avaya toll fraud and security handbook · 2008. 2. 14. · avaya toll fraud and security handbook...

Avaya Toll Fraud and Security Handbook

555-025-600Issue 10

June 2005

Copyright 2005, Avaya Inc.All Rights Reserved

NoticeEvery effort was made to ensure that the information in this document was complete and accurate at the time of printing. However, information is subject to change.

WarrantyAvaya Inc. provides a limited warranty on this product. Refer to your sales agreement to establish the terms of the limited warranty. In addition, Avaya’s standard warranty language as well as information regarding support for this product, while under warranty, is available through the following Web site: http://www.avaya.com/support.

Preventing Toll Fraud"Toll fraud" is the unauthorized use of your telecommunications system by an unauthorized party (for example, a person who is not a corporate employee, agent, subcontractor, or is not working on your company's behalf). Be aware that there may be a risk of toll fraud associated with your system and that, if toll fraud occurs, it can result in substantial additional charges for your telecommunications services.

Avaya Fraud InterventionIf you suspect that you are being victimized by toll fraud and you need technical assistance or support, in the United States and Canada, call the Technical Service Center's Toll Fraud Intervention Hotline at1-800-643-2353.

DisclaimerAvaya is not responsible for any modifications, additions or deletions to the original published version of this documentation unless such modifications, additions or deletions were performed by Avaya. Customer and/or End User agree to indemnify and hold harmless Avaya, Avaya's agents, servants and employees against all claims, lawsuits, demands and judgments arising out of, or in connection with, subsequent modifications, additions or deletions to this documentation to the extent made by the Customer or End User.

How to Get HelpFor additional support telephone numbers, go to the Avaya support Web site: http://www.avaya.com/support. If you are:

• Within the United States, click the Escalation Contacts link. Then click the appropriate link for the type of support you need.

• Outside the United States, click the Escalation Contacts link. Then click the International Services link that includes telephone numbers for the international Centers of Excellence.

Providing Telecommunications SecurityTelecommunications security (of voice, data, and/or video communications) is the prevention of any type of intrusion to (that is, either unauthorized or malicious access to or use of) your company's telecommunications equipment by some party.Your company's "telecommunications equipment" includes both this Avaya product and any other voice/data/video equipment that could be accessed via this Avaya product (that is, "networked equipment").An "outside party" is anyone who is not a corporate employee, agent, subcontractor, or is not working on your company's behalf. Whereas, a "malicious party" is anyone (including someone who may be otherwise authorized) who accesses your telecommunications equipment with either malicious or mischievous intent.Such intrusions may be either to/through synchronous (time-multiplexed and/or circuit-based), or asynchronous (character-, message-, or packet-based) equipment, or interfaces for reasons of:

• Utilization (of capabilities special to the accessed equipment)• Theft (such as, of intellectual property, financial assets, or toll

facility access)• Eavesdropping (privacy invasions to humans)• Mischief (troubling, but apparently innocuous, tampering)• Harm (such as harmful tampering, data loss or alteration,

regardless of motive or intent)Be aware that there may be a risk of unauthorized intrusions associated with your system and/or its networked equipment. Also realize that, if such an intrusion should occur, it could result in a variety of losses to your company (including but not limited to, human/data privacy, intellectual property, material assets, financial resources, labor costs, and/or legal costs).

Responsibility for Your Company’s Telecommunications SecurityThe final responsibility for securing both this system and its networked equipment rests with you - Avaya’s customer system administrator, your telecommunications peers, and your managers. Base the fulfillment of your responsibility on acquired knowledge and resources from a variety of sources including but not limited to:

• Installation documents• System administration documents• Security documents• Hardware-/software-based security tools• Shared information between you and your peers• Telecommunications security experts

To prevent intrusions to your telecommunications equipment, you and your peers should carefully program and configure:

• Your Avaya-provided telecommunications systems and their interfaces

• Your Avaya-provided software applications, as well as their underlying hardware/software platforms and interfaces

• Any other equipment networked to your Avaya products

TCP/IP FacilitiesCustomers may experience differences in product performance, reliability and security depending upon network configurations/design and topologies, even when the product performs as warranted.

Standards ComplianceAvaya Inc. is not responsible for any radio or television interference caused by unauthorized modifications of this equipment or the substitution or attachment of connecting cables and equipment other than those specified by Avaya Inc. The correction of interference caused by such unauthorized modifications, substitution or attachment will be the responsibility of the user. Pursuant to Part 15 of the Federal Communications Commission (FCC) Rules, the user is cautioned that changes or modifications not expressly approved by Avaya Inc. could void the user’s authority to operate this equipment.

Product Safety StandardsThis product complies with and conforms to the following international Product Safety standards as applicable:Safety of Information Technology Equipment, IEC 60950, 3rd Edition, or IEC 60950-1, 1st Edition, including all relevant national deviations as listed in Compliance with IEC for Electrical Equipment (IECEE) CB-96A.Safety of Information Technology Equipment, CAN/CSA-C22.2No. 60950-00 / UL 60950, 3rd Edition, or CAN/CSA-C22.2 No. 60950-1-03 / UL 60950-1.Safety Requirements for Customer Equipment, ACA Technical Standard (TS) 001 - 1997.One or more of the following Mexican national standards, as applicable: NOM 001 SCFI 1993, NOM SCFI 016 1993, NOM 019 SCFI 1998.The equipment described in this document may contain Class 1 LASER Device(s). These devices comply with the following standards:

• EN 60825-1, Edition 1.1, 1998-01• 21 CFR 1040.10 and CFR 1040.11.

The LASER devices used in Avaya equipment typically operate within the following parameters:

Luokan 1 LaserlaiteKlass 1 Laser ApparatUse of controls or adjustments or performance of procedures other than those specified herein may result in hazardous radiation exposures. Contact your Avaya representative for more laser product information.

Typical Center Wavelength Maximum Output Power

830 nm - 860 nm -1.5 dBm

1270 nm - 1360 nm -3.0 dBm

1540 nm - 1570 nm 5.0 dBm

http://www.avaya.com/supporthttp://www.avaya.com/support/

Electromagnetic Compatibility (EMC) StandardsThis product complies with and conforms to the following international EMC standards and all relevant national deviations:Limits and Methods of Measurement of Radio Interference of Information Technology Equipment, CISPR 22:1997 and EN55022:1998.Information Technology Equipment - Immunity Characteristics - Limits and Methods of Measurement, CISPR 24:1997 and EN55024:1998, including:

• Electrostatic Discharge (ESD) IEC 61000-4-2• Radiated Immunity IEC 61000-4-3• Electrical Fast Transient IEC 61000-4-4• Lightning Effects IEC 61000-4-5• Conducted Immunity IEC 61000-4-6• Mains Frequency Magnetic Field IEC 61000-4-8• Voltage Dips and Variations IEC 61000-4-11

Power Line Emissions, IEC 61000-3-2: Electromagnetic compatibility (EMC) - Part 3-2: Limits - Limits for harmonic current emissions.Power Line Emissions, IEC 61000-3-3: Electromagnetic compatibility (EMC) - Part 3-3: Limits - Limitation of voltage changes, voltage fluctuations and flicker in public low-voltage supply systems.

