Learning and Development

Learning and Development OpenStage 15 Train the Trainer Training Notes Siemens Enterprise Communications Limited

TELEPHONE SYSTEMS SECURITY GUIDANCE NOTES Introduction Toll fraud and Hacking is a multi-dollar business in the USA, which has now arrived in the UK. Hackers use various methods to access a PABX, which may be done for many reasons, but primarily for obtaining free calls. This inevitably results in very large telephone bills for the hacked company. What is Hacking? When telephone system hacking began, it was achieved by people who used PCs to break into the voice mail system. Hackers used mailboxes to spread Information, conduct drug sales, post stolen credit numbers or simply to record nasty greetings for callers. Now however hackers use telephone systems to obtain outgoing trunks, they then sell this access to a community of people for dialling expensive international calls. If the incoming trunks are Freephone numbers the fraudsters enjoy the benefit of completely free calls, with the hacked company paying the bill for both ends of the call. Why has Hacking Now Become a Problem in the UK? Hacking has become a serious problem in the UK for the following reasons. The sophistication of telephone systems now available to companies in the UK. OFTEL now allows many features on PABXs such as PSTN trunk to PSTN trunk transfer to be used. Wide use of Maintenance modems on telephone systems. Sophisticated Voice Mail Systems. Widespread use of the Internet which is used for posting Hacking information. Widespread use of modems in the UK which has resulted in cheap and user friendly modems being available on the market. The huge demand for free international calls as overseas nations develop their telephone networks and business requirements. Customers either ignoring or not being aware of the hacking problem thereby leaving their telephone systems open to fraud. The widespread use of the Freephone numbers 0500 and 0800. Direct Inward System Access (DISA). By far the greatest current problem in the UK for PABX owners is toll fraud, a service that has millions of potential "customers". What Can Be Done To Prevent The PABX From Being Hacked? Hacker activity may not be completely avoidable but steps can be made to reduce the risks. The principle aim of telephone security is to deter hackers from taking control of a customer s telephone system. Fraudsters after free calls will move on to other PABXs if it takes too long to break into a system. Page 1

Hackers with a personal or political grudge against a company will spend a considerable amount of time in hacking the targeted telephone system, in order to achieve their required objective. This may be: To obtain free calls Crash the Telephone System Leave abusive messages on the Voice Mail System. So the chief objective must be to reduce the risks that expose a telephone system to being successfully hacked. Risk Factors The principle factors that attract a hacker to a telephone system are: Freephone numbers connected to the telephone system Modem Access to the Telephone System Voice Mail Systems Systems with a large amount of trunks/ddi trunks Direct Inward System Access (DISA) Once the hacker as ascertained that the targeted telephone system has one or more of the features listed above and there are inadequate counter security measures on the telephone system it will be seized by the hacker. Once seized the systems are reconfigured for fraudulent use. Systems are often not used immediately as the fraudster has to inform their "Customers" of the "toll free access number". Hacking Counter Measures The primary method of preventing fraudulent access to the telephone system is for the customer to educate their staff with regard to telephone security. Implementing all, or at least some, of the following simple steps can reduce the susceptibility of a system to being hacked. Customer Level Measures Passwords/Codes Use random numbers for PINs, which should utilise the maximum number of permissible digits. Ensure system passwords and codes are not left as default, particularly system administration passwords. Cancel passwords and security codes of departing employees. Change passwords and security codes as often as possible. Do not divulge passwords/codes over the phone. Page 2

Trunk Access Educate everyone about not connecting anyone they do not know to an outgoing trunk. Ensure effective call barring has been carried out barring the following numbers may reduce the possibility of the system being used for fraudulent calls. Note: No call barring plan should be limited to the codes listed below. 7 (CIS- former USSR) 234 (Nigeria) 1809 (Jamaica) 86 (China) 91 (India) 92 (Pakistan) 155 (International Operator) The customer should consider call allow rather than call bar on their system. They should also bar access to countries that they do not require telephone access to. Do not allow Voice Mail Systems to have trunk access. System Information Guard information on the Telephone system: Network service providers authorisation codes should be kept in a secure location. Do not write authorisation codes in notebooks. Keep all System Manuals in a secure location and do not write information that may be useful to hackers in these manuals. Cabinets used to store system manuals must be kept locked. Customers and engineers should dispose of sensitive information securely and not leave information useful to hackers in waste bins. Equipment Room Access Access to the telephone system should be restricted as much as possible. Customers should ask for identification before allowing access to the telephone system. Engineers should record all site visit details in the site logbook. Monitoring The Telephone System Fraudulent calls and Hacking attempts can be detected if the Call logging Information is reviewed on a daily basis. Immediate correct action should be taken and the Network Service Provider should be informed as soon as possible. Page 3

