Security specification

Last Updated : Aug 24, 2021 |

The Avaya Product Security Support Team (PSST) responds to ongoing security vulnerabilities for all Avaya Products. For more information, see Avaya Product Security Vulnerability Response Policy and Avaya Security Vulnerability Classification at the Avaya Support website at https://support.avaya.com/security.

Default security

The IP Office software security engine is supplied by Mocana Corporation. For more information, see https://www.mocana.com.

Security features are built-in into the software platform. These features consist of:
  • Integrated firewall to prevent Denial of Service (DoS) attacks

  • Secure connections to ensure the privacy and integrity of transmitted information including:
    • TSL on administration interfaces

    • HTTPS client

    • HTTPS server

    • IPSec

    • SIP-TLS

    • SSL/VPN

    • VMPro/Exchange MAPI integration (TLS)

Configurable security

Configurable security settings include the following features:
  • Encryption and message authentication

  • Configuring integrated firewall settings

  • Digital certificates

  • Prevention of tool fraud by restricting user privileges and using security policy configuration to manage account credentials and access control

See Avaya IP Office™ Platform Security Guidelines for more information.

Network security

Network security leverages resources such as VLANs and firewalls available on the enterprise network and includes:
  • External firewall configuration

  • Separate of network functionality by creating separate VLAN groups and security zones

  • Hardening of Layer 2 (data link layer) and Layer 3 (Network layer) by configuring SNMP trap destinations, syslog entries, and an IPSec VPN.

  • SSL/VPN remote access

Operational security

Ongoing operational security to maintain a secure system includes:
  • Patching

  • Logging and monitoring

  • Virus protection