Lucent Technologies BCS Products Security Handbook

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-5 Keeping Unauthorized Third Parties from Entering the System 
3
Figure 3-1. Remote Access Call Path
INCOMING
REMOTE
ACCESS CALL
YES
YES
NO
YES
CODE?VALID
CODE ENTERED
CODE?VALID
STOP
BARRIER
CODE
REQUIRED?NO
APPLY SECURITY
VIOLATION NOTIFICATION
STOP
NO
STOP
YES
ROUTE TO ATTENDANT
OR DISCONNECT
STOPNO
CODE ENTERED
ACCESS DIAL
TONE?
LOG INVALID ATTEMPT
DISCONNECT CALL
SYSTEM DIAL TONECALL...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-6 Keeping Unauthorized Third Parties from Entering the System 
3
For DEFINITY ECS, DEFINITY G1, G3, and System 75, you can assign up to 10 
barrier codes to provide the first checkpoint. When barrier codes are required for 
Remote Access, callers hear a special dial tone, and then must enter a valid 
barrier code before they can access the PBX system.
NOTE:
With DEFINITY ECS, DEFINITY G1, G3,...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-7 Keeping Unauthorized Third Parties from Entering the System 
3
code should be used to screen entry into Remote Access; authorization codes 
can then be used to screen outgoing calls on Automatic Alternate Routing (AAR), 
Automatic Route Selection (ARS), and World Class Routing (WCR) (G2.2) trunks.
Authorization Codes1
NOTE:
For all systems, once established, the number of digits (four to...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-8 Keeping Unauthorized Third Parties from Entering the System 
3
System 85, DEFINITY G2, and G3 users. However, it is best to keep the number 
of authorized users to a minimum.
To maximize the security of the system, follow these steps:
nWhen assigning authorization codes, give the users the lowest possible 
FRL needed for their calling requirements.
nBe sure to remove any unused...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-9 Keeping Unauthorized Third Parties from Entering the System 
3
For DEFINITY ECS, DEFINITY G1, G3, and System 75, trunks translated for 
Remote Access can be given a night service destination. Although it is not 
recommended, trunks accessing the system can be assigned a Remote Access 
extension as a night service destination. The system will change to either allow or 
deny access for a...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-10 Keeping Unauthorized Third Parties from Entering the System 
3
dialed (or inferred), routes calls to the vector. Calls processed by the vector 
carry the permissions and restrictions associated with the COR of the VDN
.
In order to deny incoming callers access to outgoing facilities, including tie lines, 
configure the COR of the VDN to prohibit outgoing access. To do this, follow the...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-11 Tools that Restrict Unauthorized Outgoing Calls 
3
Use of the acknowledgment option is strongly recommended for those systems 
utilizing both Remote Access and Facility Test Call (for notification if the feature is 
inadvertently left enabled), or those systems requiring notification if Facility Test 
Call is linked to hacking activity.
Tools that Restrict Unauthorized 
Outgoing Calls
Use...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-12 Tools that Restrict Unauthorized Outgoing Calls 
3
Class of Restriction
For DEFINITY ECS, DEFINITY G1, G3, and System 75, the Class of Restriction 
(COR) places calling permissions and restrictions on both the calling party and the 
called extension. Up to 64 CORs can be defined in the system. For DEFINITY 
ECS, DEFINITY G3rV1, G3i-Global, and G3V2, the number of CORs has been 
increased...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-13 Tools that Restrict Unauthorized Outgoing Calls 
3
The following restrictions can be placed on the originating station or trunk:
nOutward Restricted: cannot make Public Network Calls via AAR/ARS or 
TACs. Calls can be placed to internal stations, to tie trunks via TACs, and 
off-switch via the Uniform Dial Plan (UDP).
NOTE:
Some states require that all telephones be able to dial emergency...

BCS Products
Security Handbook  
555-025-600  Issue 6
December 1997
Large Business Communications Systems 
Page 3-14 Tools that Restrict Unauthorized Outgoing Calls 
3
accessed. After the vector is accessed, the COR of the VDN is used 
for further call permission checking. See also ‘‘
Restriction Override 
(3-way COR Check)’’ on page 3-14.
Restriction Override (3-way COR Check)
The Restriction Override feature, which is available only with DEFINITY 
G3i-Global and G3V2 and later, determines whether or...