Federal Communications Commission StatementPart 15:

Part 68: Answer-Supervision SignalingAllowing this equipment to be operated in a manner that does not provide proper answer-supervision signaling is in violation of Part 68 rules. This equipment returns answer-supervision signals to the public switched network when:

• answered by the called station,• answered by the attendant, or• routed to a recorded announcement that can be administered

by the customer premises equipment (CPE) user.This equipment returns answer-supervision signals on all direct inward dialed (DID) calls forwarded back to the public switched telephone network. Permissible exceptions are:

• A call is unanswered.• A busy tone is received.• A reorder tone is received.

Avaya attests that this registered equipment is capable of providing users access to interstate providers of operator services through the use of access codes. Modification of this equipment by call aggregators to block access dialing codes is a violation of the Telephone Operator Consumers Act of 1990.

REN Number

For MCC1, SCC1, CMC1, G600, and G650 Media Gateways:This equipment complies with Part 68 of the FCC rules. On either the rear or inside the front cover of this equipment is a label that contains, among other information, the FCC registration number, and ringer equivalence number (REN) for this equipment. If requested, this information must be provided to the telephone company.

For G350 and G700 Media Gateways:This equipment complies with Part 68 of the FCC rules and the requirements adopted by the ACTA. On the rear of this equipment is a label that contains, among other information, a product identifier in the format US:AAAEQ##TXXXX. The digits represented by ## are the ringer equivalence number (REN) without a decimal point (for example, 03 is a REN of 0.3). If requested, this number must be provided to the telephone company.

For all media gateways:The REN is used to determine the quantity of devices that may be connected to the telephone line. Excessive RENs on the telephone line may result in devices not ringing in response to an incoming call. In most, but not all areas, the sum of RENs should not exceed 5.0. To be certain of the number of devices that may be connected to a line, as determined by the total RENs, contact the local telephone company.REN is not required for some types of analog or digital facilities.

Means of ConnectionConnection of this equipment to the telephone network is shown in the following tables.

For MCC1, SCC1, CMC1, G600, and G650 Media Gateways:

For G350 and G700 Media Gateways:

For all media gateways:If the terminal equipment (for example, the media server or media gateway) causes harm to the telephone network, the telephone company will notify you in advance that temporary discontinuance of service may be required. But if advance notice is not practical, the telephone company will notify the customer as soon as possible. Also, you will be advised of your right to file a complaint with the FCC if you believe it is necessary.The telephone company may make changes in its facilities, equipment, operations or procedures that could affect the operation of the equipment. If this happens, the telephone company will provide advance notice in order for you to make necessary modifications to maintain uninterrupted service.If trouble is experienced with this equipment, for repair or warranty information, please contact the Technical Service Center at1-800-242- 2121 or contact your local Avaya representative. If the equipment is causing harm to the telephone network, the telephone company may request that you disconnect the equipment until the problem is resolved.

Note: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense.

Manufacturer’s PortIdentifier

FIC Code SOC/REN/A.S. Code

Network Jacks

Off premises station OL13C 9.0F RJ2GX, RJ21X, RJ11C

DID trunk 02RV2-T 0.0B RJ2GX, RJ21X

CO trunk 02GS2 0.3A RJ21X

02LS2 0.3A RJ21X

Tie trunk TL31M 9.0F RJ2GX

Basic Rate Interface 02IS5 6.0F, 6.0Y RJ49C

1.544 digital interface 04DU9-BN 6.0F RJ48C, RJ48M

04DU9-IKN 6.0F RJ48C, RJ48M

04DU9-ISN 6.0F RJ48C, RJ48M

120A4 channel service unit

04DU9-DN 6.0Y RJ48C

Manufacturer’s PortIdentifier

FIC Code SOC/REN/A.S. Code

Network Jacks

Ground Start CO trunk 02GS2 1.0A RJ11C

DID trunk 02RV2-T AS.0 RJ11C

Loop Start CO trunk 02LS2 0.5A RJ11C

1.544 digital interface 04DU9-BN 6.0Y RJ48C

04DU9-DN 6.0Y RJ48C

04DU9-IKN 6.0Y RJ48C

04DU9-ISN 6.0Y RJ48C

Basic Rate Interface 02IS5 6.0F RJ49C

A plug and jack used to connect this equipment to the premises wiring and telephone network must comply with the applicable FCC Part 68 rules and requirements adopted by the ACTA. A compliant telephone cord and modular plug is provided with this product. It is designed to be connected to a compatible modular jack that is also compliant. It is recommended that repairs be performed by Avaya certified technicians.The equipment cannot be used on public coin phone service provided by the telephone company. Connection to party line service is subject to state tariffs. Contact the state public utility commission, public service commission or corporation commission for information.This equipment, if it uses a telephone receiver, is hearing aid compatible.

Canadian Department of Communications (DOC) Interference InformationThis Class A digital apparatus complies with Canadian ICES-003.Cet appareil numérique de la classe A est conforme à la normeNMB-003 du Canada.This equipment meets the applicable Industry Canada Terminal Equipment Technical Specifications. This is confirmed by the registration number. The abbreviation, IC, before the registration number signifies that registration was performed based on a Declaration of Conformity indicating that Industry Canada technical specifications were met. It does not imply that Industry Canada approved the equipment.

Installation and RepairsBefore installing this equipment, users should ensure that it is permissible to be connected to the facilities of the local telecommunications company. The equipment must also be installed using an acceptable method of connection. The customer should be aware that compliance with the above conditions may not prevent degradation of service in some situations.Repairs to certified equipment should be coordinated by a representative designated by the supplier. Any repairs or alterations made by the user to this equipment, or equipment malfunctions, may give the telecommunications company cause to request the user to disconnect the equipment.

