Breach fitness for organisations
Assume that certain details about your customers may already have been exposed. And design customer contact and verification around that.
In cybersecurity, organisations have worked for years with the principle assume breach: assume that an attacker may already be inside and design your security around that.
Especially within customer service, helpdesk, identification and verification processes, a different starting point also applies: assume exposure.
Name, address, date of birth, email address, phone number or customer number are therefore less and less suitable for establishing that someone really is the customer.
The question then becomes not only:
“How do we protect personal data?”
but also:
“How do we act safely when personal data may already be known to people with bad intent?”
A caller gives name, address and customer number. Is that enough to change their details?
A ‘colleague’ asks for a password reset and knows the right details. How do you establish who it is?
A request to change a bank account number, email address or phone number.
Recovery and security questions that rely on data that may already have leaked.
Which details do we currently rely on to establish that someone is the customer or colleague?
Which of those details may already be known to people with bad intent?
Are staff allowed to end the call and call back via a known channel?
Is it safe and normal for staff to report doubt or a mistake straight away?