Telecom cybersecurity: 5 mistakes small businesses make

If you don’t know who can change call forwarding or who can call certain destinations, you don’t control the risks in your phone system. Telecom cybersecurity means reviewing access, outbound calls, call forwarding, service continuity and recordings. Changing passwords is not enough.

In brief:

• Sharing an admin account makes it harder to identify who changed an extension or a call forwarding rule.
• Reviewing outbound calling permissions and authorised destinations helps you spot settings you no longer need.
• If the connection fails, your plan should say where calls will go and how you will test the forwarding.
• Protecting recordings means deciding who can listen to them and checking the rules that apply to how long you keep them.

Start by checking what can be changed and who can change it. Review the cloud PBX features and ask your provider which controls it offers before assuming they are in place.

What goes wrong when several people share a cloud PBX account?

When several people share the cloud PBX administrator account, it is hard to tell who changed an extension, a call queue or a call forwarding rule. If a former employee still knows the password, removing their access means changing it for everyone who uses the account.

Start by identifying who logs in to the cloud PBX and why. Then check what access each person needs: someone who answers calls does not need permission to change the settings. Give each person their own login where the provider allows it, and check how you remove or change access when someone leaves the company or changes roles.

If the cloud PBX only supports a shared account, ask the provider how to limit its use and check who made changes. Record who approves each change. To extend this check to the rest of the service, see how to review a small business’s phone service.

Why review outbound calling permissions?

Outbound calling permissions determine which users or extensions can call and which destinations they can reach. If access is left open without a clear reason, your company may take longer to spot calls it does not recognise. It may also be unclear which access to restrict or whom to contact to stop the calls.

Define the destinations each team needs. Then check whether extensions still have permissions they no longer use. A SIP channel carries a call over the connection between your PBX and your provider. If you run your own PBX, see how SIP Trunk connects your own PBX before deciding which controls you need.

Ask your provider whether you can restrict destinations by extension, review outbound activity and block calls when you spot unauthorised use. Ask for the reporting and blocking procedure too. Spotting a problem is little use if nobody knows who must act.

What is the risk of not reviewing call forwarding?

A call forwarding rule that nobody checks can send calls to an old number, a mobile phone that no one answers any more, or a number outside your company. If people can also change the rule without oversight, it becomes hard to tell when the call route changed and who approved it.

Check these routes regularly with test calls:

• Main numbers: check which extension, queue or number receives each call.
• Queues: check where a call goes when nobody answers.
• Out-of-hours calls: confirm they reach the intended destination when the office is closed.

Record where each test call actually goes and who approves changes. If a call does not reach the expected destination, correct the forwarding rule and test it again.

What happens if the connection your phone service depends on fails?

If that connection fails, your business may stop receiving calls on its usual extensions. Before an outage, you need to know where those calls will go, who will activate the backup route and how they will check that it works.

Preventing unauthorised access protects the cloud PBX. Keeping calls flowing during an outage takes a separate plan. Identify which numbers depend on the office connection and agree with your provider how you can receive calls if it fails. When reviewing fibre and mobile connectivity, ask what depends on each connection and what your team would need to do.

Then assign one person to activate the procedure and another to check it. Test it: call the main number from outside, check who answers and confirm how you will return to normal operation. A plan nobody has tested is still a hypothesis.

Why isn’t switching on call recording enough?

Saving the audio is only one part of the job. Without a clear purpose, access rules and a retention policy, conversations may remain available longer than necessary. Before recording calls, define why you need them, who can listen and what information callers should receive.

Keep the technical setup separate from the legal review. Ask your provider where recordings are stored, how access is restricted and how it is removed when someone no longer needs it. Do not assume your phone system has controls you have not checked.

Before you switch on recording, review what callers will be told and how long you need to keep the files. Do not assume consent is always required or choose a retention period by guesswork. Use the call recording guide to prepare your questions, then check the answers with up-to-date legal advice.

Frequently asked questions

Are internet calls less secure than calls over a traditional phone line?

Not necessarily. The risk depends on how access, the connection and the service configuration are managed. Changing technology does not eliminate administrative mistakes. When comparing providers, ask which controls you can manage, which ones they manage and how to report an incident. Get the answers in writing.

How can I tell if someone is spoofing my company’s number?

You cannot confirm spoofing just because someone says they received a call displaying your number. Ask when the call happened, which number received it and what happened. Check whether your company has a record of the call. Then give the details to your provider and ask them to investigate what they can verify.

What information should I prepare before reporting an incident to my provider?

Write down what happened, when it started and which numbers, extensions or people appear to be affected. Keep any reports you have received and note any changes your team has made since spotting the problem. Say whether you can still make and receive calls. This will help your provider decide what to check first.

What security questions should I ask before choosing a phone provider for my small business?

Ask who manages the accounts, how changes are authorised and what options you have to control outbound calls. Find out how calls will be handled if the connection fails, how to report an incident and which tasks remain your responsibility. Do not assume a feature is included unless the provider confirms it.

Ask for a review of access permissions, call forwarding and the continuity of your phone service.

Ask for a review of access permissions, call forwarding and the continuity of your phone service.

---

Written by Mehdi Chouikh, CEO.