Subscriber mailbox password administration

The administrator enables a subscriber account for voice messaging and determines the initial password for mailbox access. Administrators configure the system to prompt TUI subscribers to change their passwords the first time they access the voice mail system. Administrators can reset a subscriber password at any time but cannot view the password.

The administrator can enable password expiration that forces subscribers to change passwords at predetermined intervals. Changing the password reduces the chance that an unauthorized user can access a subscriber mailbox.

To increase security, administrators can apply the following password (PIN) policies to subscriber mailbox accounts:

Enforce a minimum password (PIN) length (3 to 15 digits, default is 4). The administrator establishes the minimum password length as a system-wide parameter.
Enforce password aging, password aging is not enabled by default.
Force password change the first time a user logs in [To enable, set a nonconforming password, for example a password that is shorter than the minimum password length, and the TUI forces the subscriber to change the password when the subscriber logs in to the mailbox for the first time. The new password must conform to the password setting rules. ]
Block break-in attempts by setting a low lockout threshold (low number of consecutive unsuccessful attempts to log in to a mailbox on the VMSC subscriber page)

The system checks the following parameters to ensure the password is not:

in sequential order, ascending or descending.
the same as the extension.
contain the extension anywhere within the password.
consist a single repeated digit.

Messaging subscribers gain access to the message server from either a desktop computer or the telephone user interface (TUI). To protect the subscriber mailbox password, ensure the following best practices:

Use desktop clients that support Secure Sockets Layer (SSL) encryption. Messaging provides native support for SSL versions of IMAP4.
Never use obvious or unimportant passwords, such as an employee identification number, a social security number, or easily guessed numeric combinations.
Do not assign a password that is the mailbox number in reverse order, a 1 followed by the mailbox number, or any similar pattern.
Discourage the practice of writing down passwords, storing them, or sharing them with others. Advise the subscriber to keep any written password in a secure place and to discard an inactive password.
Never program passwords onto telephone automatic dial buttons.

Set password expiration and complexity features to improve password security.