Declarations of ConformityUnited States FCC Part 68 Supplier’s Declaration of Conformity (SDoC)Avaya Inc. in the United States of America hereby certifies that the equipment described in this document and bearing a TIA TSB-168 label identification number complies with the FCC’s Rules and Regulations 47 CFR Part 68, and the Administrative Council on Terminal Attachments (ACTA) adopted technical criteria.Avaya further asserts that Avaya handset-equipped terminal equipment described in this document complies with Paragraph 68.316 of the FCC Rules and Regulations defining Hearing Aid Compatibility and is deemed compatible with hearing aids.Copies of SDoCs signed by the Responsible Party in the U. S. can be obtained by contacting your local sales representative and are available on the following Web site: http://www.avaya.com/support.All Avaya media servers and media gateways are compliant with FCC Part 68, but many have been registered with the FCC before the SDoC process was available. A list of all Avaya registered products may be found at: http://www.part68.org by conducting a search using "Avaya" as manufacturer.

European Union Declarations of Conformity

Avaya Inc. declares that the equipment specified in this document bearing the "CE" (Conformité Europeénne) mark conforms to the European Union Radio and Telecommunications Terminal Equipment Directive (1999/5/EC), including the Electromagnetic Compatibility Directive (89/336/EEC) and Low Voltage Directive (73/23/EEC).Copies of these Declarations of Conformity (DoCs) can be obtained by contacting your local sales representative and are available on the following Web site: http://www.avaya.com/support.

JapanThis is a Class A product based on the standard of the Voluntary Control Council for Interference by Information Technology Equipment (VCCI). If this equipment is used in a domestic environment, radio disturbance may occur, in which case, the user may be required to take corrective actions.

To order copies of this and other documents:Call: Avaya Publications Center

Voice 1.800.457.1235 or 1.207.866.6701FAX 1.800.457.1764 or 1.207.626.7269

Write: Globalware Solutions200 Ward Hill AvenueHaverhill, MA 01835 USAAttention: Avaya Account Management

E-mail: [email protected] the most current versions of documentation, go to the Avaya support Web site: http://www.avaya.com/support.

http://avaya.com/supporthttp://www.part68.org/http://www.avaya.com/support/http://www.avaya.com/support/

Issue 10 June 2005 5

Chapter 1: About this document . . . . . . . . . . . . . . . . . . . . . . 21Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21Reason for reissue. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Intended audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23How this guide is organized . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23Avaya’s statement of direction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Avaya/customer security roles and responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Avaya’s roles and responsibilities . . . . . . . . . . . . . . . . . . . . . . . . 27Customer roles and responsibilities . . . . . . . . . . . . . . . . . . . . . . . 28

Downloading this book and updates from the Web . . . . . . . . . . . . . . . . . 28Related resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Product documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29Avaya security offerings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Avaya toll fraud and technical assistance . . . . . . . . . . . . . . . . . . . . . . 30Within the US. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30International . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Related documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30Trademarks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31Sending us comments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

Chapter 2: Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Who is the enemy? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

Hackers and phreakers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Call sell operations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Drug dealers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

What is in a loss? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35Cost of the phone bill . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35Lost revenue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35Expenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Known toll fraud activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36

Chapter 3: IP security . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41Mission-critical assets. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42Physical security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Contents

Contents

6 Avaya Toll Fraud and Security Handbook

Hacker attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42Control networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Firewalls and routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Customer-managed applications . . . . . . . . . . . . . . . . . . . . . . . . . . . 44Administration and management . . . . . . . . . . . . . . . . . . . . . . . . . . . 45Software patches and upgrades . . . . . . . . . . . . . . . . . . . . . . . . . . . 45Additional information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Chapter 4: Security risks . . . . . . . . . . . . . . . . . . . . . . . . . . 47Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47Remote access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48Automated attendant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Other port security risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Voice messaging systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50Administration / maintenance access . . . . . . . . . . . . . . . . . . . . . . . . 50

Changing default passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . 50Choosing passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51Increasing adjunct access security . . . . . . . . . . . . . . . . . . . . . . . 52Increasing product access (port) security . . . . . . . . . . . . . . . . . . . . 52

General security measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53Educating users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53Establishing a policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54Physical security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Security goals tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Chapter 5: Large business communications systems . . . . . . . . . . 67Keeping unauthorized third partiesfrom entering the system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68

Protecting the Remote Access feature . . . . . . . . . . . . . . . . . . . . . . 68Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68Disabling/removing the Remote Access feature . . . . . . . . . . . . . . . . 69Tools to protect the Remote Access feature. . . . . . . . . . . . . . . . . . . 70

Barrier codes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71Authorization codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74Feature access code administration . . . . . . . . . . . . . . . . . . . . . 75Trunk administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75Remote access dial tone . . . . . . . . . . . . . . . . . . . . . . . . . . . 75Night service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

Contents


Call vectoring (Communication Manager,MultiVantage Software, DEFINITY ECSand DEFINITY G3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

Protecting vectors that contain call prompting . . . . . . . . . . . . . . . 76Command: status remote-access . . . . . . . . . . . . . . . . . . . . . . . . 77Logoff screen notification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

Tools that restrict unauthorized outgoing calls . . . . . . . . . . . . . . . . . . . 78Class of restriction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

Calling party and called party restrictions . . . . . . . . . . . . . . . . . . 80COR-to-COR restrictions/calling permissions . . . . . . . . . . . . . . . . 81Restriction override (3-way COR check) . . . . . . . . . . . . . . . . . . . 81

Class of service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82Facility restriction level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83Alternate facility restriction levels . . . . . . . . . . . . . . . . . . . . . . . . 83Toll analysis (G3 only). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84Free call list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84AAR/ARS analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84ARS dial tone. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84Station restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85Recall signaling (switchhook flash) . . . . . . . . . . . . . . . . . . . . . . . 85Attendant-controlled voice terminals . . . . . . . . . . . . . . . . . . . . . . 85Restrictions — individual and group-controlled(Communication Manager, MultiVantageSoftware, DEFINITY ECS, DEFINITY G1,G3, and System 75). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

Central office restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86Restricting incoming tie trunks . . . . . . . . . . . . . . . . . . . . . . . . . . 87Authorization codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87Trunk-to-trunk transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87Forced entry of account code. . . . . . . . . . . . . . . . . . . . . . . . . . . 88World class routing (Communication Manager,MultiVantage Software, DEFINITY ECS andDEFINITY G2.2 and G3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

Digit conversion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89Station security codes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89Personal station access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90Extended user administration of redirected calls . . . . . . . . . . . . . . . . 91Remote user administration of call coverage . . . . . . . . . . . . . . . . . . 91