Engineering Level Measures Engineers must be security conscious at all times when dealing with a customer's PABX. Change the default passwords/passcodes to new codes when an installation is completed, particularly the engineering Passcodes. Destroy any customer code that has been written down before leaving site. Configure systems in accordance with the equipment security guidance information. DO NOT enable features on the telephone system that allows Dial Through. Unless the customer requests this feature. Disable any feature on the system which allows or facilitates Dial Through applications, unless specifically requested otherwise by the customer. Advise and configure any PIN digits used by the customer to be the maximum number of permitted digits. These PIN numbers must not include the customer s STD number or be related to extension numbers. Hackers are adept at finding the numbers of maintenance modems. If a maintenance modem is used, the allocated extension number should be different for each site. Maintenance modems should ideally be configured as dial back modems so that they ring back to the service centre. Under no circumstances should the customer be told the passcode for the maintenance modem. Keep all documentation up to date, accurate and secure. If a telephone system has been successfully hacked and the perpetrator is found and prosecuted, documents such as site visit log books and configuration manual may be required as evidence in court. DO NOT leave the customer with spare configured Mail box numbers and only configure the minimum amount of spare extension numbers. Ideally there should be no spare extension numbers. Educate the customer to ask for security pass from engineers requesting access to the switch room. Make sure that the customer is aware of who should be allowed entry to the equipment room and what their security passes would look like. The combined effect of carrying out these countermeasures will reduce the likelihood of a telephone system being hacked. Page 4

Table of Contents TELEPHONE SYSTEMS SECURITY GUIDANCE NOTES... 1 Table of Contents... 5 1. The OpenStage 15... 7 1.1 The Audio Keys... 8 1.2 Mailbox and Menu Keys... 8 1.3 Navigation Keys... 8 1.4 Key Module... 9 2. Making Calls Basic Functions... 10 2.1 Making a Call Off-Hook... 10 2.2 Making a Call On-Hook... 10 3. Answering Calls... 11 3.1 Answering a Call with the Handset... 11 3.2 Answering a Call with the Speaker... 11 3.3 Ending the Call... 11 3.4 Rejecting a Call... 12 3.5 Deflecting a Call... 12 4. Holding a Call... 13 4.1 Hold Ringback Timer... 13 5. Transferring Calls... 14 5.1 Transfer a Call Unannounced... 14 5.2 Transfer a Call Announced... 14 5.3 Transfer a Call Announced No Answer... 14 5.4 Aborting a Consultation Call... 14 6. Call Alternating (Toggle)... 15 6.1 Cancelling Call Alternating... 15 7. Conference... 16 8. Call Waiting (second call)... 17 8.1 Accepting 2 nd call... 17 8.2 Rejecting 2 nd Call... 17 9. Callback... 18 9.1 Placing a Callback request... 18 Page 5

9.2 Reacting on a Callback... 18 9.2.1 Accepting a Callback... 18 9.2.2 Rejecting a Callback... 18 9.2.3 Deflecting a Callback... 18 10. Call Lists... 19 10.1 View missed Calls... 19 10.2 Return a Missed Call... 19 11. Call Forwarding... 20 11.1 Programming Call Forward destinations... 20 11.2 Allocating a Destination Number to a Call Forward Type... 21 11.3 Define Duration for No Reply Forwarding... 21 11.4 Activate All Call Forwarding... 21 11.5 Deactivate call forward... 22 12. Programming Function Keys... 23 12.1 Programming a Speed Dial Key... 23 13. Handset configuration... 24 13.1 Language Settings... 24 13.2 Display contrast... 24 13.3 Date and time... 24 13.4 Daylight saving time... 25 13.5 Setting the daylight saving or standard time... 25 13.6 Time display format... 25 13.7 Date display format... 25 14. Audio Settings... 26 14.1 Handset volume... 26 14.2 Ringer melody... 26 Page 6

