Lucent Technologies DEFINITY System Little Instructions Manual

							DEFINITY System’s Little Instruction Book
for basic administration  555-233-756  Issue 1
April 2000
Enhancing system security 
75 Assigning and changing users 
Changing passwords
You should change your passwords often.
Tip:
To force users to change passwords, set password aging in the 
Login Administration screen.
To change the password (b3stm0m) for angi3:
1. Type
 change password angi3 and press RETURN.
The Password Administration screen appears.
2. Complete the following fields:
nPassword of Login Making Change
This is your password that you used to login to the 
session.
nLogin Name
nLogin’s Password
nReenter Login’s Password
3. Press 
EN TER to save your changes. 
						

							Enhancing system security 
76 Preventing toll fraud 
DEFINITY System’s Little Instruction Book
for basic administration  555-233-756  Issue 1
April 2000
Changing logins
Occasionally you’ll need to change permissions for a user’s login. 
For example, you may want to change a login so that the user 
must change their password every 30 days (a good rule of 
thumb).
To change the password aging for our new login, angi3:
1. Type 
change login angi3 and press RETURN.
The Login Administration screen appears with the current 
information for angi3.
2. Type 
30 in the Password Aging Cycle Length (Days) field.
3. Press 
EN TER to save your changes.
Preventing toll fraud
An important role for every administrator is to manage the 
security of their phone system. You need to make every effort to 
ensure that your phone system is not open to toll fraud. Toll fraud 
is the unauthorized use of telephone features and services and the 
theft of long distance service. When toll fraud occurs, your 
company is responsible for charges.
For more information on system security and preventing toll 
fraud, we recommend you obtain the BCS Products Security 
Handbook and use it often, or call your Center of Excellence.
!SECURITY ALERT:
When you suspect toll fraud, call the Security Hotline 
immediately (+1 800 643 2353) or contact your Lucent 
representative. 
						

							DEFINITY System’s Little Instruction Book
for basic administration  555-233-756  Issue 1
April 2000
Enhancing system security 
77 Preventing toll fraud 
Top 11 tips to help prevent toll fraud
You can reduce your company’s risk of toll fraud by following a 
few important guidelines.
1. Protect system administration from unauthorized access.
Make sure all system administration and maintenance 
logins are secure. Change your passwords frequently.
2. Deny unauthorized remote access.
If you do not use remote access, disable all its related 
features. If you use remote access, require barrier codes 
and set your authorization codes, if applicable, at the 
maximum length. Also, change these codes frequently.
3. Restrict individual ability to make international calls.
Set up class of restriction groups to allow only certain 
people to call international numbers required for your 
business.
4. Protect access to information stored in voice mail.
Require passwords for access to voice mailboxes. Use 
complicated passwords and change the passwords 
regularly.
5. Deny any transfer from a voice mail system to a dial tone.
Place restrictions on the ports that allow access to and 
from your voice mail system. Activate “secure transfer” 
features in voice mail systems. 
						

							Enhancing system security 
78 Preventing toll fraud 
DEFINITY System’s Little Instruction Book
for basic administration  555-233-756  Issue 1
April 2000
6. Use system software to intelligently control call routing.
Set up your system to control how each call is handled or 
routed. If possible, use time-of-day routing to limit the use 
of your system during off hours.
7. Place protection on systems that ask callers to dial digits.
Restrict certain users’ access to dial tone. Restrict the digit 
combinations dialed at prompts.
8. Monitor traffic and system activity for suspicious call 
patterns.
Use your traffic reports and call detail records to monitor 
call activity. Activate features that deny access to your 
system when unauthorized attempts are detected. 
9. Provide physical security for telecommunications assets.
Restrict unauthorized access to equipment rooms and wire 
connection closets. Keep translation backups, system 
manuals, and reports in a safe place.
10. Educate system users to recognize toll fraud activity and 
react appropriately.
Train your users how to protect themselves from 
inadvertent compromises to system security.
11. Monitor call traffic over vectors.
Vector fraud is one of the most common types of toll fraud 
because vectors route calls based on the class of restriction 
(COR) assigned to the VDN. Refer to BCS Products 
Security Handbook or your Lucent representative for more 
information. 
						

