Instruction manual

PassageWay Telephony Services for NetWare and
Windows NT
Issue 9 May 2003
9-7
■ PassageWay Telephony Server administrators should be aware of switch
COS and COR assignments and should not define device groups that
allow applications to use third party call control to originate from an
unrestricted phone and then transfer the call to a restricted phone. Such
programs might also act as agents for setting up trunk-to-trunk calls (where
permitted by the PBX) from phones other than the requesting user’s phone.
■ Since a user with PassageWay Telephony Server administration privileges
can open an administrative door to toll fraud just as a Communication
Manager, MultiVantage™ Software, DEFINITY ECS or MERLIN LEGEND
administrator can, protect administrative privileges for the PassageWay
Telephony Server as closely as switch administrative restrictions.
■ PassageWay Telephony Server administration permissions should be
given only to a small number of trusted users since a user with
administration privileges may grant other users full administration
privileges. Only give users the privileges they need.
■ Any PBX used in a development environment should not be connected to
the public network (or networked with general use PBXs) since
development environments may be informal, minimally protected
environments.
■ Exercise caution when using pcANYWHERE. PassageWay Telephony
Services technical staff use this tool to diagnose and maintain their
products on the customer premises. Simply having pcANYWHERE
installed on a PC does not pose a security risk; it must be up and running
and administered to receive calls. In addition, pcANYWHERE offers a
number of security features. General tips for protecting the PassageWay
product at the customer site when pcANYWHERE is used include the
following:
— Only run pcANYWHERE as necessary.
— Do not publish the phone number for the modem.
— Use the return call option with Avaya phone number. (Do not set up
pcANYWHERE without the callback option.)
— For added security, unplug the phone jack from the modem when
pcANYWHERE is not in use.
— Change your password after services leaves and after remote
access.
— Configure the following security options:
■ Require login names for callers.
■ Make passwords case-sensitive.
■ Log all failed connection attempts.