Verify access to modem ports if they are in the organisation's control. Otherwise, ensure appropriate controls are in place with the system maintainer. Only provide appropriate access privileges to those who need them. Regularly change maintenance and administration passwords, at least every three months, more frequently if possible. Change passwords immediately if an employee with privileged access leaves the company or if the system maintainer is changed.
Ensure passwords are difficult to guess or work out.
For example, they should not contain the company or employee name or be derived from readily available information. Maintain an audit trail of maintenance and administration activity. Review the audit trail regularly. If remote access ports are provided for system maintenance, consider dial back modems as a security measure. Remote access telephone numbers should not be easy to guess.