							DEFINITY System’s Little Instruction Book
for basic administration  555-233-756  Issue 1
April 2000
Enhancing system security 
79 Using reports to detect problems 
Using reports to detect problems
Call Detail Recording
Call Detail Recording (CDR) collects detailed information about 
calls handled by your system. This CDR information can be sent 
directly to a printer or into call accounting software. You can use 
the printed CDR output or call accounting reports to monitor calls 
on your system and look for possible toll fraud problems.
Review your call accounting reports or CDR output each day to 
help detect possible toll fraud. When reviewing these records, 
look for:
nunusual calling patterns
— numerous calls to the same number
— calls outside of normal business hours
— long calls
ncalls to suspicious destinations, including international 
calls not typical for your business
npatterns of authorization code usage (same code used 
simultaneously or high activity)
nhigh numbers of “ineffective call attempts” indicating 
attempts at entering invalid codes
nundefined account codes
If you are unfamiliar with reading CDR printed output, you’ll 
want to refer to the description of CDR in the DEFINITY ECS 
Administrator’s Guide. 
						

							Enhancing system security 
80 Using reports to detect problems 
DEFINITY System’s Little Instruction Book
for basic administration  555-233-756  Issue 1
April 2000
If your organization uses call accounting software to analyze your 
CDR output, you probably receive formatted reports that list the 
information you need to detect possible toll fraud. If you have 
questions about reading your call accounting reports, refer to your 
call accounting software manuals.
Security Violations Notification
You can administer Security Violations Notification so that the 
system notifies you and provides reports when users enter invalid 
information. You want to know about the following types of 
violations, which may indicate an attempt to breach your 
security:
nlogin violations
nremote access barrier code violations
nauthorization code violations
nstation security code violations
For example, let’s have the system notify us at extension 8000 
when someone tries to enter more than 3 invalid authorization 
codes within a 1-minute time span. 
						

							DEFINITY System’s Little Instruction Book
for basic administration  555-233-756  Issue 1
April 2000
Enhancing system security 
81 Using reports to detect problems 
To set up Security Violations Notification for our example:
1. Type 
change system-parameters security and press 
RETURN.
The Security-Related System Parameters screen appears.
Security-Related System Parameters screen
2. In the SVN Authorization Code Violation Notification 
Enabled field, type 
y and press RETU RN.
Additional fields now display on the screen.
3. In the Originating Extension field, type the extension you 
want the system to use to originate the call.
Use the extension of an unused non-dial station.
4. Enter 
8000 in the Referral Destination field.
Use the extension you want the system to notify.
5. If the referral destination is on a different system or is a 
non-display phone, fill in the Announcement Extension 
field.
                      SECURITY-RELATED SYSTEM PARAMETERS
SECURITY VIOLATION NOTIFICATION PARAMETERS
 SVN Login Violation Notification Enabled? n
 SVN Remote Access Violation Notification Enabled? n
       
SVN Authorization Code Violation Notification Enabled? y
       Originating Extension: _____     Referral Destination: 8000Authorization Code Threshold: 3_               Time Interval: 0:01      Announcement Extension: _____ 
						

							Enhancing system security 
82 Using reports to detect problems 
DEFINITY System’s Little Instruction Book
for basic administration  555-233-756  Issue 1
April 2000
6. Enter 3 in the Authorization Code Threshold field. 
Enter the maximum number of invalid entry attempts you 
want to allow.
7. Enter 
0:01 (1 minute) in the Time Interval field.
Use an hour:minute format for the amount of time you 
want the system to use for the monitor interval.
8. Press 
EN TER to save your changes.
Viewing security reports
Your system generates two types of Security Violations reports:
nSecurity Violations Detail report — displays the number of 
successful and failed login attempts by login ID.
nSecurity Violations Summary report — displays valid and 
failed access attempts, as well as security violations for 
logins, authorization codes, barrier codes, and station 
security codes.
To display a Security Violations Detail report and see a list of 
login data:
1. Type 
list measurements security-violations detail and 
press 
RETU RN.
To display a Security Violations Summary report:
1. Type 
list measurements security-violations summary 
and press RETURN. 
						

							DEFINITY System’s Little Instruction Book
for basic administration  555-233-756  Issue 1
April 2000
Enhancing system security 
83 Using reports to detect problems 
Printing security reports
You may want to keep a paper copy of a Security Violations 
report to monitor security trends for a specific time period.
To print a Security Violations Summary report to the slave printer 
associated with the administration terminal:
1. Type 
list measurements security-violations summary 
print
 and press RETURN.
To print a Security Violations Summary report to the system 
printer:
1. Type 
list measurements security-violations summary 
schedule
 and press RETURN.
The system prompts whether you want to print the report 
immediately or schedule to print it later.
2. Enter the appropriate Print Interval and press 
EN TER to send 
the report.
Clearing security reports
Once you review the security measurement reports, you may 
want to clear the current measurements and reset the Counted 
Since field.
To clear measurements for security violations and reset the 
counter:
1. Type 
clear measurements security-violations and press 
RETURN. 
						

							Enhancing system security 
84 Using reports to detect problems 
DEFINITY System’s Little Instruction Book
for basic administration  555-233-756  Issue 1
April 2000