1. The OpenStage 15 Page 7

1.1 The Audio Keys 1.2 Mailbox and Menu Keys 1.3 Navigation Keys Page 8

1.4 Key Module The key module provides an additional 18 individual programmable keys. Together with the Shift function, it is possible to use 34 extra keys for speed dials or feature keys This Key module requires a separate power supply unit. Page 9

2. Making Calls Basic Functions You are able to make calls either off-hook or on-hook using the Speaker Key. 2.1 Making a Call Off-Hook Or Lift handset, enter number (remembering any access code eg. 9 for an outside line) Confirm on Lift Handset Confirm on last number Redial 2.2 Making a Call On-Hook Or Press the Speaker Key Enter the number to dial on the keypad Confirm Lift handset Confirm on last number Redial Page 10

3. Answering Calls When you receive a call to your handset you will be able to distinguish if the call is an External call or an Internal call by the ring tone. An External call will give a double ring tone at your handset; an Internal call will give a single ring tone at your handset. Caller s information will also appear on the graphics display. 3.1 Answering a Call with the Handset Lift handset. Raise or lower the volume if necessary Replace the handset to end the call 3.2 Answering a Call with the Speaker Or Press the Speaker Key Speaker mode is now active. Raise or lower the volume if necessary appears on the screen Press to confirm The speaker mode is now active. Raise or lower the volume if necessary 3.3 Ending the Call Or Press speaker key Press to select from Menu Page 11

3.4 Rejecting a Call An incoming call can be refused, from within the pop-up menu: Press to move through menu Select and confirm with the The caller hears the busy tone. If the caller s number is identified, it will be stored in the Missed Calls list so that they can be called back at a later date. 3.5 Deflecting a Call An incoming call can be deflected to an alternative destination providing Call Deflection is activated within the menu: Or Press to move through menu Select and confirm with the If the deflect destination number is programmed the call will be deflected immediately. If a destination telephone number has not been programmed, you will be asked in a pop-up menu to enter a destination telephone number; Enter destination number and confirm with The call will be deflected to this number. Page 12

4. Holding a Call You can place a current call on hold providing the Hold function has been activated. Whilst on a call use to select Confirm with To reconnect press on from menu. 4.1 Hold Ringback Timer This function can be activated to remind you that a call is still being held. You can set the reminder period between 3 to 15 minutes. Press the Key Arrow down to User and Select If necessary enter password and Select Configuration and Select Connected calls and Select Hold Rem. Delay and Enter a value between 3 and 15 and. Select Save & Exit and NB: Hold cannot be used with a consultation hold or after a second call has been answered. Page 13

5. Transferring Calls You are able to transfer calls Announced and Un-Announced providing the options Call Transfer and Hangup while Ringing are allowed. If you transfer a call Un-Announced to an extension and the call is not answered it will return back to the originating telephone after a pre-set time. If the extension has a Forward set, the call will follow the forwarding. 5.1 Transfer a Call Unannounced Whilst active on a call; Arrow down to Blind Transfer in the menu and confirm with Key in the required number Confirm with Replace the handset (after transferring the call successfully, the display returns to the idle mode) 5.2 Transfer a Call Announced Whilst active on a call; Or Confirm with on Consult (Caller is now on hold) Key in the required number, confirm with On answering, announce the call and if the 2 nd party accepts the call, Replace handset down Arrow down to Complete Transfer in the menu and confirm with If the 2 nd party does not accept the call, select Disc & Return in menu and confirm. You are reconnected with the 1 st party. 5.3 Transfer a Call Announced No Answer Disconnect & return is displayed in menu Confirm with You are reconnected with the 1 st party. 5.4 Aborting a Consultation Call Disconnect & return is displayed in menu Confirm with The consultation call will be terminated and connection to the 1 st party will be re-established.. Page 14

6. Call Alternating (Toggle) The call alternating feature enables the user to toggle between two calls (internal/external or Network calls) when conducting a Consultation call. The above calls can be either made or received by the user. With one call established, Confirm with on Consult in menu Establish second call Confirm with on Alternate in menu. Use repeatedly to switch between the two parties. To connect the two calls together, select Complete Transfer in menu and confirm with or replace handset. 6.1 Cancelling Call Alternating Whilst connected to the party you wish to disconnect from, Arrow down to Disc & Return in menu and confirm with. (You are reconnected with the remaining party) Page 15

