As I move along in my installation, rcsinfo brought up the question of ensuring the system was secured to avoid a huge long distance bill.

So what should I look for to ensure that this does not happen?

I understand the basics of "Change the default passwords" but is there anything else I should check out to make sure things are secure?

If it has a direct connection to the Internet, ensure that the firewal feature set is properly configured.

If using a SIP trunk service and you need to open port 5060, ensure that you configure the system to only accept calls from specific IP addresses and networks, typically only your inside voice networks and ITSP servers.

Configure your AA to disallow callers from making external calls via the AA.

Use SSH vice telnet if accessing direct from the Internet and limit to specific IP addresses that are allowed to connect.

Implement the advanced login protections if accessible via the Internet to reduce the attack surface.

Configure NTP servers and enable logging.

Use strong passwords.