Constant and consistent monitoring ensures any threats can be identified early and reacted to. In addition to threat monitoring, existing installations should be reviewed for changes in security requirements that may be caused by customer needs, technology, or regulation.

• Activate all necessary reporting.

• Monitor all alarms and logs, especially for repeated failed logins or other evidence of attack

• Detect other unusual activity, for example:

• New VoIP extensions

  • Forwarding set

  • Phones dialling unexpectedly

  • Unable to make outgoing calls

  • Unusual call destinations

  • Unusual call volumes or time of day/week

  • High phone bill

  • Unable to login to phones or applications

  • Unable to use voicemail

  • The string 'Barred' in SMDR reports

  • The syslog tag of 'IPTables-Rejected' in Linux server syslog events.

• Review Avaya Security advisories

• Review Avaya IP Office application notes, technical bulletins and tips

• Ensure the latest IP Office service packs are applied

• Monitor telephony provider communications

• Conduct periodic security reassessment