Security

Avaya recognizes that cloud solution security is a primary customer concern. The Avaya Cloud Public Security Playbook illustrates our: 

• 360º security visibility  
• Global security intelligence 
• Sophisticated customer-facing controls
• Secure and hardened CCaaS solution 

The supported access control methods are:

• Role-based access control (RBAC)
• Mandatory access control (MAC)
• Discretionary access control (DAC)

Multi-tenant RBAC provides fine-grained access management of Contact Center resources. Using RBAC, a customer may segregate duties within your organization and grant only the amount of access to users and applications that they need to perform their roles. Between you the Customer and Avaya the Provider, we employ Segregation of Duties (SoD) as a security strategy and to maintain compliance regulations. 

Avaya Experience Platform solutions provide RBAC for granular control of users. The Admin Center uses a unique account ID across all APIs, events, and data to prevent unauthorized access to the data of a customer. These roles are pre-configured or built-in to cover different job functions related to administration and contact center operations. You can define permissions on the protected resources and map these permissions to built-in roles during installation. The built-in roles are:

• System administrator 
• Auditor 
• Security administrator 
• Tenant administrator 
• Supervisor 
• Reporting user 
• Operations manager or analyst 

Yes, however, the list of IP addresses may change over time as per Azure range assignments for various cloud components and regions.  Inbound traffic through public APIs and Admin panels can be restricted at Avaya Experience Platform solution level.

Avaya cloud solutions use encryption to protect all data in transit and at rest. Data in transit uses Transport Layer Security (TLS) version 1.2+. The Cloud platform complies to Federal Information Processing Standards (FIPS) 140-2 and National Institute of Standards and Technology (NIST) standards to underpin our security protocols, standards, and encryption practices. Key Vault Technology is used to maintain trust and to ensure the security and integrity of:

• Secrets Management: tokens, passwords, certificates, and API keys
• Key Management: controlling the encryption keys used to encrypt your data
• Certificate Management: deploy the platform that supports public and private TLS/SSL certificates
• Strong encryption is achieved by using 2048-bit public/private key pairs to create unreadable records that may be safely stored
• Keys support the encryption of API transactions, passwords, certificates, or cryptographic exchanges

We proactively identify and monitor threats utilizing User and Entity Behavior Analytics (UEBA) to detect:  

• Zero-day
• Targeted attacks
• Advanced persistent threats

Our partners, security teams, and tools continuously monitor and isolate threats in real-time via operational proactive response 24x7x365 and incident handling processes.

To maintain security and to ensure trust and integrity, we maintain security change audit logging of our entire cloud real estate: 

• Restricting change via pipeline and maintaining:  

• Active audit trail 

• Activity logs 

• Audit reports 

• Diagnostic services, logs, and metrics (such as key vault audit) 

• Network Security Group (NSG) flow logs and event logs 

• Cloud monitoring, Cloud network watching, and Cloud real-time scanning  

• Audit data retention and archiving to meet sovereignty and regulatory processes  

• Retention period for monitor logs is 365 days and we can configure with a maximum of two years 

Support for Avaya cloud solutions is based on ITIL®️ processes, including service desk, service management, incident management, problem management, and change management.

For Avaya cloud solutions, customers receive an email with details of the updates being applied to the environment through the standard notification processes for all planned maintenance and emergency changes.

Avaya enables the export of audit trace logs to integrate a customer SIEM. RWS admin can download application configuration change logs, Product activity and resource logs aren't exportable, and the retention period is 90 days, but it is configurable.

Yes. Systems are scanned with Qualys and patched according to Avaya’s vulnerability and patch management security standard. Avaya conducts vulnerability assessment and penetration testing on a regular cadence to maintain targeted regulatory compliances. Please note: Avaya doesn’t allow our customers to conduct vulnerability assessment and penetrating testing on Avaya Experience Platform.