AT&T 3 manual Security Policy and User Education

System Administrator’s Responsibilities

Security Policy and User Education

As a safeguard against toll fraud, establish policies and educate all mail system users:

■All reports of trouble, requests to move extensions, or any other administrative details associated with the communications system or the mail system should be handled by one person (the System Administrator) or within one department. Anyone claiming to be a telephone company representative should be referred to this person or department.

■If a caller claims to be an authorized telephone company representative, verify his or her identity before permitting that person any access to the system.

■Establish well-controlled procedures for passwords.

—Establish a specific date for changing passwords (for example, the first of each month) and help users remember to do it.

—Tell users what the Minimum Password Length is.

—Tell users that passwords should not be recycled. They should be hard to guess and should not contain:

■All the same numbers (for example, 666666).

■Sequential characters (for example, 123456).

■Personal information that can be associated with them (such as their name, birthdate, telephone number, or social security number).

—Discourage the practice of writing down passwords, If a password needs to be written down, keep it in a secure place and never discard it while it is still active.

—Tell users never to program passwords onto Auto Dial buttons. Display phones reveal the programmed numbers and internal abusers can use the Auto Dial buttons to originate unauthorized calls.

■Educate employees that hackers may try to trick them into providing them with dial tone or dialing a number for them.

■Ask users to tell you if any of the following suspicious activity occurs:

—Inability to log into Voice Mail.

—Lost mail messages, mailbox lockout, or altered greetings.

—Inability to get an outside line.

—Series of calls where there is silence on the other end or the caller hangs up.

—Sudden increase in wrong numbers.

—Caller complaints that your lines are busy

Introduction 1-13