ISO 17799 of the International Standards Organization, Information technology - Security techniques - Code of practice for information security management, is an internationally-accepted standard of good practice for information security. ISO 17799 suggests a well structured set of controls to address information security risks, covering confidentiality, integrity and availability aspects. None of the suggested controls is mandatory, however, an organization wishing to be in compliance should show a security strategy that explains the decision not to implement key controls.
The following table shows how ISO 17799 addresses the different categories of data security management.
| ISO 17799 Security Guidelines | Messaging features and processes |
|---|---|
| Ensure that applications process information correctly | |
|
Use the System Log and Maintenance Alarm and Event logs. |
|
Messaging can track administration and notify the administrator when changes are made. Use the System Log, and the Maintenance Alarm and Event logs. |
|
Use digital certificates when transmitting data to ensure authorization.
Restrict access to the system with logins, passwords, and authentication keys. |
|
Use audits and status reports to verify output. |
|
Encrypt data to protect data from packet-sniffing and eavesdropping. |
| Protect and control the system files of your organization | |
|
Messaging requires the appropriate access control in order to install software. In addition, a digital certificate from the software ensures the software is allowed to be installed on the server.
See |
|
Avaya uses internal ISO-certified testing processes for software. |
|
Messaging source code is not accessible outside of Avaya. The Red Hat Linux operating system is also restricted.
See |
| Control development and support processes | |
|
Avaya uses internal ISO-certified change control processes for software. For security-related updates, Avaya uses a change policy as documented in How Avaya delivers security updates. |
|
Avaya uses internal ISO-certified test procedures after operating system changes. See Validating a security update. |
|
Avaya includes only the Linux software packages it needs for Messaging. Messaging software is proprietary, and Linux software cannot be changed on an installed system. Standard program binaries are normally installed with write permissions only to the super-user (root) and cannot be modified. |
|
Messaging does not have antivirus, antiworm, or antitrojan software. However, Avaya does not recommend using third-party antivirus software on Messaging. For more information, see Planning against viruses and worms and other malicious code. |
|
Avaya software, if outsourced, is developed according to Avaya’s ISO-certified processes. |
| Control your technical system vulnerabilities | Messaging offers many features and processes to protect the customer’s communications network. See:
|