Contents


Security measures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92Require passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92Restrict who can use remote access andtrack its usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93

Fully restrict service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95Provide individualized calling privileges using FRLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

Prevent after-hours calling using time of day routing or alternate FRLs . . . . . . . . . . . . . . . . . . . . . . 97

Block international calling . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98Limit international calling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99Select authorization code time-out to attendant. . . . . . . . . . . . . . . . . 100Restrict calls to specified area codes . . . . . . . . . . . . . . . . . . . . . . 101Allow calling to specified numbers. . . . . . . . . . . . . . . . . . . . . . . . 101Use attendant control of remote access calls(DEFINITY G2 and System 85 only) . . . . . . . . . . . . . . . . . . . . . . . 102

Use attendant control of specific extensions . . . . . . . . . . . . . . . . . . 102Disable direct access to trunks . . . . . . . . . . . . . . . . . . . . . . . . . . 103Use attendant control of trunk group access . . . . . . . . . . . . . . . . . . 103Disable facility test calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104Suppress remote access dial tone . . . . . . . . . . . . . . . . . . . . . . . . 106Disallow trunk-to-trunk transfer . . . . . . . . . . . . . . . . . . . . . . . . . 107Disable transfer outgoing trunk to outgoing trunk . . . . . . . . . . . . . . . 107Disallow outgoing calls from tie trunks . . . . . . . . . . . . . . . . . . . . . 108Limit access to tie trunks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109Monitor trunks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109Use terminal translation initialization . . . . . . . . . . . . . . . . . . . . . . 110Require account codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110Assign COR restrictions to adjuncts when usingexpert agents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

Disable distinctive audible alert . . . . . . . . . . . . . . . . . . . . . . . . . 111Remove data origination code . . . . . . . . . . . . . . . . . . . . . . . . . . 112Use world class routing restrictions . . . . . . . . . . . . . . . . . . . . . . . 112Change override restrictions on 3-way COR check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Detecting toll fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114Administration security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Logins for INADS port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115Forced password aging and administrable logins . . . . . . . . . . . . . 115

Call detail recording/station message detail recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

Contents


Traffic measurements and performance . . . . . . . . . . . . . . . . . . . . . 118Monitor I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118SAT, Manager I, and G3-MT reporting . . . . . . . . . . . . . . . . . . . . 119ARS measurement selection . . . . . . . . . . . . . . . . . . . . . . . . . 119

Automatic circuit assurance . . . . . . . . . . . . . . . . . . . . . . . . . . . 119BCMS measurements (Communication Manager,MultiVantage Software, DEFINITY ECS andDEFINITY G1 and G3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

CMS measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121Security violation notification (Communication Manager,MultiVantage Software, DEFINITY ECS and DEFINITY G3) . . . . . . . . . . 122

Security Violations Measurement reports . . . . . . . . . . . . . . . . . . . . 124Remote access barrier code aging/access limits(DEFINITY G3V3 and Later) . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

Recent Change History report (CommunicationManager, MultiVantage Software, DEFINITYECS, and DEFINITY G1 and G3) . . . . . . . . . . . . . . . . . . . . . . . . . 130

Malicious call trace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130Service observing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131Busy verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132List call-forwarding command . . . . . . . . . . . . . . . . . . . . . . . . . . 132

Chapter 6: Small business communications systems . . . . . . . . . . 133Features for the MERLIN systems . . . . . . . . . . . . . . . . . . . . . . . . . . 134MERLIN II Communications System . . . . . . . . . . . . . . . . . . . . . . . . . 136

Protecting direct inward system access . . . . . . . . . . . . . . . . . . . . . 136Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137

MERLIN LEGEND Communications System . . . . . . . . . . . . . . . . . . . . . 138Preventive measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139Protection via star codes andallowed/disallowed lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

Default disallowed list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141Assigning a second dial tone timer . . . . . . . . . . . . . . . . . . . . . . . 141Setting facility restriction levels . . . . . . . . . . . . . . . . . . . . . . . . . 142

Security defaults and tips . . . . . . . . . . . . . . . . . . . . . . . . . . . 142Protecting the Remote Access feature . . . . . . . . . . . . . . . . . . . . . . 143

Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143Protecting remote system programming. . . . . . . . . . . . . . . . . . . . . 145

Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145Protecting remote call forwarding . . . . . . . . . . . . . . . . . . . . . . . . 145

Contents


MERLIN LEGEND/MAGIX toll fraud . . . . . . . . . . . . . . . . . . . . . . . . . . 146Why toll fraud happens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146Tool fraud warning signs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146Tips to prevent toll fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147Responsibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148Programming tools to prevent fraud . . . . . . . . . . . . . . . . . . . . . . . 148Security of your systems: preventing toll fraud . . . . . . . . . . . . . . . . . 148Toll fraud prevention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

Physical security, social engineering, andgeneral security measures. . . . . . . . . . . . . . . . . . . . . . . . . . 150

Security risks associated with transferringthrough voice messaging systems . . . . . . . . . . . . . . . . . . . . . 151

Security risks associated with the AutomatedAttendant feature of voice messaging systems . . . . . . . . . . . . . . 153

Security risks associated with the RemoteAccess feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154

Other security hints . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154Detecting toll fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156Magix R1.5: allowed lists enhancements. . . . . . . . . . . . . . . . . . . 158Legend through Magix R1 automatic route selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Magix R1.5 automatic route selectionenhancements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160

Magix R1.5: Wildcard characters in ARS 6-digittables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

Magix R1.5: Disallowed lists enhancements . . . . . . . . . . . . . . . . . 163Loop-start reliable disconnect . . . . . . . . . . . . . . . . . . . . . . . . 164Disconnect signaling reliability . . . . . . . . . . . . . . . . . . . . . . . . 165Marked system speed dial. . . . . . . . . . . . . . . . . . . . . . . . . . . 166Night service group assignment . . . . . . . . . . . . . . . . . . . . . . . 166Remote Access feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167Trunk-to-trunk transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

Toll fraud investigation: disallow list information . . . . . . . . . . . . . . . . 170General information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170Standard disallow list entries . . . . . . . . . . . . . . . . . . . . . . . . . 170

Questions to ask the customer . . . . . . . . . . . . . . . . . . . . . . . . . . 172LEGEND/MAGIX toll fraud at a glance . . . . . . . . . . . . . . . . . . . . . . 172MERLIN Mail/MERLIN LEGEND Mail/MERLINmessaging toll fraud at a glance . . . . . . . . . . . . . . . . . . . . . . . . 174

