As a security company, we often have customers who call into our support center to either allow or disallow some kind of computer traffic.

This is the nature protecting people from the Internet, and there is nothing unusual about it. However, there is a new trend facing people who rely on help desks, like ours.

Hackers have targeted help desks because they know that the people who provide you support have the access into your systems that they want to exploit.

Imagine the following scenario:

You have 5 restaurants with POS systems that help you run your business.

To help you with managing your business, you have hired some outside technology company such as your POS provider or Netsurion to help support you. If a hacker figured out that you have a centralized help desk, what stops them from calling for help and telling whomever answers the phone that they are you.

Furthermore, they explain that there is an emergency situation, and they need full access to all your locations immediately. Would your current help desk know how to verify your identification so that the hacker will not successfully convince someone to by pass your security?

When asked, most owners state that the people who support them know their voice and they will recognize them on the phone.

Well, that might be the case most of the time, but what if it is a new engineer who was just hired? They might be scared of losing their job, so they will do what they can to accommodate an agitated customer who is demanding immediate support.

The nature of a support desk job is to provide help to people who call. Therefore, you should have some kind of safeguard protecting you so that someone cannot simply pretend to be you on the phone and access your sensitive equipment and data.

There are many simple ways that well run businesses use to validate identity every day. You can have a secret word that a technician has to ask you, or you might need to answer a series of personal questions that are stored at your support center.

Here at Netsurion, for example, we have users with different levels of support permission and our help desk sends a one-time password to our approved contacts who call us for technical support. Regardless of the method you use to protect yourself, you need to be aware of the potential risk to your operations.

For more information about help desk vulnerabilities you can check out this article from “Dark Reading”.