Contents

System security for CIC

CIC is a Windows Server-based communication system that takes advantage of NT Advanced Server (NTAS) security features built into the operating system. CIC also uses encrypted passwords, implicit and explicit login procedures, and it provides other mechanisms to prevent the abuse of CIC accounts and toll fraud practices. Toll fraud is a common abuse of phone system privileges where employees and external thieves use corporate resources for long distance phone charges. To control telephone access, CIC allows you to define patterns or groups of phone numbers for any number of dialing destinations (for example, Local Calls, Emergency Calls, In State, International, etc.), called "classifications." It also allows you to assign zero or more of these classifications to all users, individual users, all members of a workgroup, or any station (for example, stand-alone telephone) defined in CIC an organization or organizational group . This approach gives CIC administrators complete control over which users and stations are allowed to dial certain numbers.

Using Interaction Administrator, CIC administrators can control which parts of the CIC clients appear on each agent’s computer, and which telephone features each agent may use. A CIC Master Administrator can also give limited CIC administration controls to trusted users who have access to Interaction Administrator.

The following sections provide an overview of several security considerations. For more information about CIC security considerations that may affect your environment, see the Interaction Center Security Features Technical Reference in the Documentation Library.

Basic Precautions

To minimize opportunities for toll fraud or sabotage to the CIC server, follow these basic precautions in any CIC installation.

CIC client users should log out each day or evening before going home. To be safe, CIC users should lock their desktops or completely log out of the operating system to prevent unauthorized users from starting the CIC clients and gaining dialing privileges. As long as a CIC client user’s workstation is logged in to the CIC server, that workstation’s telephone can be used to make any kind of call that user has privileges to make, even if the user’s computer is password protected.
Configure each CIC user account with that user’s NT domain account (see the User Configuration page in Interaction Administrator) to enable NTAS account/password security. See the CIC Account Authentication section below for details on how this works.
Unless it is absolutely necessary, do not modify the IC DialPlan handler to require all users to dial a single digit (for example, 9) to dial an external number. This scheme is prone to the bogus "test your line" phone scam where a caller falsely representing the phone company asks an unsuspecting operator to press the keys 9, 0, and # and then hang up in order to conduct a line test. Doing so gives the caller access to that line. CIC can intelligently select the appropriate lines (that is, dial groups) for external calls; CIC does not require a prefix digit to "get an outside line."
Control access to the corporate toll free line, and follow the precautions described in the Toll Fraud Prevention topic to prevent remote callers from abusing CIC’s powerful remote access capabilities.
To enhance security and simplify the process updating CIC, ensure that each CIC user account name identically matches the user's corresponding NT domain account name. This name convention is not a requirement, but it will enable you to take advantage of improved security features.

Fraud, authentication, and passwords

Toll Fraud

See the Toll Fraud Prevention topic for a detailed discussion on preventing toll fraud by employees who may choose to abuse CIC’s powerful remote access features.

CIC Account Authentication

Each CIC user account generally corresponds to a network domain account established on a Windows server. This network account usually has an email account on a mail server (for example, Microsoft Exchange Server) on the network. CIC user accounts can exist apart from a network account, but those CIC users will not have access to CIC’s unified messaging features, and they must explicitly log in to CIC with a CIC password each time they connect to the IC server. The most efficient, and recommended, way for CIC users to connect to CIC is via an implicit login using a valid network account. CIC performs implicit or explicit account validation the first time a CIC user starts a client application (for example, the CIC client, voice mail form, Interaction Fax Viewer, and so on.) The implicit login process uses NTAS to verify the CIC user has a valid NT domain account, and is thereby automatically authenticated to the CIC server.

Login Authentication Cache

During the initial account authentication process, that account’s login information is cached on the local client workstation, if the login was successful. CIC applications started after that they do not require manual validation because they use the cached login information by default. For example, if you successfully start Interaction Client Fax Viewer and then later choose to start Interaction Fax Viewer or use the MAPI voicemail form, those CIC client applications will not need to be authenticated by the CIC server because the user’s login information is cached on the client workstation.

You can manually start some CIC applications with /User= and /Password= command line arguments, which override the cached login names. When an CIC user logs out of the operating system, or restarts the computer, the login account cache is destroyed. Just logging out of CIC does not destroy the user cache. If a user encounters a problem logging in to CIC, you can manually clear the client workstation’s login cache by closing the process named I3aca.exe on that workstation.

Implicit Login

Implicit login allows properly configured CIC users to be authenticated on the CIC server via the user’s NT domain account. When someone logs in to a network domain, that person is authenticated on the network via NTAS. CIC Client applications can take the domain/account name used to log in to a workstation and compare it with a list of domain/account names entered in the CIC user’s configuration in Interaction Administrator. If a match is found, the IC Client application is automatically authenticated. This works only if the Domain User field is properly completed in Interaction Administrator for the users starting CIC applications. If it does not find an exact match between the client’s domain/user name and the user configuration data on the CIC server, the login is denied and the client application can prompt the user to manually log in. Click here for more details.

Implicit login requires that each CIC user’s Configuration page has the NT Domain User field correctly filled in with the text:

DOMAIN/UserName

The DOMAIN portion is the name of the network domain the CIC server is on, and the CIC user accounts have access to (for example, I3Domain). The UserName portion is the network user’s account name (for example, KevinK). If the NT Domain User field is not filled in (for example, I3domain/Kevink), users must log in to CIC manually.

Explicit Login

CIC client applications can manually log in to the CIC server in two ways.

Some CIC client applications can use /User and /Pass command line arguments
If implicit login fails, CIC client applications present the Login dialog

Some applications, like snteraction Fax Viewer and Fax Monitor cannot be started with user name and password arguments. However, the CIC clients, Interaction Administrator, Interaction Designer, and several other CIC client applications can be started from a command prompt with command line arguments that specify the CIC user name and password. For example:

C:> clienta /user=sonyam /password=123 /notifier=I3server

If CIC finds a CIC user named "sonyam" with a CIC password of "123" defined on the CIC server, the login is successful and the login data is cached on client workstation for subsequent connections. However, if the user name or password is not authenticated (for example, the wrong password is entered), CIC displays a login dialog to prompt the user, as shown below:

In the Login dialog box, enter a valid CIC user and server configuration data:

IC Username A valid CIC account name (such as, milanv)
Password The CIC password for this account (such as, 1234)
Server The name or IP address of the CIC server (such as, I3Server)

Password Encryption

While passwords entered on a command line are visible, and therefore vulnerable, at that point, passwords are concealed on the Login dialog box. In both cases, passwords are immediately encrypted before they are passed across the network; they are not passed as clear text. Passwords are stored in an encrypted format in the registry on the CIC server and are therefore not readable by editing the registry. If a CIC user forgets his or her unique password, the CIC administrator must enter a new password for that user in the User Configuration page in Interaction Administrator.