LEGEND/MAGIX toll fraud check list . . . . . . . . . . . . . . . . . . . . . . . 174

Contents


MERLIN Plus Communications System . . . . . . . . . . . . . . . . . . . . . . . 184Protecting remote line access (R2 only) . . . . . . . . . . . . . . . . . . . . . 184

Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185Protecting remote call forwarding (R2 only) . . . . . . . . . . . . . . . . . . . 185

PARTNER II Communications System . . . . . . . . . . . . . . . . . . . . . . . . 186PARTNER Plus Communications System . . . . . . . . . . . . . . . . . . . . . . 187System 25 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187

Protecting remote access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188

Protecting remote system administration . . . . . . . . . . . . . . . . . . . . 189Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189

Chapter 7: Voice messaging systems . . . . . . . . . . . . . . . . . . . 191Protecting voice messaging systems . . . . . . . . . . . . . . . . . . . . . . . . 191

Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192Communication Manager, MultiVantage Software, DEFINITY ECS, DEFINITY communications systems, System 75,and System 85 194

Tools that prevent unauthorized calls . . . . . . . . . . . . . . . . . . . . . . 195Facility restriction levels . . . . . . . . . . . . . . . . . . . . . . . . . . . 195Station-to-trunk restrictions. . . . . . . . . . . . . . . . . . . . . . . . . . 196Class of restriction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196Class of service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196Toll analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197

Security measures in the PBX . . . . . . . . . . . . . . . . . . . . . . . . . . 197Limit voice mail to internal calling . . . . . . . . . . . . . . . . . . . . . . 197Restrict the outside calling area . . . . . . . . . . . . . . . . . . . . . . . 198Allow calling only to specified numbers . . . . . . . . . . . . . . . . . . . 199

Detecting voice mail fraud . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201Call detail recording and / station messagedetail recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201

Call Traffic report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203Trunk Group report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203SAT, Manager I, and G3-MT reporting . . . . . . . . . . . . . . . . . . . . 203ARS measurement selection . . . . . . . . . . . . . . . . . . . . . . . . . 203Automatic circuit assurance . . . . . . . . . . . . . . . . . . . . . . . . . 204Busy verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205

Protecting the AUDIX, DEFINITY AUDIX, andAvaya INTUITY voice mail systems . . . . . . . . . . . . . . . . . . . . . . . 205

Unauthorized system use . . . . . . . . . . . . . . . . . . . . . . . . . . . 205Traffic reports (AUDIX Voice Mail System only) . . . . . . . . . . . . . . . 207

Contents


Call detail recording (AUDIX Voice Mail System only) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208

Protecting passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210Security features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211Security measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217

Protecting the AUDIX Voice Power System . . . . . . . . . . . . . . . . . . . 218Traffic reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218Protecting passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218Security measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219

Protecting the CONVERSANT Voice InformationSystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220

Protecting passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221Security measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222

MERLIN II Communications System . . . . . . . . . . . . . . . . . . . . . . . . . 222Protecting the MERLIN MAIL Voice MessagingSystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

Protecting passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224

MERLIN LEGEND Communications System . . . . . . . . . . . . . . . . . . . . . 225Protecting the AUDIX Voice Power System . . . . . . . . . . . . . . . . . . . 226

Protecting passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227Security measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Protecting the INTUITY Voice Messaging System. . . . . . . . . . . . . . . . 228Protecting passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229Security measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

Protecting the MERLIN MAIL, MERLINMAIL-ML, MERLIN MAIL R3, and MERLINLEGEND Mail voice messaging systems . . . . . . . . . . . . . . . . . . . . 232

Protecting automated attendant . . . . . . . . . . . . . . . . . . . . . . . 233Protecting passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234Additional MERLIN MAIL R3 and MERLIN LEGEND Mail Voice Messaging System security features . . . . . . . . . . . . . . 236

Messaging 2000 System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237Maintaining Message 2000 system security . . . . . . . . . . . . . . . . . . . 237Security recommendations for remote access . . . . . . . . . . . . . . . . . 242

Contents


PARTNER II Communications System . . . . . . . . . . . . . . . . . . . . . . . . 242Protecting the PARTNER MAIL and PARTNERMAIL VS systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242


PARTNER Plus Communications System . . . . . . . . . . . . . . . . . . . . . . 244Protecting the PARTNER MAIL and PARTNERMAIL VS systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245


System 25 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247Protecting the AUDIX Voice Power System . . . . . . . . . . . . . . . . . . . 247

Protecting passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248Security measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248

Chapter 8: Automated attendant . . . . . . . . . . . . . . . . . . . . . . 251Communication Manager,MultiVantage Software, DEFINITYECS, DEFINITY communicationssystems, System 75, and System 85 . . . . . . . . . . . . . . . . . . . . . . . . 251

Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251Tools that prevent unauthorized calls . . . . . . . . . . . . . . . . . . . . . . 252

Facility restriction levels . . . . . . . . . . . . . . . . . . . . . . . . . . . 252Station-to-trunk restrictions. . . . . . . . . . . . . . . . . . . . . . . . . . 253Class of restriction (System 75, DEFINITY G1,and G3, Communication Manager,MultiVantage Software, DEFINITY ECS). . . . . . . . . . . . . . . . . . . 253

Class of service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253Toll analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

Security measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255Limit transfers to internal destinations. . . . . . . . . . . . . . . . . . . . 255Prevent calls to certain numbers . . . . . . . . . . . . . . . . . . . . . . . 256Allow calling to specified numbers . . . . . . . . . . . . . . . . . . . . . . 256

Detecting automated attendant toll fraud . . . . . . . . . . . . . . . . . . . . 258Call detail recording / station messagedetail recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 259

Call Traffic report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260Trunk Group report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260SAT, Manager I, and G3-MT reporting . . . . . . . . . . . . . . . . . . . . 260ARS measurement selection . . . . . . . . . . . . . . . . . . . . . . . . . 261Automatic circuit assurance . . . . . . . . . . . . . . . . . . . . . . . . . 261

Contents


Busy verification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263Call Traffic report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263Trunk Group report . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263Traffic reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263Call detail recording . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264Voice session record . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264Outgoing voice call detail record . . . . . . . . . . . . . . . . . . . . . . . 265

Protecting automated attendant on the AUDIX Voice Mail System . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266

Disallow outside calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266Protecting automated attendant on the AUDIXVoice Power System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Protecting automated attendant on theCONVERSANT Voice Information System . . . . . . . . . . . . . . . . . . . 268

