them and some of our clients we're still doing that with because that's kind of how and we take the credit card information, we have an API that directly goes and it goes to their system and then they do it. So I mean we're kind of in between there but you don't want to take a bunch of credit cards, get them on your system and then go batch file them or go send them all at once. And you're setting yourself up for having credit card, too much credit card information on your servers and opening yourself up for some security issues.

15:47So if you can anyway, process credit card payments at the time and then you can kind of delete or kind of get rid of the credit card information. The other thing too, and I have here in my notes, two-factor authentication. Everybody for me, it's kind of a pain, but if you think about it, it's pretty cool. So if you are in a customer service department and a customer is calling in and saying hey I forgot my password, you really need to start to get into the two factor authentication and not just saying hey what's your name, social security number and address and okay you have all that, well here's your account number. The phishing is too great of an issue now. So you need to be able to use their cell phone, use their email to send them something to make sure that it's them from that standpoint and then you can kind of go through another security protocol to get them their password or to reset their password or to give them their account information.

16:47Can't be lazy with this stuff. It's super painful. I get it, right? And think about this as a BPO, as a call center outsourcer. Every client we have has different security needs and also security thresholds that they want met. So we have to be here at all times. We have to be at the top level and that way we can make sure that we're always on top of it. But some of you guys are at that bottom level or just you're doing the minimum stuff. Make 2020 the year that you're going to push and implement a couple of these every single time that this topic comes up. You need to keep pushing it with your management team to implement some of these security things. The biggest pain in the rear as well, but it's really important, is making sure that you have policies for everything. I'm not going to go through all the policies because there's so many of them that it may blow your mind and I don't want to scare you off.

17:44Go to the PCI or go to a third party website that deals with PCI compliance. the policies and procedures that you need to have and you need to have on file to make sure that you're covering your butt and you're covering everything in your contact center. So everything from a security policy, from a data security policy, from a change management to internet settings, there's so many different things that you have to think through. Get the policy, get some help online with and then go through the implementation in your contact center. The last piece that I want to kind of talk about it's kind of the fun I don't fun fun's a bad word but the technology that that is out there too so this kind of goes with on the call and we're trying to not only protect our clients customers organizations associates from from all of this from a security standpoint but we also have to protect the organization right so So people we know that they try to do phishing schemes, they try to have some fraudulent information that they try to get information and try to scam you.

18:53So some of the things that you can do, right, and these are some of the things that we're doing right now. So one, and I've talked about this a little bit, is speech analytics. So you can set specific categories up in speech analytics to search for certain things. Here's an example, and I think I've used it before, we had a client who had their internal call center. They had fraud in their internal call center when one of their reps was scheming with their cousin who didn't work there. And she would give information to the cousin. The cousin would call in and say, Hey, my name is Mrs. All my information. Can you change my address? And can you send me a new debit card out? Right? And so they were doing this for months and months and just defrauding the organization. So when they came to us, They said, hey, how do we not do this?

19:40Well, one of the first things that we did with that is we set up categories in speech analytics. And we said, hey, if any customer ever says on this account, send me new debit card, new debit card, send new card, and change address, change my address, any of those type of phrases, and we can do and and ors, that those calls will get flagged, right? And so we look at that every single day. And if any of those come up, boom, we pull it up, we listen, we find out who it is, we go through the whole account, and we have another layer of protection for the client, and that you can have as well, for just listening to what's going on on the calls. The other thing is, it's a little bit more expensive, but from us, it's gonna be available really in the cloud from a nice, nice and context standpoint, is voice authentication, right?

20:28So basically a customer calls in, kind of opts in for voice authentication, servers listen to them and then we get a make sure that the next time that they call in when we kind of play their voice that it's it's actually them it's number one it's it's much easier for the customer because we don't have to go through that painful verification that we all do what's your social security number what's your date of birth you know what is what's your first born son's name right all that kind of stuff mother's maiden name we don't have to do that and also we have a level of security that's beyond you know what we can do because we're actually getting down to kind of biometric type data and that's where the AI and all that kind of stuff kind of comes in where that technology is so voice authentication if you are in any type of financial services you got to look at it or you got to go to BPO like like us right that that has that that technology and then some of the easy things that you guys can do too if you don't have this technology is is look at the Annie right and the Annie is the phone number that's called right if you have if you can get to the same rep right through maybe your your tree your IVR tree if the same rep or even the same Annie is constantly being dialed right a lot of these guys aren't smart we've been able to catch people just they're constantly calling and using their same cell phone number and when we see that over the last 30 days that they've called you know 45 times and we're asking questions so check that look at your Annie look at the reps that are on there but really just you can kind of get a get some of that information and glean some of that as well from from people who have been calling in so so that's kind of I think I think where I want to stop I have a couple more things that we could get into but I don't again I don't like making these episodes more than than 20-25 minutes. I'm going to make them kind of quick for you guys. So again, framing this as if you're PCI compliant, most of the check blocks that you need to be secure for your organization are going to be there. Again, we can go to other layers of certifications like HIPAA, and HIPAA is for health care, different kind of level, and then you kind of mix both a little bit. The security guys hate when I say that, but for a SOC 2, and kind of look at that, it's kind of an overall protocol for your organization as well.

22:53So there's a lot of different ways that you can protect yourself. The biggest thing that we see is people just being lazy with it saying it won't happen to me. If you're saying that, it's probably going to happen. There's so many things that you can do, right? Just off the top, even if you're not trying to be PCI, but you need to be secure from a physical standpoint, making sure that you have cameras, making sure that you have reps in the right places, making sure that people sign in when they come in here from a digital standpoint, locking down the computers, making sure that they can only go on certain internet sites, looking at single sign on, little things like that are really, really, really important. I can't say enough about not being cheap on virus protection, looking at you're on the call stuff. [QA coverage remark omitted] Making sure that you're taking steps there to mask all that stuff. Looking maybe at new technology like voice authentication to get you through another layer of protection. And then guys, policies and procedures will save your rear. They're a pain, but you got to do them. You got to look through it. Get a committee together. Look at your security policies. Look at your procedures and try go through what you guys have and what you guys don't have and again check that out and you can there's there's so many resources online that I would be I'd be failing miserably if I tried to if I tried to to help you more with that alright so that's that's what I got for you guys from it from a security standpoint I want to go into a couple real quick housekeeping things I want to thank everybody for joining who has joined the community right we're up to almost 50 members I know that sounds lame but we were at 10 like two weeks ago. So again, advice from a call center geek community. It's different than the advice from a call center geek Facebook page, but go on there, join. I will instantly allow you to become a member. And I love it for those of you who are listening that are members. Let's start some discussions up. I just did a little thing on there. Write to anybody who posts something that's going to get at least five to ten comments. I'll send you a free book. I'm doing anything I can to not make me be the voice of that. I want you guys to kind of be the voice of that. Also please go on to our advice from a call center geek YouTube channel. The YouTube channel we're posting a daily call center tip of the day. We have like 16-17 right now. I think it's really gonna help you. I mean I'm gonna have literally like 500 of them, right? So by the end of this year we should have almost 400 with 365 days. A lot of tips, videos like this like right now I'm recording the podcast. So if you want to see me in my Friday dress down. It's there as well. Plus we're doing a lot of internal things. Like we just did a roundtable meeting with our reps where we talked about what are some cool things to talk to and tell new supervisors. I'm gonna go put some GoPro cameras on my supervisors so that you can see the first 30 minutes and actually how they do it. So it'll be some really cool and I think unique content there as well. So again guys thank you. Thank you for listening. I'm at the 25 minute mark so I'm gonna peace out and I will talk to all of you guys next week.