The latest software addresses the issues that allowed the systems to be hacked. It seems like you followed best practices, some of the WORST practices would be: allowing administration from the WAN without a VPN first.

What was allowing this to happen is that the passwords of phones registered with older software assigned a DEFAULT password to those phones. As you know from creating SIP accounts for soft phones, you need a userid and a password....all passwords for registered handsets are default. Once you know that, you can pretty much connect with a softphone and a few tricks and make all of the calls you like without knowing the remote (pnp) key or anything.

In short: upgrade to the latest software, and you should not need to take any other special precautions. (Although I agree with the DO NOT ALLOW AUTO CREATE OF WAN HANDSETS...if this is a problem, enable it remotely, let the user connect, and then disable it again...you'll be getting the call anyway, so no big deal, right?)