Lucent Technologies 5 manual A-11

MERLIN LEGEND Communications System Release 5.0	Issue 1
System Manager’s Guide 555-650-118	June 1997

ACustomer Support Information

Toll Fraud Prevention Page A-11

■Customers should also take advantage of Lucent Technologies monitoring services and devices, such as the NetPROTECTSM family of fraud-detection services, CAS with HackerTracker®, and CAT Terminal with Watchdog. Call 1 800 638-7233 to get more information on these Lucent Technologies fraud detection services and products.

Security Risks Associated with Transferring
through Voice Messaging Systems	1

Toll fraud hackers try to dial into a voice mailbox and then execute a transfer by dialing *T. The hacker then dials an access code (either 9 for Automatic Route Selection or a pooled facility code) followed by the appropriate digit string to either direct dial or access a network operator to complete the call.

NOTE:

In Release 3.1 and later systems, all extensions are initially and by default restricted from dial access to pools. In order for an extension to use a pool to access an outside line/trunk, this restriction must be removed.

Preventive Measures 1

Take the following preventive measures to limit the risk of unauthorized transfers by hackers:

■Outward restrict all MERLIN LEGEND Communications System voice mail port extension numbers. This denies access to facilities (lines/trunks). In Release 3.1 and later systems, voice mail ports are by default outward restricted.

■As an additional security step, network dialing for all extensions, including voice mail port extensions, should be processed through ARS using dial access code 9.

!SECURITYlALERT:

The MERLIN LEGEND Communications System ships with ARS activated with all extensions set to Facility Restriction Level 3, allowing all international calling. To prevent toll fraud, ARS Facility Restriction Levels (FRLs) should be established using:

■FRL 0 for restriction to internal dialing only

■FRL 2 for restriction to local network calling only

■FRL 3 for restriction to domestic ong-distance (excluding area code 809 for the Dominican Republic as this is part of the North American Numbering Plan, unless 809 is required)

■RL 4 for international calling

In Release 3.1 and later systems, default local and default toll tables are factory-assigned an FRL of 2. This simplifies the task of