Administrator's Guide

Remote Access
Issue 5 October 2002 1087555-233-506
!
SECURITY ALERT:
Avaya designed the Remote Access feature incorporated in this product that,
when properly administered by the customer, enables the customer to
minimize the ability of unauthorized persons to gain access to the network. It
is the customer’s responsibility to take the appropriate steps to properly
implement the features, evaluate and administer the various restriction
levels, protect access codes and distribute them only to individuals who have
been advised of the sensitive nature of the access information. Each
authorized user should be instructed concerning the proper use and
handling of access codes.
In rare instances, unauthorized individuals make connections to the
telecommunications network through use of remote access features. In such
an event, applicable tariffs require the customer pay all network charges for
traffic. Avaya cannot be responsible for such charges, and will not make any
allowance or give any credit for charges that result from unauthorized
access.
To ensure the security of your system, consider the following:
■ Make all remote access facilities unlisted directory telephone numbers.
■ Require users to enter a Barrier Code of at least seven random digits AND
an Authorization Code of at least 13 random digits to make network calls.
■ Make Authorization Codes nonconsecutive (random) and change them, at
least, quarterly.
■ Deactivate Authorization Codes immediately if the user leaves the
company or changes assignments.
■ Assign the minimum level of calling permissions required to each
Authorization Code.
■ Block off-hours and weekend remote access calling, when possible. Use
Alternative Facility Restriction Levels, if available.
■ Use a voice recording, warble tone, or no tone and avoid use of a dial tone
as a prompt when the remote access unit answers.
■ Assign the lowest possible FRL to only allow internal switch calls.
As an additional step to ensure System security, you can permanently disable the
Remote Access feature if you do not intend to use it now or in the future. If you do
decide to permanently disable the feature, it will require Avaya Services
intervention to activate the feature again.