Lucent Technologies BCS Products Security Handbook

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-55 Detecting Toll Fraud 
3
nFor Remote Access, enter the number of attempts allowed before a 
violation occurs in the Barrier Code Threshold field, and enter the time 
interval in hours or minutes for tracking the number of attempts.
nFor logins, enter the number of login attempts before a violation occurs in 
the Login Threshold field and the time interval in hours or minutes for 
tracking...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-56 Detecting Toll Fraud 
3
DEFINITY G3V4 offers an additional feature: 
nThe status remote access command provides information on the state of 
remote access. Valid states are 
enabled, disabled, svn-disabled, or 
not-administered. Valid barrier code states include active and expired.
For information on administering these parts of the Security Violation Notification 
Feature, see Appendix...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-57 Detecting Toll Fraud 
3
nTrunk (other than remote access)
nRemote Access
nAttendant
— Port Type: The type of port used by the measured login process. If 
break-ins are occurring at this level, the offender may have access to your 
system administration. With DEFINITY Release 5r, port types can be:
nSYSAM-LCL (SYSAM Local Port)
nSYSAM-RMT (SYSAM Remote Port)
nMAINT
nSYS-PORT (System Ports)...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-58 Detecting Toll Fraud 
3
nMAIN
nSYS-PORT (System Ports)
nMGR1
nINADS (The Initialization and Administration System port)
nEPN (The EPN maintenance EIA port)
nNET
— Successful Logins: The total number of times a login was used 
successfully to log into the system for the given port type.
— Invalid Passwords: The total number of login attempts where the 
attempting person submitted an invalid...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-59 Detecting Toll Fraud 
3
— Time: The time the invalid attempt occurred 
— Login: The invalid login that was entered as part of the login violation 
attempt. An invalid password may cause a security violation. If a 
valid login causes a security violation by entering an incorrect 
password, the Security Violation Status report lists the login.
— Port: The port on which the failed login...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-60 Detecting Toll Fraud 
3
— Date: The day that the violation occurred
— Time: The time the violation occurred
— Originator: The type of resource originating the call that generated 
the invalid authorization code access attempt. Originator types 
include:
nStation
nTrunk (other than a trunk assigned to a Remote Access trunk 
group)
nRemote Access (when the invalid authorization code is...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-61 Detecting Toll Fraud 
3
Remote Access Barrier Code Aging/Access Limits 
(DEFINITY G3V3 and Later)
For DEFINITY G3V3 and later, including DEFINITY ECS, Remote Access Barrier 
Code Aging allows the system administrator to specify both the time interval a 
barrier code is valid, and/or the number of times a barrier code can be used to 
access the Remote Access feature.
A barrier code will...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-62 Detecting Toll Fraud 
3
NOTE:
Since the amount of space available for storing this information is limited, 
you should print the entire output of the list history command immediately 
upon suspicion of toll fraud.
For DEFINITY G3V4 with the Intel
® processor, the history log has doubled in size 
to 500 entries, and provides login and logoff entries. This log includes the date, 
time, port,...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-63 Detecting Toll Fraud 
3
Service Observing
When toll fraud is suspected, this feature allows an authorized person, such as a 
security supervisor, to monitor actual calls in progress to establish whether or not 
an authorized user is on the call. The service observer has the option to listen only 
or to listen and talk.
An optional warning tone can be administered (on a per-system basis) to...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-64 Detecting Toll Fraud 
3
Busy Verification
When toll fraud is suspected, you can interrupt the call on a specified trunk group 
or extension number and monitor the call in progress. Callers will hear a long tone 
to indicate the call is being monitored.
For DEFINITY ECS, DEFINITY G1, G3, and System 75:
nEnter change station to display the Station screen for the station that will 
be...