How Secure Is Your Call Center? Network Device Security
In our previous entry on this topic, we dove into the world of endpoint device security. In many cases, malware and attacker entry points can be traced back to a compromised endpoint. Attackers and malware are more resourceful than they were a few years ago, though, so every possible vector has to be identified and protected, not just the desktops.
When someone says network device, a wide range of equipment comes to mind: firewalls, routers, switches, wireless access points, network attached storage, and so on. In a call center environment, the telephony systems belong on that list too, because the phone platform is ultimately the lifeblood of the business. A compromised switch is a bad day; a compromised PBX or dialer takes revenue off the board by the minute. I treat our voice infrastructure with the same suspicion I apply to anything else with an IP address, because that is exactly what it is.
Out of the box, none of these devices are immune to attack, whether from a snooping employee, a malicious outsider, or malware working its way laterally through the network. Many attacks can be avoided simply by weighing security risk against actual business need before a device or exception goes live. Here is the pattern I see most often: a user requests a temporary exception for a legitimate, short-term business need, the exception is granted, the project ends, and the exception lives on forever because nobody owned the task of removing it. Attackers hunt for exactly these forgotten holes: remotely accessible ports and services that someone opened for a reason nobody remembers. As vulnerabilities and entry points accumulate, the odds of an incident go up with them. Poorly configured mail servers, web servers, and file servers are the classic examples. If an attacker gets in, your administrator is facing a nightmare scenario: sensitive data viewed or altered, or business continuity deliberately disrupted.
Unlike PCs and servers, most network devices cannot be protected by installing anti-malware software. They have to be manually hardened by an administrator based on what the business actually requires of them. The work is meticulous rather than clever, which is probably why it gets skipped. A few widely accepted best practices that I hold our own environment to:
- Allow access only to ports and protocols with a specific, documented business need.
- Disable or remove services that are not needed or that duplicate something already provided elsewhere.
- Keep all services, firmware, and operating systems current. Network gear is the equipment most likely to be running firmware from the year it was installed.
- Run port scans against all devices on a regular schedule, so you find the open doors before an attacker does. The scan that surprises you is the one that was worth running.
- Periodically review and re-justify every service in use. If nobody can name the business reason, turn it off and see who calls.
- Separate critical production services onto their own hosts: DNS, email, DHCP, file, database, and web services should not share a box just because the box has capacity.
- Document every explicit exception with the business reason behind it, and track changes to those exceptions. An exception without an expiration date and an owner is a permanent vulnerability with paperwork.
Segmentation deserves a mention as well. In a call center there is no reason the agent floor, the voice systems, and the server infrastructure need to sit in one flat network. Putting them in separate VLANs with firewall rules between them costs a few evenings of planning and cutover work, and it means a compromised agent PC cannot talk directly to your database server or your phone switch. That single design decision has more security value than most products you can buy.
There are many additional hardening steps, and the specific actions vary from device to device, but the concept holds regardless of brand, model, or operating system. If you run a Microsoft shop, the Best Practices Analyzers can scan your systems and flag configurations that stray from vendor guidance; equivalent hardening guides exist from other trusted sources and should be used to make sure all bases are covered.
It is impossible to completely protect a heterogeneous device environment short of unplugging everything from the network, and nobody is paying us to do that. But if you keep up with security trends, hold your configurations to a documented standard, and review your exceptions like they are debts to be paid down, your administrator can sleep peacefully. Most nights, anyway.