Genesys CTI User Forum

Whenever a route ISCC is done over PSTN, are we introducing some kind of security hole in the system?

An example scenario –

A. A customer call is authenticated by IVR In front. Sensitive data attached.
B. Customer wants to talk to an agent. IVR requests ISCC for transferring a call to Avaya PBX.
C. Avaya T-Server assigns ERP and sends the access number – which is a public number.
D. Before IVR can dial the access number, someone from public network dials that number.

In this scenario, T-Server will most likely think this call as the original customer call and attach all data gathered by the customer call with this new call.

Of course having private trunks will help. But is there anything anyone knows of if it could be addressed in above scenario in some elegant way?

Thanks for any help.

I posted last night but the site was having problems so here goes again

I have dealt with this issue several times with paranoid clients (Banks) and each time the result is that it is a non-issue.

Don't make the External Route Points in a known range of numbers (known to customers or staff) and the probability of there being a security risk is so minimal that PINs are easier to guess. Remember you have to know the ERP that will be chosen next and be able to dial in the exact instant to "spoof" a call.

The only way I have been able to get one call through is by having an IVR making hundreds of call while I make a test call. Each call that hits an ERP is either caught by the switch programming or directed to the default_destination so you would notice a sudden burst of calls.

As I said it is a non-issue