Lucent Technologies BCS Products Security Handbook

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-45 Detecting Toll Fraud 
3
NOTE:
Whenever possible, TAC calls should be disallowed. See ‘‘Disable 
Direct Access to Trunks’’ on page 3-35.
For DEFINITY G2.2:
nDo not turn on overlapped sending (default is off in G2.2, on in earlier 
releases). To turn off overlapped sending, enter PROC103 WORD1 
FIELD14. Overlapped sending bypasses digit checking.
nTo force waiting for a TCM, the trunk group...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-46 Detecting Toll Fraud 
3
nAttendants report frequent “no one there” or “sorry, wrong number” calls
nBill shows calls were made to strange places
NOTE:
If you should suspect toll fraud in your system, you may call one of the 
numbers in the “Toll Fraud Contact List” in Appendix G in the back of this 
manual.
Table 3-4
 shows the reports and monitoring techniques that track system activity...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-47 Detecting Toll Fraud 
3
Administration Security
Logins for INADS Port
For DEFINITY G3V4 and later, which includes DEFINITY ECS, only Lucent 
Technologies logins can access the INADS port. If the customer wants INADS 
access, Lucent Technologies must administer customer login permission.
This permission is administered on a login basis. Lucent Technologies is 
responsible for performing the...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-48 Detecting Toll Fraud 
3
On upgrades to the DEFINITY G3V3 or later, which includes DEFINITY ECS, 
customer logins and passwords are carried forward. Password aging is set to one 
day, and customers must customize their logins/passwords following upgrades.
Login permissions for a specified login can be set by the superuser to block any 
object that can affect the health of the switch. Up to...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-49 Detecting Toll Fraud 
3
NOTE:
Only the last extension on the call is reported. Unauthorized users who are 
aware of this procedure originate calls on one extension, then transfer to 
another extension before terminating the call. Internal toll abusers may 
transfer unauthorized calls to another extension before they disconnect so 
that CDR does not track the originating station. If the...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-50 Detecting Toll Fraud 
3
nA series of short or long holding times that may indicate repeated attempts 
to enter the system and/or success in doing so
nHigh volume on WCR patterns used for   + and       + calls
nBusiest hour for trunk group being inconsistent with business hours
nDrastic changes in switch occupancy profile compared to a typical 24-hour 
period
Monitor I
For DEFINITY G2 and...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-51 Detecting Toll Fraud 
3
ARS Measurement Selection
The ARS Measurement Selection feature can monitor up to 20 routing patterns 
(25 for DEFINITY ECS and DEFINITY G3) for traffic flow and usage.
For DEFINITY ECS, DEFINITY G1, G3, and System 75:
nEnter change ars meas-selection to choose the routing patterns you want 
to track.
nEnter list measurements route-pattern followed by the timeframe...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-52 Detecting Toll Fraud 
3
nTo review and verify the entries, enter list aca-parameters.
nEnter change trunk group to display the Trunk Group screen.
nEnter y in the ACA Assignment field.
nEstablish short and long holding times. The defaults are 10 seconds (short 
holding time) and one hour (long holding time).
nTo review an audit trail of the ACA referral call activity, enter list...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-53 Detecting Toll Fraud 
3
nIn the Measured field, enter external if you have only CMS or both if you 
have BCMS and CMS.
nTo generate reports, use cms reports.
For DEFINITY G2:
nUse PROC115 WORD1 FIELD5 to specify incoming or two-way 
measurements by CMS.
nSet up time limits and count thresholds on CMS (Trunk Group Exceptions). 
Exceptions are reported to designated CMS terminals (User...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-54 Detecting Toll Fraud 
3
attempted violation. The monitor security-violations command displays the 
login activity in real-time on either Remote Access or System Management ports.
Information about invalid system management login attempts and remote access 
attempts (and, for G3V3 or later, including DEFINITY ECS), invalid authorization 
code attempts) is collected at two levels:
nOn an...