7. Conference A three party conference can be established as a local conference. Whilst conducting a consultation call: Arrow down to Conference and confirm with You are connected to both parties. To disconnect one party: Arrow down to the connection that you wish to disconnect Press Press on Disconnect Page 16

8. Call Waiting (second call) You can accept a second incoming call whilst already using the telephone. The caller hears the ringing tone whilst you hear a call waiting signal. This call can be ignored or accepted. 8.1 Accepting 2 nd call In the display Or Select Accept by pressing You are immediately connected to the 2 nd party and the 1 st party is on hold Select Disconnect & Return to disconnect the 2 nd party and return to 1 st caller Select Alternate to go between the two calls 8.2 Rejecting 2 nd Call In the display menu, Arrow down and choose from the following options: Ignore Reject Deflect The caller number is added to the missed call list. Page 17

9. Callback A callback request can be set if the required party is busy or does not reply. 9.1 Placing a Callback request Dial the number required. If the other party is busy or does not reply. The screen will show Callback. Select and confirm with When the required number becomes free (on busy) or the extension is next used (on no reply) your phone will ring to advise you. NB: The Callback feature has to be activated by the administrator. 9.2 Reacting on a Callback When the required number becomes free (on busy) or the extension is next used (on no reply) your telephone will ring and the display will show the caller information along with the Callback icon. The pop-up menu opens: 9.2.1 Accepting a Callback is displayed in the screen confirm to accept the call by pressing 9.2.2 Rejecting a Callback Arrow down to and confirm with The Callback request will be deleted and the caller hears a busy tone. The telephone number and further information of the caller are saved in the Call List for Missed Calls. 9.2.3 Deflecting a Callback Arrow down to and confirm with Enter the number you wish to deflect the callback to and confirm. Page 18

10. Call Lists Calls received while you are absent are indicated by a message on the idle display. The key will also be lit. The Call Lists logs all dialled, received, missed and forwarded calls in chronological order. Any calls not showing CLI will be logged as UnKnown Each lists holds up to 30 entries. Multiple calls from the same number are only listed once. 10.1 View missed Calls Press the key Arrow down and select Arrow down to view any missed calls. 10.2 Return a Missed Call Select the required entry from the missed call list Arrow down and Select The number is now being dialled. Page 19

11. Call Forwarding This feature enables a user to forward their calls to another destination if unavailable. There are four types of Call Forwarding which can be programmed in the Forward menu; All Calls On no reply On busy Locked Phone Due to it s immediate effect, the All Calls type of forwarding has a higher priority than the no reply or busy types. If Forwarding All Calls is activated, the forwarding icon your telephone is in the idle mode) is shown on the display (when Any forwarded calls will be listed in the Forwarded tab of the Call Log 11.1 Programming Call Forward destinations You can store up to five destination telephone numbers for Call Forwarding. These destinations can be allocated to the several forwarding settings. Press key. Select User from Menu and confirm. Enter password if prompted Arrow down to Configuration and confirm with Arrow down to Incoming Calls and confirm with Arrow down to Forwarding and confirm with Select Settings Arrow down to Destination and confirm with Arrow down to Edit Favourites and confirm with Arrow down to Destination 1 and confirm with Enter the telephone number and confirm with Arrow down to Save & Exit and select twice NB: You can also save the Destination via any of the Destination Number options for each particular Call Forwarding mode. Page 20

