Toll Fraud Prevention; Physical Security, Social Engineering, And General Security Measures - Lucent Technologies MERLIN LEGEND Release 5.0 System Planning Manual

MERLIN LEGEND Communications System Release 5.0
System Planning 555-650-112
A Customer Support Information

Toll Fraud Prevention

Toll Fraud Prevention
Toll fraud is the unauthorized use of your telecommunications system by third
parties to make long-distance telephone calls. Under the law, you, the customer,
are responsible for paying part or all of those unauthorized calls. Thus, the
following information is of critical importance.
Unauthorized persons concentrate their activities in two areas with the MERLIN
LEGEND Communications System:
They try to transfer out of the MERLIN LEGEND Communications System
to gain access to an outgoing trunk and make long-distance calls.
They try to locate unused or unprotected mailboxes and use them as
drop-off points for their own messages.
The following is a discussion of how toll fraud is often perpetrated and ways to
prevent unauthorized access that can lead to toll fraud.
Physical Security, Social Engineering, and
General Security Measures
Criminals called hackers may attempt to gain unauthorized access to your
communications system and voice messaging system in order to use the system
features. Hackers often attempt to trick employees into providing them with
access to a network facility (line/trunk) or a network operator. This is referred to as
social engineering. Hackers may pose as telephone company employees and
employees of Lucent Technologies or your authorized dealer. Hackers will go
through a company's trash to find directories, dialing instructions, and other
information that will enable them to break into the system. The more
knowledgeable they appear to be about the employee names, departments,
telephone numbers, and the internal procedures of your company, the more likely
it is that they will be able to trick an employee into helping them.
Preventive Measures
Take the following preventive measures to limit the risk of unauthorized access by
hackers:
Provide good physical security for the room containing your
telecommunications equipment and the room with administrative tools,
records, and system manager information. These areas should be locked
when not attended.
Provide a secure trash disposal for all sensitive information, including
telephone directories, call accounting records, or anything that may supply
information about your communications system. This trash should be
shredded.
1
1
1
Issue 1
June 1997
Page A-11