AT&T MERLIN LEGEND Release 3.1 Maintenance And Troubleshooting Manual page 263

Customer Support Information
n
If Outcalling is allowed to long distance numbers, build an Allowed
List for the voice mail port extension(s) used for Outcalling. This list
should contain the area code and the first three digits of the local
exchange telephone numbers to be allowed.
Additional general security for voice messaging systems:
n
Use a secure password for the General Mailboxes.
n
The default administration mailbox, 9997, must be reassigned to
the system manager's mailbox/extension number and securely
password protected.
n
All voice messaging system users must use secure passwords
known only to the user.
Security Risks Associated with the
Automated Attendant Feature of voice
messaging systems
Two areas of toll fraud risk associated with the Automated Attendant
feature of voice messaging systems are the following:
n
Pooled facility (line/trunk) access codes are translated to a menu
prompt to allow Remote Access. If a hacker finds this prompt, the
hacker has immediate access. (In Release 3.1 and later systems,
dial access to pools is initially factory-set to restrict all extensions:
to allow pool access, this restriction must be removed by the
system manager.
Maintenance and Troubleshooting
A–19