Avaya MERLIN MAGIX Maintenance And Troubleshooting Manual page 195

Maintenance and Troubleshooting
If Outcalling is required by voice messaging system extensions:
Program an ARS Facility Restriction Level (FRL) of 2 on voice mail port extensions used for
I
Outcalling.
If 800 and 411 numbers are used, remove 1800, 800, 411, and 1411 from Disallowed List
I
number 7.
If Outcalling is allowed to long-distance numbers, build an Allowed List for the voice mail port
I
extensions used for Outcalling. This list should contain the area code and the first three digits
of the local exchange telephone numbers to be allowed.
Additional general security for voice messaging systems:
Use a secure password for the General Mailboxes.
I
The default administration mailbox, 9997, must be reassigned to the System Manager's
I
mailbox/extension number and securely password protected.
All voice messaging system users must use secure passwords known only to the user.
I
Security Risks Associated with the Automated
Attendant Feature of Voice Messaging Systems
Two areas of toll fraud risk associated with the Automated Attendant feature of voice messaging
systems are:
Pooled facility (line/trunk) access codes are translated to a menu prompt to allow Remote
I
Access. If a hacker finds this prompt, the hacker has immediate access. (Dial access to pools
is initially factory-set to restrict all extensions: to allow pool access, this restriction must be
removed by the System Manager.)
If the Automated Attendant prompts callers to use Remote Call Forwarding (RCF) to reach an
I
outside telephone number, the system may be susceptible to toll fraud. An example of this
application is a menu or submenu that says, "To reach our answering service, select prompt
number 5," and transfers a caller to an external telephone number.
Remote Call Forwarding can be used securely only when the Central Office provides "reliable
disconnect" (sometimes referred to as forward disconnect or disconnect supervision), which
guarantees that the Central Office does not return a dial tone after the called party hangs up.
In most cases, the Central Office facility is a loop-start line/trunk which does not provide
reliable disconnect. When loop-start lines/trunks are used, if the calling party stays on the line,
the Central Office does return a dial tone at the conclusion of the call, enabling the caller to
place another call as if it were being placed from your company. Ground-start trunks provide
reliable disconnect and should be used whenever possible.
Toll Fraud Prevention
A-12
6