11.2 Allocating a Destination Number to a Call Forward Type Press key. Select User from Menu and confirm. Arrow down to Configuration and confirm with Arrow down to Incoming Calls and confirm with Arrow down to Forwarding and confirm with Select Settings Arrow down to Destination for desired Call Forwarding type and confirm with Select required Destination Number from list Arrow down to Save & Exit and select twice. 11.3 Define Duration for No Reply Forwarding You can define how often the telephone rings before the No Reply forwarding is activated. Press key. Select User from Menu and confirm with. Arrow down to Configuration and confirm with Arrow down to Incoming Calls and confirm with Arrow down to Forwarding and confirm with Select Settings Arrow down to Duration and confirm with Enter the amount of seconds required and confirm with Arrow down to Save & Exit and select twice. 11.4 Activate All Call Forwarding To activate the All calls forwarding function you can have a pre-programmed key allocated to your phone s key layout. Alternatively you go activate through the Menu Key, providing a forwarding destination has been programmed for any of the different types of forwardings. Press key. Select User from Menu and confirm. Enter password if prompted Arrow down to Configuration and confirm with Arrow down to Incoming Calls and confirm with Arrow down to Forwarding and confirm with Select Settings Arrow down to Forwarding Type and confirm with Toggle to ON using the arrow keys and confirm with Arrow down to Save & Exit and select twice Page 21

11.5 Deactivate call forward Press key. Select User from Menu and confirm. Enter password if prompted Arrow down to Configuration and confirm with Arrow down to Incoming Calls and confirm with Arrow down to Forwarding and confirm with Select Settings Arrow down to Forwarding Type and confirm with Toggle to OFF using the arrow keys and confirm with Arrow down to Save & Exit and select twice Page 22

12. Programming Function Keys Press and hold the programmable key you want to program until the input field opens. The key illuminates continuously. Arrow down and press on Normal to program the first level Or Shifted to program the second level Arrow down and press on Selected Dialling (or any other type of function required) from the list Press on Save & Exit twice 12.1 Programming a Speed Dial Key Press and hold the programmable key you want to program until the input field opens. The key illuminates continuously. Arrow down & press on Settings under Normal or Shifted Arrow down to Mode & press until it changes to numerical Enter the required destination number and select Arrow down and select Save & Exit twice Page 23

13. Handset configuration 13.1 Language Settings Press the Key Select User and confirm Enter password and confirm if necessary Arrow down to Locality? and confirm Arrow down to Language? and confirm Arrow down to Language required and confirm Arrow down to Save and Exit and select OK twice 13.2 Display contrast Press the Key Select User and confirm Enter password and confirm if necessary Arrow down to Phone and confirm Select Display and confirm Arrow down to Contrast and confirm Set the contrast with or and confirm Arrow down to Save and Exit and select twice 13.3 Date and time Press the Key Select User and confirm Enter password and confirm if necessary Arrow down to Date and time and confirm Select Time or Date and confirm Enter and confirm the time or date Select Save and Exit twice Page 24

13.4 Daylight saving time Press the Key Select User and confirm Enter password and confirm if necessary Arrow down to Date and time and confirm Arrow down to Daylight saving and confirm Select Yes and confirm Select Save and Exit twice 13.5 Setting the daylight saving or standard time Press the Key Select User and confirm Enter password and confirm if necessary Arrow down to Date and time and confirm Arrow down to Difference (mins) and confirm Enter the difference in minutes and confirm Select Save and Exit twice 13.6 Time display format Press the Key Select User and confirm Enter password and confirm if necessary Arrow down to Locality and confirm Arrow down to Time format and confirm Select 24 hour and confirm Arrow down to Save and Exit and select twice 13.7 Date display format Press the Key Select User and confirm Enter password and confirm if necessary Arrow down to Locality and confirm Arrow down to Date format and confirm Select dd/mm/yy and confirm Arrow down to Save and Exit and select twice Page 25

14. Audio Settings 14.1 Handset volume Press the Key Select User and confirm Enter password and confirm if necessary Arrow down to Audio and confirm Arrow down to Volumes and confirm Arrow down to Handset and confirm Use or to set volume and confirm Select Save and Exit twice 14.2 Ringer melody Press the Key Select User and confirm Enter password and confirm if necessary Arrow down to Audio and confirm Arrow down to Settings and confirm Arrow down to Ringer melody and confirm Choose option required 1 8 and confirm Select Save and Exit twice Page 26

Please make use of this page for any Notes you may have Page 27

Copyright Siemens Enterprise Communications Limited 2008. All rights reserved. The information contained herein is the property of Siemens Enterprise Communications Limited and is supplied without liability for errors or omissions. No part may be reproduced or used except as authorised by contract or other written permission. The copyright and the foregoing restriction on reproduction and use extend to all media in which the information may be embodied. Our Learning Solutions can be accessed directly at www.siemens.co.uk/com-training