Instruction manual

Small business communications systems
6-12 Issue 9 May 2003
Protecting the Remote Access feature
The Remote Access feature allows users to call into the MERLIN LEGEND
Communications System from a remote location (for example, a satellite office, or
while traveling) and use the system to make calls. However, unauthorized
persons might learn the remote access telephone number and password, call into
the system, and make long distance calls.
For MERLIN LEGEND R3.1 and later systems, system passwords, called barrier
codes, are by default restricted from making outside calls. In MERLIN LEGEND
releases prior to Release 3.0, if you do not program specific outward calling
restrictions, the user is able to place any call normally dialed from a telephone
associated with the system. Such an off-premises network call is originated at,
and will be billed from, the system location.
The MERLIN LEGEND Communications System has 16 barrier codes for use with
remote access. For systems prior to MERLIN LEGEND R3, barrier codes have a
5-digit maximum; for R3 systems and later, barrier codes have an 11-digit
maximum. For greater security, always use the maximum available digits when
assigning barrier codes.
Beginning with MERLIN LEGEND R3.0, the following rules on barrier codes have
been included in order to prevent telephone toll fraud:
— The remote access default requires a barrier code
— The barrier code is a flexible-length code ranging from 4 to 11 digits
(with a default of 7) and includes the * character. The length is set
system-wide.
— The user is given three attempts to enter the correct barrier code
The following security measures assist you in managing the Remote Access
feature to help prevent unauthorized use.
Security tips
■ Evaluate the necessity for remote access. If this feature is not vital to your
organization, consider not using it or limiting its use.
■ To turn off the Remote Access feature:
1. On the System Administration screen, select
Lines and Trunks
and then select
Remote Access.
2. Choose
Disable Remote Access.
If you need the feature, use as many of the security measures presented in
this section as you can.