Technical information

PassageWay® Telephony Services for NetWare® and
Windows NT®
Issue 7 June 2001
8-7
 PassageWay Telephony Server administrators should be aware of switch
Class of Service (COS) and Class of Restriction (COR) assignments and
should not define Device Groups that allow applications to use Third party
call control to originate from an unrestricted phone and then transfer the
call to a restricted phone. Such programs might also act as agents for
setting up trunk to trunk calls (where permitted by the PBX) from phones
other than the requesting user’s phone.
 Since a user with PassageWay Telephony Server administration privileges
can open an administrative door to toll fraud just as a DEFINITY ECS or
MERLIN LEGEND administrator can, protect administrative privileges for
the PassageWay Telephony Server as closely as switch administrative
restrictions.
 PassageWay Telephony Server Administration permissions should be
given only to a small number of trusted users since a user with
administration privileges may grant other users full administration
privileges. Only give users the privileges they need.
 Any PBX used in a development environment should not be connected to
the public network (or networked with general use PBXs) since
development environments may be informal, minimally protected
environments.
 Exercise caution when using pcANYWHERE. PassageWay Telephony
Services technical staff use this tool to diagnose and maintain their
products on the customer premises. Simply having pcANYWHERE
installed on a PC does not pose a security risk; it must be up and running
and administered to receive calls. In addition, pcANYWHERE offers a
number of security features. General tips for protecting the PassageWay
product at the customer site when pcANYWHERE is used include the
following:
— Only run pcANYWHERE as necessary
— Do not publish the phone number for the modem.
— Use the return call option with Avaya phone number. (Do not set up
pcANYWHERE without the callback option.)
— For added security, unplug the phone jack from the modem when
pcANYWHERE is not in use.
— Change your password after services leaves and after remote
access.
— Configure the following security options:
 Require login names for callers
 Make passwords case sensitive
 Log all failed connection attempts