Avaya MERLIN MAGIX Maintenance And Troubleshooting Manual page 199

Maintenance and Troubleshooting
Change passwords frequently (at least quarterly). Changing passwords routinely on a specific
I
date (such as the first of the month) helps users to remember to do so.
Always use the longest-length password allowed.
I
Establish well-controlled procedures for resetting passwords.
I
Limit the number of invalid attempts to access a voice mailbox to five or less.
I
Monitor access to the MERLIN MAGIX Integrated System dial-up maintenance port. Change
I
the access password regularly and issue it only to authorized personnel. Disconnect the
maintenance port when not in use. (This however, eliminates Avaya's 24-hour maintenance
surveillance capability and may result in additional maintenance costs.)
Create a communications system management policy concerning employee turnover and
I
include these suggestions:
– Delete all unused voice mailboxes in the voice mail system.
– If a terminated employee had Remote Access calling privileges and a personal
authorization code, remove the authorization code immediately.
– If barrier codes and/or authorization codes were shared by the terminated employee,
these should be changed immediately.
Regularly back up your MERLIN MAGIX Integrated System files to ensure a timely recovery
I
should it be required. Schedule regular, off-site backups.
Keep the Remote Maintenance Device turned off when not in use by Avaya or your authorized
I
dealer.
Limit transfers to registered subscribers only.
I
Use the Security Violations Notification options (Mailbox Lock or Warning Message) to alert
I
you of any mailbox break-in attempts. Investigate all incidents.
Review security policies and procedures and keep them up to date.
I
Choosing Passwords
Passwords should be the maximum length allowed by the system.
Passwords should be hard to guess and should not contain:
All the same numbers (for example, 1111, 666666)
I
Sequential characters (for example, 123456)
I
Numbers that can be associated with you or your business, such as your name, birthday,
I
business name, business address, telephone number, or social security number
Words and commonly used names
I
Passwords should be changed regularly–at least on a quarterly basis. Recycling old passwords is
not recommended. Never program passwords (or authorization codes or barrier codes) onto a
speed dial button.
Other Security Hints
A-16
6