Download as PDF, PPTX
More Related Content
Similar to Contact Center Authentication
Contact Center Authentication
- 1. Contact Center Authentication KelleyRobinson | OWASP AppSec California 2019 @kelleyrobinson
- 2. This talk haseverything • My social security number • My mother's maiden name • The email I briefly used 11 years ago • Accidental phishing
- 3. Kelley Robinson Contact CenterAuthentication @kelleyrobinson
- 4. Millennial spends 14hours on the phone with customer support agents Kelley Robinson @kelleyrobinson
- 5.
- 6.
- 7. 1. I havean existing account 2. There is personal info tied to my account (i.e. orders, data) 3. Company has a customer support phone number 4. USA phone number 5. Inbound calls @kelleyrobinson 🔍 Research Parameters
- 8. • Mostly informationgathering (read) • Limited actions and account changes (write) - This can and did trigger additional security @kelleyrobinson 🔍 Research Parameters
- 9.
- 10.
- 11. ☎ Getting intouch over the phone @kelleyrobinson 1. Customer support number 2. "Call me" 3. No phone number i.e. Home Depot, Comcast, State Farm i.e. Walmart, Amazon, Verizon i.e. Facebook, Lyft
- 12.
- 13. • Most useInteractive Voice Response (IVR) to direct you to the correct use case • Rarely does your IVR input matter if you end up talking to an agent @kelleyrobinson 📲 On the phone
- 14. 1. Automated withthe phone number you're calling from 2. Automated with provided info like account number 3. Manual with an agent @kelleyrobinson (identification)📲 On the phone
- 15. @kelleyrobinson Identity Authentication Personal information (i.e.date of birth) Google-able, probably doesn't change Proof of identity, usually with a secret (i.e. one time password)
- 16.
- 17.
- 18.
- 19.
- 20. @kelleyrobinson 🙌 The Good 👍The OK 👎 The Bad 😰 The. . . oh. . . oh no
- 21. @kelleyrobinson 🙌 The Good Actuallyauthenticating users • One time codes for authentication • Refusing to disclose personal information Bonus Delight: • Apple lets you choose your hold music 🎵
- 22. @kelleyrobinson 🙌 Automated intro: “Welcome toNetflix. For faster service, log in to netflix.com and find the 6 digit service code located at the bottom of any web page. ”
- 25.
- 26. @kelleyrobinson 👍 The OK Roomfor improvement but still positive • Recognizing the phone number you're calling from • Verifying multiple forms of personal information • Prompting with relevant account actions
- 27. @kelleyrobinson 👍 Automated intro: “Welcome back,Kelley. I see you're flying from Los Angeles to Newark Liberty today, are you calling about that trip? ”
- 28. @kelleyrobinson 👎 The Bad Phishingrisk with minimal effort • Only asking for one form of identity • Identity is easily accessible public information • Requiring a Social Security Number
- 29. @kelleyrobinson Why are SocialSecurity Numbers Bad Authenticators? Meet Mrs. Hilda Schrader Whitcher Social Security Administration History
- 30. @kelleyrobinson “In fact, avalid SSN can be easily guessed, as they were issued serially prior to June 25, 2011. Wikipedia
- 31. @kelleyrobinson 😰 The. .. oh. . . oh no Wait. What just happened? This is problematic. • Giving out identity information • Allowing account changes without authentication • Asking what phone number to send an SMS token to*
- 32.
- 33.
- 34. @kelleyrobinson • Use thesame rigor for authentication over the phone as you do on your website • Honor user settings for things like 2FA 🤖 Unify authentication systems
- 35.
- 36.
- 37.
- 38.
- 39.
- 40. @kelleyrobinson 💁 Build guardrailsfor agents
- 41. @kelleyrobinson • Limit callerinformation available to agents • Only expose information after a caller is authenticated • Have a small subset of agents that have access to do the most sensitive actions • Perform silent authentication 💁 Build guardrails for agents
- 42. @kelleyrobinson 💁 Build guardrailsfor agents Verify caller email address before continuing: grace.hopper@gmail.com Verify caller email address before continuing: VerifyEnter email here vs. ✅ Agent Dashboard 1 Agent Dashboard 2
- 43. • Do arisk assessment using provided identity • Have behind the scenes fraud detection @kelleyrobinson 💁 Build guardrails for agents
- 44. @kelleyrobinson 🔐 Consider yourThreat Model
- 45. @kelleyrobinson • What areyou allowing people to do over the phone? • Limit sensitive actions if you can't implement true authentication 🔐 Consider your Threat Model
- 46.
- 47.
- 48. @kelleyrobinson “It’s culturally acceptableto use your national ID number for identification (e.g. at the supermarket, the cashier will ask you for your ID number to credit your loyalty card). ”
- 49.
- 51. @kelleyrobinson ✅ Actually authenticateusers 📵 Don't share personal information 🤖 Unify authentication systems 💁 Build guardrails for your agents 🔐 Consider your threat model Takeaways
- 52.
- 53.