Protecting automated attendant on theDEFINITY AUDIX System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

Protecting automated attendant on the Avaya INTUITY System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268

MERLIN II Communications System R3. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

MERLIN MAIL Voice Messaging System . . . . . . . . . . . . . . . . . . . . . 269MERLIN Attendant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269

MERLIN LEGEND Communications System . . . . . . . . . . . . . . . . . . . . . 269AUDIX Voice Power System. . . . . . . . . . . . . . . . . . . . . . . . . . . . 269MERLIN MAIL, MERLIN MAIL-ML, andMERLIN MAIL R3 voice messaging systems . . . . . . . . . . . . . . . . . . 270

MERLIN Attendant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270PARTNER II Communications System . . . . . . . . . . . . . . . . . . . . . . . . 270

PARTNER MAIL and PARTNER MAIL VS systems . . . . . . . . . . . . . . . 270PARTNER Attendant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

PARTNER Plus Communications System . . . . . . . . . . . . . . . . . . . . . . 271PARTNER MAIL and PARTNER MAIL VS systems . . . . . . . . . . . . . . . 271PARTNER Attendant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271

System 25 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272AUDIX Voice Power System. . . . . . . . . . . . . . . . . . . . . . . . . . . . 272

Chapter 9: Other products and services . . . . . . . . . . . . . . . . . . 273Call Management System (R3V4) . . . . . . . . . . . . . . . . . . . . . . . . . . . 273

Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273CMS helplines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274

Contents


CallMaster PC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

Multipoint Conferencing Unit(MCU)/Conference Reservation andControl System (CRCS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275

PassageWay Telephony Services forNetWare and Windows NT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 276

Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 277TransTalk 9000 Digital Wireless System . . . . . . . . . . . . . . . . . . . . . . . 280

Security tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 280

Chapter 10: Call routing. . . . . . . . . . . . . . . . . . . . . . . . . . . 281Call routing call flow. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281

Chapter 11: Blocking calls . . . . . . . . . . . . . . . . . . . . . . . . . 283Country codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283Blocking toll fraud destinations . . . . . . . . . . . . . . . . . . . . . . . . . . . 292

Blocking ARS calls on DEFINITY G1 and System 75 . . . . . . . . . . . . . . 293Blocking ARS calls on G2.1 and System 85 . . . . . . . . . . . . . . . . . . . 298Blocking WCR calls on DEFINITY G2.2. . . . . . . . . . . . . . . . . . . . . . 299Blocking ARS calls on G3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300Blocking ARS calls on System 25 R3V3 . . . . . . . . . . . . . . . . . . . . . 303

Chapter 12: Remote access example (Communication Manager, MultiVantage Software, DEFINITY ECS, DEFINITY G1, G3, and System 75) . . . . . . . . . . . . . . . . . . . . . . . . . . . 305

Setting up remote access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 305Permanently disabling remote access . . . . . . . . . . . . . . . . . . . . . . . . 307

Chapter 13: Administering features of theDEFINITY G3V3 and later . . . . . . . . . . . . . . . . . . . 309

Administering the SVN feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309Administering the login component . . . . . . . . . . . . . . . . . . . . . . . 310

Enable/disable a login ID . . . . . . . . . . . . . . . . . . . . . . . . . . . 311List the status of a login ID . . . . . . . . . . . . . . . . . . . . . . . . . . 311

Administering the barrier code security violationsparameters of the SVN feature . . . . . . . . . . . . . . . . . . . . . . . . . 312

Enable/disable remote access code . . . . . . . . . . . . . . . . . . . . . 313Administering the Remote Access Kill After N Attempts feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314

Contents


Administering the Login ID Kill After N Attempts feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315

Administering the authorization code component . . . . . . . . . . . . . . . 316Administering the station security code component . . . . . . . . . . . . . . 317

Administering barrier code aging . . . . . . . . . . . . . . . . . . . . . . . . . . 318Administering customer logins andforced password aging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320

Adding customer logins and assigning initialpassword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

Changing a login’s attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . 323Administering login command permissions . . . . . . . . . . . . . . . . . . . 324

Display a specified login . . . . . . . . . . . . . . . . . . . . . . . . . . . 325List logins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325Remove a login. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325

Administering the security violations reports . . . . . . . . . . . . . . . . . . . . 325

Chapter 14: Changing your password . . . . . . . . . . . . . . . . . . . 327AUDIX Voice Mail System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327AUDIX Voice Power System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327CONVERSANT Voice Information System . . . . . . . . . . . . . . . . . . . . . . 328DEFINITY AUDIX System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329Communication Manager, MultiVantage Software,DEFINITY ECS and DEFINITY G1 and G3 . . . . . . . . . . . . . . . . . . . . . . 330

DEFINITY G2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331Avaya INTUITY System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331MERLIN MAIL or MERLIN MAIL-MLVoice Messaging System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332

MERLIN MAIL R3, MERLIN LEGENDMail, or PARTNER MAIL R3 VoiceMessaging System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333

PARTNER MAIL System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334PARTNER MAIL VS System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 334System 25 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335System 75 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335System 85 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 336

Contents


Chapter 15: Toll fraud job aids . . . . . . . . . . . . . . . . . . . . . . . 337Toll fraud warning signs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 337System security action plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 339Ten tips to help prevent phone fraud. . . . . . . . . . . . . . . . . . . . . . . . . 340

Chapter 16: Special security product and service offers . . . . . . . . . 343Remote port security device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343

Key and lock features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344Securing DEFINITY Systems (prior to Release 7.2)with the remote port security device . . . . . . . . . . . . . . . . . . . . . . 345

Avaya support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 345Securing DEFINITY systems (Release 7.2 and Later) with AccessSecurity Gateway. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346

Administering the Access Security Gateway . . . . . . . . . . . . . . . . . . 347Logging in via Access Security Gateway (session establishment) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 347

Maintaining login IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348Temporarily disabling Access Security Gatewayaccess for login. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348

Restarting temporarily disabled ASG access for login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349

Maintaining the ASG history log . . . . . . . . . . . . . . . . . . . . . . . . . 349Loss of an ASG key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349Interactions of ASG . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350Securing INTUITY AUDIX ports (Release 5.0 and later) with ASG. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350

Logging in with ASG. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351Maintaining login IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352

Adding an ASG login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352Blocking or reinstating access privileges for anASG login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353

Changing the encryption key number for anASG login . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353

