Lucent Technologies MERLIN LEGEND Release 6.1 Maintenance And Troubleshooting Manual page 343

MERLIN LEGEND Communications System Release 6.1
Maintenance and Troubleshooting 555-661-140
Toll Fraud Prevention
Program an ARS Facility Restriction Level (FRL) of 2 on voice mail port
extension(s) used for Outcalling. This allows calls to use the default local
ARS table that is defaulted to an FRL of 2 and any other ARS routes with
an FRL of 2 or less.
If 800 and 411 numbers are used, remove 1800, 800, 411, and 1411
from Disallowed List (number 7).
If Outcalling is allowed to long distance numbers, build an Allowed List
for the voice mail port extension(s) used for Outcalling. This list should
contain the area code and the first three digits of the local exchange
telephone numbers to be allowed.
In a private network, if your switch is outcalling only to non-local private
network extensions, program the VMI ports with an FRL of 2.
Additional general security recommended for voice messaging systems:
Use a secure password for the General Mailboxes.
The default administration mailbox, 9997, must be reassigned to the
system manager's mailbox/extension number and securely password
protected.
All voice messaging system users must use secure passwords known
only to the user.
Security Risks Associated with the
Automated Attendant Feature of Voice
Messaging Systems
Two areas of toll fraud risk associated with the Automated Attendant feature of
voice messaging systems are the following:
Pooled facility (line/trunk) access codes are translated to a menu
prompt to allow Remote Access. If a hacker finds this prompt, the
hacker has immediate access. (In Release 3.1 and later systems, dial
access to pools is initially factory-set to restrict all extensions: to allow
pool access, this restriction must be removed by the system manager.)
Issue 1
August 1998
Page A-17