Using reports to detect problems
14. Callers misrepresenting themselves as the “phone company,”
“AT&T,” “RBOCS,” or even known employees within your company may claim to be testing the lines and ask to be transferred to “900,” “90,” or ask the attendant to do “start 9 release.” This transfer reaches an outside operator, allowing the unauthorized caller to place a long distance or international call.
Instruct your users to never transfer these calls. Do not assume that if “trunk to trunk transfer” is blocked this cannot happen.
15. Hackers run random generator PC programs to detect dial tone.
Then they revisit those lines to break barrier codes and/or authorization codes to make fraudulent calls or resell their services. They do this using your telephone lines to incur the cost of the call.
Frequently these call/sell operations are conducted at public pay telephones located in subways, shopping malls, or airport locations. See the “QSIG to DCS TSC Gateway” section in the
Administrator Guide for Avaya Communication Manager to prevent this happening to your company.
Vector fraud is one of the most common types of toll fraud because vectors route calls based on the Class of Restriction (COR) assigned to the VDN. For more information, see the Avaya Toll Fraud and
Security Handbook, or contact your Avaya representative.
Using reports to detect problems
Call Detail Recording
Call Detail Recording (CDR) collects detailed information about calls handled by your system. This CDR information can be sent directly to a printer or into call accounting software. You can use the printed
CDR output or call accounting reports to monitor calls on your system and look for possible toll fraud problems.
Issue 3 February 2007 93
Enhancing system security
Review your call accounting reports or CDR output each day to help detect possible toll fraud. When reviewing these records, look for:
● unusual calling patterns
numerous calls to the same number
calls outside of normal business hours
long calls
● calls to suspicious destinations, including international calls not typical for your business
● patterns of authorization code usage (same code used simultaneously or high activity)
● high numbers of “ineffective call attempts” indicating attempts at entering invalid codes
● undefined account codes
● attempts to change the access code or to use an invalid access code when using conferencing features.
If you are unfamiliar with reading CDR printed output, see the description of CDR in the Administrator Guide for Avaya
Communication Manager.
If your organization uses call accounting software to analyze your
CDR output, you probably receive formatted reports that list the information you need to detect possible toll fraud. If you have questions about reading your call accounting reports, see your call accounting software manuals.
94 Basic Administration Quick Reference
Using reports to detect problems
Security Violations Notification
You can administer Security Violations Notification (SVN) so that the system notifies you and provides reports when users enter invalid information. You want to know about the following types of violations, which may indicate an attempt to breach your security:
● login violations
● remote access barrier code violations
● authorization code violations
● telephone security code violations
For example, you can have the system notify you at your extension when someone tries to enter more than 3 invalid authorization codes within a 1-minute time span.
For more details and examples, see the Enhancing System Security section in the Administrator Guide for Avaya Communication
Manager.
Issue 3 February 2007 95
Enhancing system security
96 Basic Administration Quick Reference