Displaying ASG login information . . . . . . . . . . . . . . . . . . . . . . 354Disabling ASG authentication. . . . . . . . . . . . . . . . . . . . . . . . . 354

Setting and resolving violation warnings . . . . . . . . . . . . . . . . . . . . 354Setting notification limits . . . . . . . . . . . . . . . . . . . . . . . . . . . 354Resolving ASG violation alarms . . . . . . . . . . . . . . . . . . . . . . . 355

Avaya support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356HackerTracker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356

Contents


Security Tune-Up Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 356Toll fraud contact list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 357

Chapter 17: Product security checklists . . . . . . . . . . . . . . . . . . 359General security procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360AUDIX, DEFINITY AUDIX andINTUITY AUDIX voice messaging systems . . . . . . . . . . . . . . . . . . . . . 363

AUDIX Voice Power System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365BasicWorks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367CONVERSANT Voice Information System . . . . . . . . . . . . . . . . . . . . . . 372Communication Manager, MultiVantage Software, DEFINITY ECS, DEFINITY G1 and G3, and System 75 . . . . . . . . . . . . . . . 374

DEFINITY G2 and System 85 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381DIMENSION PBX System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385MERLIN II Communications System . . . . . . . . . . . . . . . . . . . . . . . . . 388MERLIN LEGEND Communications System . . . . . . . . . . . . . . . . . . . . . 390MERLIN MAIL Voice Messaging System . . . . . . . . . . . . . . . . . . . . . . . 393MERLIN MAIL-ML Voice Messaging System . . . . . . . . . . . . . . . . . . . . . 395MERLIN MAIL R3 Voice Messaging System . . . . . . . . . . . . . . . . . . . . . 397MERLIN Plus Communications System . . . . . . . . . . . . . . . . . . . . . . . 400Messaging 2000 Voice Mail System . . . . . . . . . . . . . . . . . . . . . . . . . 401Multimedia Communications Exchange Server . . . . . . . . . . . . . . . . . . . 406Multipoint Conferencing Unit/Conference Reservation andControl System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407

ESM security checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409CRCS Security Checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411MSM security checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413

PARTNER, PARTNER II, and PARTNER Plus communications systems, and PARTNER Advanced Communications System (ACS) . . . . . . . . . . . . . . . . . . . . . . . . . . . 418

PARTNER MAIL, PARTNER MAIL VS, and PARTNER Voice Mail (PVM) systems . . . . . . . . . . . . . . . . . . . . . . . . 423

System 25 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425PassageWay Telephony Services. . . . . . . . . . . . . . . . . . . . . . . . . . . 428

Contents


Chapter 18: Large business communicationssystems security tools by release . . . . . . . . . . . . . . 433

Chapter 19: Non-supported products . . . . . . . . . . . . . . . . . . . 445As of December 31, 2002 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445As of December 31, 2001 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445As of December 31, 2000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445As of September 30, 2000 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446As of December 31, 1999 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446

Chapter 20: Links to additional security information . . . . . . . . . . . 447About IP and network security . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447Avaya products to enhance security . . . . . . . . . . . . . . . . . . . . . . . . . 447White papers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 447Books and articles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448Web sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448

Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461

Contents



Chapter 1: About this document

OverviewThis handbook discusses security risks and measures that can help prevent external telecommunications fraud involving the following Avaya products:

IP and IP-enabled servers:

● Avaya S8100, S8300, and S8700 Media Servers

● DEFINITY® Enterprise Communications Server (ECS) Release 5 and later

PBX systems:● DEFINITY® Generic 1, 2, and 3 communications systems

● MERLIN® II Communications System

● MERLIN LEGEND® Communications System

● MERLIN® Plus Communications System

● PARTNER® II Communications System

● PARTNER® Plus Communications System

● System 25 Communications System

● System 75 (R1V1, R1V2, R1V3)

● System 85 (R1, R2V2, R2V3, R2V4)

Voice processing systems:

● AUDIX® Voice Mail System

● AUDIX® Voice Power® System

● CONVERSANT® Voice Information System

● DEFINITY® AUDIX® System

● INTUITY™ AUDIX® Voice Messaging System

● INTUITY™ CONVERSANT® Voice Information System

● MERLIN MAIL® Voice Messaging System

● MERLIN MAIL®-ML Voice Messaging System

● MERLIN MAIL® R3 Voice Messaging System

● PARTNER MAIL® System

● PARTNER MAIL VS® System

About this document


Other products and services:

● Call Management System (R3V2)

● CallMaster® PC

● Multipoint Conferencing Unit (MCU)

● PassageWay® Telecommunications Interface

● TransTalk™ 9000 Digital Wireless System

● Telephony Services for Netware®

Note:Note: Unless specifically stated otherwise, references in this document to “G3Vx and

later” include the specified DEFINITY G3 (and more recent) versions, DEFINITY ECS, MultiVantage™ Software, and Communication Manager.

Note:Note: Although the Avaya S8100, S8300, and S8700 Media Servers are not covered

explicitly in this handbook, the information supplied for DEFINITY ECS applies to these media servers as well.

Note:Note: Although the DIMENSION® Call Management System is not covered explicitly in

this handbook, the information supplied for System 85 Release 2 applies to the DIMENSION PBX System as well.

Note:Note: This document describes switch features and how they are related to security. It

is not designed to fully describe the capabilities of each feature. For further details about all the security features and their interactions with other system features, refer to the appropriate system manual for your telecommunications system. (See Related documentation in this chapter for titles and document numbers.)

Reason for reissueThis issue, Issue 10 of the Avaya™ Toll Fraud and Security Handbook, continues to focus this document on toll fraud and related security issues. This update includes additional links to security related white papers. See Chapter 20: Links to additional security information.

Minor edits and other additions have also been included in this issue.

Intended audience


Intended audienceTelecommunications managers, console operators, and security organizations within a company should be aware of the information in Chapters 1, 2, and 3. Chapter 4 introduces more technical information and is directed at people responsible for implementing and administering the security aspects of systems.

Chapters 10 through 13 expand upon technical information in the handbook and are intended for use by the system administrator. Chapters 13, 15, 16, and 18 have application throughout the organization. Chapter 16 is specifically intended for telecommunications management personnel with responsibilities for implementing a security policy.

How this guide is organizedThe Avaya™ Toll Fraud and Security Handbook has the following chapters:

Chapter 1: About this document

Describes the scope, intended audience, and contents of this handbook. Contains Avaya’s Statement of Direction. Also defines Avaya’s and the customer’s roles and responsibilities.

Chapter 2: Introduction

Provides a background for toll fraud.

