Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Hold the IP Phone: Page 4 of 7

Features That Can Cause Headaches

• DISA: Traveling users make for a host of security concerns, such as how to secure DISA (Direct Inward System Access) services, which enable employees to access the corporate PBX without being directly connected to it--to retrieve voicemail, for example. While the vulnerability pertaining to DISA exists in non-IP-based PBXs, the problem is expanded when gaining access to the PBX can also give an intruder the run of the corporate data network; at the very least, intruders could have the IP PBX place long-distance calls or even crank or obscene calls that would be hard to trace.

Clearly, DISA can be a big security hole if it's not properly managed and should be used only with caller ID and, if possible, RSA Security's SecurID, or smartcard technology. Restricting DISA to only those calling from phone numbers that the system accepts, like a salesman's cell phone, means hackers will have a harder time breaking in, but the trade-off is that legitimate users will be limited in the locations from which they can access voicemail.

• Substitution: While call forwarding moves only calls from one phone to another, substitution moves all the features, including address book, access abilities and personalized speed dial. The danger is that most PBXs let administrators block certain calls to specific extensions and dictate just what calls can be made from an extension. Substitution can bypass all these safeguards by letting employees move the functions they're permitted to use to different phones. Your CEO could be walking out of the building and need to make a quick call. Instead of walking back, using substitution he could transfer the functions of his phone down to a lobby phone and get all the access he would have from his office.

This is great--unless the CEO forgets to log off the lobby phone and transfer the features back to his office. If that's not done, anyone picking up that lobby phone could have access to the CEO's call database and features. Substitution should be kept at one call and then automatically transferred back, or not used at all. At the very least, the IP PBX should be configured to reset itself once a day to put everything back where it was. Note that substitution is a temporary convenience feature and is not designed to be used when an employee moves from one office to another. That's a management area where unified messaging holds promise (see InternetWeek's "A Unified View," and "CallPilot Aces UM Challenge"). But that's another workshop.