I am curious as to why you are so concerned about the security at the console port. Keep in mind, even with very secure passwords and remote authentication, if someone has console access and knows what they are doing, then as jayh says, its pretty much game over from there. However, that calls into question the security of the physical location of the unit. Furthermore, if someone has physical access to the unit to attempt to gain console access, it is going to require rebooting the unit or bringing it down in some way. If you are using a monitoring system, you should get an alert that your IAD is down. You could also setup a syslog server pretty cheaply/easily and turn up your logging and dump it all to syslog so you can inspect it on a regular basis, including config changes.
Speaking from a carrier's perspective, the wording of the contract is such that the carrier is protected and not liable for silly or goofed up configuration changes by inexperienced users. Its actually a little surprising that you have an equipment lease that you are allowed to make config changes on. Normally that is left to the service provider. If you don't have access to use remote authentication protocols, lock your telnet down via an access list (only accept connections from specific IP addresses), secure the console with a complex password, and make sure the physical location of your equipment is secure.