Chapter 3: IP security Provides a summary of toll fraud security issues that are introduced in a converged voice and data network environment.

Chapter 4: Security risks

Discusses the major areas in which customer premises equipment-based systems are vulnerable, and introduces available security measures.

Chapter 5: Large business communications systems

Provides information on protecting the DEFINITY ECS Release 5 and later, DEFINITY Communications System Generic 1, Generic 2, and Generic 3, System 75, and System 85. Details how Remote Access is vulnerable to toll fraud, explains numerous system security features, and provides detailed procedures.

About this document


Chapter 6: Small business communications systems

Provides information on protecting the MERLIN II, MERLIN LEGEND, MERLIN Plus, PARTNER II, PARTNER Plus, and System 25 communications systems. Details product features that are vulnerable to toll fraud, such as Remote Access and Remote Call Forwarding, and recommends security measures.

Chapter 7: Voice messaging systems

Provides information on protecting voice messaging systems. Explains the tools available and recommends security measures.

Chapter 8: Automated attendant

Provides information on protecting automated attendant systems. Explains the features available and recommends security measures.

Chapter 9: Other products and services

Provides information to protect other Avaya products and services from toll fraud.

Chapter 10: Call routing

Details call flow through a customer premises equipment-based system.

Chapter 11: Blocking calls

Provides procedures for blocking calls to common toll fraud destinations.

Chapter 12: Remote access example (Communication Manager, MultiVantage Software, DEFINITY ECS, DEFINITY G1, G3, and System 75):

Offers an example of how to set up Remote Access and an example of how to disable it.

Chapter 13: Administering features of the DEFINITY G3V3 and later

Provides information on administering features available in DEFINITY Releases G3V3 and later, including the DEFINITY ECS Release 5 and 6.

Chapter 14: Changing your password

Tells how to change passwords for systems in the handbook.

Chapter 15: Toll fraud job aids

Provides job aids to help prevent toll fraud.

Chapter 16: Special security product and service offers

Details special product and service offers and provides a toll fraud contact list.

Chapter 17: Product security checklists

Lists the available security features and tips by product.

Avaya’s statement of direction


Avaya’s statement of directionThe telecommunications industry is faced with a significant and growing problem of theft of customer services. To aid in combating these crimes, Avaya intends to strengthen relationships with its customers and its support of law enforcement officials in apprehending and successfully prosecuting those responsible.

No telecommunications system can be entirely free from the risk of unauthorized use. However, diligent attention to system management and to security can reduce that risk considerably. Often, a trade-off is required between reduced risk and ease of use and flexibility. Customers who use and administer their systems make this trade-off decision. They know how to best tailor the system to meet their unique needs and, necessarily, are in the best position to protect the system from unauthorized use. Because the customer has ultimate control over the configuration and use of Avaya services and products it purchases, the customer properly bears responsibility for fraudulent uses of those services and products.

To help customers use and manage their systems in light of the trade-off decisions they make and to ensure the greatest security possible, Avaya commits to the following:

● Avaya products and services will offer the widest range of options available in the industry to help customers secure their communications systems in ways consistent with their telecommunications needs. Our products include industry-standard encryption (DES and 3DES) and data-integrity algorithms reconized by FIPS 140-2 11.

● Avaya is committed to developing and offering services that, for a fee, reduce or eliminate customer liability for PBX toll fraud, provided the customer implements prescribed security requirements in its telecommunications systems.

● Avaya’s product and service literature, marketing information and contractual documents will address, wherever practical, the security features of our offerings and their limitations, and the responsibility our customers have for preventing fraudulent use of their Avaya products and services.

Chapter 18: Large business communications systems security tools by release

Details security tools referenced in this guide, for the System 75, System 85, DEFINITY ECS, and DEFINITY communications systems by release.

Chapter 19: Non-supported products

Lists the non-supported products.

Chapter 20: Links to additional security information

Provides links to additional information sources for security issues.

About this document


● Avaya sales and service people will be the best informed in the industry on how to help customers manage their systems securely. In their continuing contact with customers, they will provide the latest information on how to do that most effectively.

● Avaya will train its sales, installation and maintenance, and technical support people to focus customers on known toll fraud risks; to describe mechanisms that reduce those risks; to discuss the trade-offs between enhanced security and diminished ease of use and flexibility; and to ensure that customers understand their role in the decision-making process and their corresponding financial responsibility for fraudulent use of their telecommunications system.

● Avaya will provide education programs for internal and external customers to keep them apprised of emerging technologies, trends, and options in the area of telecommunications fraud.

● As new fraudulent schemes develop, Avaya will promptly initiate ways to impede those schemes, share our learning with our customers, and work with law enforcement officials to identify and prosecute fraudulent users whenever possible.

We are committed to meeting and exceeding our customers’ expectations, and to providing services and products that are easy to use and high in value. This fundamental principle drives Avaya’s renewed assault on the fraudulent use by third parties of our customers’ communications services and products.

Avaya/customer security roles and responsibilities

The purchase of a telecommunications system is a complicated process involving many phases, including system selection, design, ordering, implementation, and assurance testing. Throughout these phases customers, vendors, and their agents each have specific roles and responsibilities. Insuring that systems are designed, ordered, installed, and maintained in a secure fashion is a responsibility each organization must understand.

Avaya, seeking to be our customers’ Partner of Choice, clearly defined its mission in this area in a Statement of Direction issued in May, 1992. (See the preceding section.) More specifically, Avaya recognized four areas where we or our agents have specific responsibilities to our customers. These areas, and our responsibilities in each area, are detailed in the next section, Avaya’s roles and responsibilities.

Avaya/customer security roles and responsibilities


In addition, customers have specific responsibilities to ensure the system they are installing is as secure as their requirements dictate. The following quote is from A Cooperative Solution to the Fraud that Targets Telecom Systems, a position paper developed by the Toll Fraud Prevention Committee (TFPC) of the Alliance for Telecommunications Industry Solutions:

“It is necessary to stress that the business owner, the owner or lessee of the CPE [Customer Premises Equipment], has the primary and paramount care, custody, and control of the CPE. The owner has the responsibility to protect this asset, the telecommunications system equally as well as other financial assets of the business.”

This document attempts to define industry standards for the roles and responsibilities of the various organizations involved in a system implementation. Portions of this document are applicable to this document and are quoted throughout. Customers interested in the entire document can receive copies by contacting:

Alliance for Telecommunications Industry Solu

avaya toll fraud and security handbook · 2008. 2. 14. · avaya toll fraud and security handbook...

Documents