Lucent Technologies MERLIN LEGEND Release 6.1 System Manager's Manual page 396

MERLIN LEGEND Communications System Release 6.1
System Manager's Guide 555-661-118
A Customer Support Information
Other Security Hints
Establish well-controlled procedures for resetting passwords.
Limit the number of invalid attempts to access a voice mailbox to five or
less.
Monitor access to the MERLIN LEGEND Communications System dial-up
maintenance port. Change the access password regularly and issue it only
to authorized personnel. Disconnect the maintenance port when not in use.
(However, this eliminates Lucent Technologies' 24-hour maintenance
surveillance capability and may result in additional maintenance costs.)
Create a communications system management policy concerning
employee turnover and include these suggestions:
— Delete all unused voice mailboxes in the voice mail system.
— If a terminated employee had Remote Access calling privileges and a
— If barrier codes and/or authorization codes were shared by the
Regularly back up your MERLIN LEGEND Communications System files to
ensure a timely recovery should it be required. Schedule regular, off-site
backups.
Keep the Remote Maintenance Device turned off when not in use by
Lucent Technologies or your authorized dealer.
Limit transfers to registered subscribers only.
Use the Security Violations Notification options (Mailbox Lock or Warning
Message) to alert you of any mailbox break-in attempts. Investigate all
incidents.
Review security policies and procedures and keep them up to date.
Choosing Passwords
Passwords should be the maximum length allowed by the system.
Passwords should be hard to guess and should not contain:
All the same numbers (for example, 1111, 666666)
Sequential characters (for example 123456)
Numbers that can be associated with you or your business, such as your
name, birthday, business name, business address, telephone number, or
social security number
Words and commonly used names
Passwords should be changed regularly, at least on a quarterly basis. Recycling
old passwords is not recommended. Never program passwords (or authorization
codes or barrier codes) onto a speed dial button.
personal authorization code, remove the authorization code
immediately.
terminated employee, these should be changed immediately.
1
Issue 1
August 1998
Page A-17