Instruction manual

General security measures
Issue 9 May 2003
4-9
Establishing a policy
As a safeguard against toll fraud, follow these guidelines:
■ Change passwords frequently (at least quarterly). Set password expiration
times and tell users when the changes go into effect. Changing passwords
routinely on a specific date (such as the first of the month) helps users to
remember to do so.
■ Establish well-controlled procedures for resetting passwords.
■ Limit the number of invalid attempts to access a voice mail to five or less.
■ Monitor access to the dial-up maintenance port. Change the access
password regularly and issue it only to authorized personnel. Consider
using the Remote Port Security Device. (Refer to Chapter 16
for additional
information.)
■ Create a PBX system management policy concerning employee turnover
and include these actions:
— Delete all unused voice mailboxes in the voice mail system.
— If an employee is terminated, immediately delete any voice
mailboxes belonging to that employee.
— If a terminated employee had remote access calling privileges and a
personal authorization code, remove the authorization code
immediately.
— If barrier codes and/or authorization codes were shared by the
terminated employee, these should be changed immediately. Notify
the remaining users as well.
— If the terminated employee had access to the system administration
interface, their login ID should be removed (G3V3 or later). Any
associated passwords should be changed immediately.
■ Back up system files regularly to ensure a timely recovery should it be
required. Schedule regular, off-site backups.
Physical security
You should always limit access to the system console and supporting
documentation. The following are some recommendations:
■ Keep the attendant console and supporting documentation in an office that
is secured with a changeable combination lock. Provide the combination
only to those individuals having a real need to enter the office.
■ Keep telephone wiring closets and equipment rooms locked.
■ Keep telephone logs and printed reports in locations that only authorized
personnel can enter.
■ Design distributed reports so they do not reveal password or trunk access
code information.