The Service Desk is potentially one of the biggest security holes in IT. There are several ways to hack a Service Desk:
1. Spoofing a user on the phone
2. Spoofing a user on email
3. Spoofing a user on the portal
We should be validating that end-users are who they say they are (authentication) no matter which communication channel they use.
Some suggestions:
1. Spoofing on the phone: have an authentication module on FreshService which requires that a user authenticates using Google Authenticator, or an text message.
2. Spoofing on email: force users to only use their work-related email addresses, this should be linked to the customer directory service
3. Spoofing on the portal: users can only log an incident if they are logged on with their domain credentials (which requires multiple domain SSO integration).
