by Maria Simonton
It’s no secret that security is a top priority for businesses these days. But how does that concern apply to IVR? Over 79% of organizations polled in a recent SANS™ Institute survey stated that their security defenses were focused primarily on external-facing websites. Yet, millions of users daily relay sensitive, personal information over the phone. Information that’s spoken, stored, transmitted, and logged.
In addition to the practices that all software applications should adhere to—strong user authentication, encrypted data storage, secure network protocols—IVR presents a unique set of security challenges that should be remediated early in the design phase.
Consider first the mode of interaction: the telephone—a device we use, via our voice, in public places. Callers who speak private information are subject to eavesdropping and recording devices. Furthermore, spoken input is often intentionally captured for the purpose of speech recognition tuning or agent observation (remember that little “your call may be monitored or recorded” disclaimer you heard?).
From a user authentication standpoint, IVR applications rarely require callers to answer personal challenge questions as is common on the web. Instead, they tend to prompt callers for information that is easily available to anyone—a date of birth or an account number, for example. And although a caller’s phone number can be used as one way to identify that person, IVR applications rarely leverage this. In fact, technology even exists to “spoof” a phone number, allowing hackers to impersonate someone they’re not.
These potential vulnerabilities don’t mean that IVR isn’t a great—and secure—self-service option. Compared to revealing personal information to a live agent, it’s actually more secure. By following these threat remediation strategies during design and development, organizations can ensure their IVR applications meet the highest security standards:
- Use strong authentication – ask for several pieces of correct (and not readily attainable) information in order to access an application.
- Implement multi-factor authentication – require users to meet two of the three recommended authentication factors: what you know (challenge question), what you have (phone for receiving SMS), and who you are (unique voiceprint).
- Enable touchtone for collection of private information – give callers the option of entering sensitive data such as a PIN via DTMF instead of speaking it.
- Identify logging requirements – determine which steps in the application will log data and which will not. SSNs, credit card numbers, or other identifying data should not be logged or displayed in reports.
- Ensure HIPAA and PCI compliance – both the health insurance and payment card industries require strict adherence to privacy guidelines. Compliance with both of these entities ensures that health information and payment information is kept private and secure.
- Transmit data securely – implement secure data protocols (TLS, HTTPS, LDAPS) for web services and backend data integrations.
- Encrypt data during exchange and at rest – implement strong encryption methods using advanced cipher keys approved by the National Institute of Standards and Technology.
- Utilize biometrics – consider voice biometrics technology for IVR, which creates a distinct ‘voiceprint’ for each user that can be used as one factor of authentication.
- Consider a third party application security service – engage a company that specializes in security to scan all application code for vulnerabilities and identify any possible exposures or threats.
For more information on how new and existing IVR applications can be optimized for security, contact INI.